WO2021208027A1 - 一种入网双向鉴权的方法及装置 - Google Patents

一种入网双向鉴权的方法及装置 Download PDF

Info

Publication number
WO2021208027A1
WO2021208027A1 PCT/CN2020/085156 CN2020085156W WO2021208027A1 WO 2021208027 A1 WO2021208027 A1 WO 2021208027A1 CN 2020085156 W CN2020085156 W CN 2020085156W WO 2021208027 A1 WO2021208027 A1 WO 2021208027A1
Authority
WO
WIPO (PCT)
Prior art keywords
node
base station
authentication information
authentication
access point
Prior art date
Application number
PCT/CN2020/085156
Other languages
English (en)
French (fr)
Inventor
张西乐
张叶飞
张磊
Original Assignee
青岛交互物联科技有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 青岛交互物联科技有限公司 filed Critical 青岛交互物联科技有限公司
Publication of WO2021208027A1 publication Critical patent/WO2021208027A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0869—Network architectures or network communication protocols for network security for authentication of entities for achieving mutual authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H04W12/068—Authentication using credential vaults, e.g. password manager applications or one time password [OTP] applications

Definitions

  • the present invention relates to the field of wireless communication technology, and in particular to a method and device for two-way authentication of network access.
  • the purpose of the present invention is to provide a method and device for two-way authentication of network access, so as to solve the problem that hardware devices between various manufacturers cannot be connected to each other at the same time.
  • the present invention provides a method for two-way authentication of network access, including:
  • each node needs to access the network of the corresponding base station, the node authentication information of each node and the base station authentication information of each base station are exchanged through each access point, so that each node and each base station perform two-way authentication.
  • the node authentication information of each node and the base station authentication information of each base station are exchanged through each access point, so that each node and the Each base station performs two-way authentication, including:
  • the node When a node needs to access the network of its corresponding base station, the node sends an authentication request frame to an access point;
  • the access point determines whether the node authentication information of the node is included, and the access point encrypts the authentication return frame containing the base station authentication information of the base station corresponding to the node through the node authentication information of the node, and Return an encrypted authentication return frame to the node;
  • the node decrypts the encrypted authentication return frame returned by the node authentication information of the node, and sends a network access request to the base station corresponding to the node by using the base station authentication information in the encrypted authentication return frame.
  • the node sending an authentication request frame to an access point includes:
  • the node determines whether the base station authentication information of the base station corresponding to the node is included or determines whether there is a matching corresponding base station around the node;
  • the node When the node does not include the base station authentication information of the base station corresponding to the node or there is no matching corresponding base station around the node, the node sends an authentication request frame to an access point.
  • the access point determines whether to include the node authentication information of the node, and the access point encrypts the base station authentication information of the base station corresponding to the node by encrypting the node authentication information of the node And return the encrypted authentication return frame to the node, including:
  • the access point receives the authentication request frame sent by the node, and determines whether the access point contains the node authentication information of the node;
  • the access point When the access point contains the node authentication information of the node, the access point adds the base station authentication information of the base station corresponding to the node in the authentication return frame, and passes the node authentication information of the node
  • the authentication return frame is encrypted, and the access point returns the encrypted authentication return frame to the node.
  • the node decrypts the encrypted authentication return frame returned by the node authentication information of the node, and transmits the base station authentication information in the encrypted authentication return frame to the node
  • the network access request sent by the corresponding base station includes:
  • the node receives the encrypted authentication return frame returned by the access point, and determines whether the encrypted authentication return frame can be decrypted by the node authentication information of the node;
  • the node When the node can decrypt the encrypted authentication return frame through the node authentication information of the node, the node updates the base station authentication information of the node corresponding to the base station with the base station authentication information in the encrypted authentication return frame.
  • Base station authentication information
  • the node searches for the corresponding base station through the base station authentication information in the encrypted authentication return frame, and determines whether the base station authentication information in the encrypted authentication return frame can decrypt the base station authentication of the corresponding base station found.
  • the node can decrypt the base station authentication information of the corresponding base station found by the base station authentication information in the encrypted authentication return frame, the node sends a network access request to the corresponding base station.
  • the configuration of base station authentication information of each base station, node authentication information of each node, and access point information of each access point includes:
  • the base station authentication information of each base station includes: base station address, base station network number, and base station encryption key;
  • the node authentication information of each node includes: node address, node encryption key, node initial vector and node token;
  • each access point information includes: node authentication information of each node accessing the access point and base station authentication information of the base station corresponding to each node.
  • the node authentication information of each node is configured through any one of APP, web page, NFC, Bluetooth, serial port, network interface, and curing at the factory.
  • the base station authentication information of each base station and the access point information of each access point are configured through any one of APP, web page, NFC, Bluetooth, serial port, and network interface. .
  • the node authentication information of each node is the same or different.
  • the present invention also provides a device for two-way authentication of network access, adopting the method, the device includes:
  • Each base station of the network Each base station of the network;
  • Each node that sends a network access request to each base station Each node that sends a network access request to each base station;
  • Each access point that exchanges node authentication information of each node and base station authentication information of each base station, so that each node and each base station perform two-way authentication;
  • each base station is configured with base station authentication information
  • each node is configured with node authentication information
  • each access point is configured with access point information
  • the node when a node needs to access the network of its corresponding base station, the node sends an authentication request frame to an access point;
  • the access point determines whether the node authentication information of the node is included, and the access point encrypts the authentication return frame containing the base station authentication information of the base station corresponding to the node through the node authentication information of the node, and Return an encrypted authentication return frame to the node;
  • the node decrypts the returned encrypted authentication return frame through the node authentication information of the node, and sends a network access request to the base station corresponding to the node through the base station authentication information in the encrypted authentication return frame.
  • the node sending an authentication request frame to an access point includes:
  • the node determines whether the base station authentication information of the base station corresponding to the node is included or determines whether there is a matching corresponding base station around the node;
  • the node When the node does not include the base station authentication information of the base station corresponding to the node or there is no matching corresponding base station around the node, the node sends an authentication request frame to an access point.
  • the access point determines whether to include the node authentication information of the node, and the access point encrypts the base station authentication information of the base station corresponding to the node by encrypting the node authentication information of the node And return the encrypted authentication return frame to the node, including:
  • the access point receives the authentication request frame sent by the node, and determines whether the access point contains the node authentication information of the node;
  • the access point When the access point contains the node authentication information of the node, the access point adds the base station authentication information of the base station corresponding to the node in the authentication return frame, and passes the node authentication information of the node
  • the authentication return frame is encrypted, and the access point returns the encrypted authentication return frame to the node.
  • the node decrypts the encrypted authentication return frame returned by the node authentication information of the node, and transmits the base station authentication information in the encrypted authentication return frame to the node
  • the network access request sent by the corresponding base station includes:
  • the node receives the encrypted authentication return frame returned by the access point, and determines whether the encrypted authentication return frame can be decrypted by the node authentication information of the node;
  • the node When the node can decrypt the encrypted authentication return frame through the node authentication information of the node, the node updates the base station authentication information of the node corresponding to the base station with the base station authentication information in the encrypted authentication return frame.
  • Base station authentication information
  • the node searches for the corresponding base station through the base station authentication information in the encrypted authentication return frame, and determines whether the base station authentication information in the encrypted authentication return frame can decrypt the base station authentication of the corresponding base station found.
  • the node can decrypt the base station authentication information of the corresponding base station found by the base station authentication information in the encrypted authentication return frame, the node sends a network access request to the corresponding base station.
  • the node authentication information of each node is configured through any one of APP, web page, NFC, Bluetooth, serial port, network interface, and curing at the factory.
  • the base station authentication information of each base station and the access point information of each access point are configured through any one of APP, web page, NFC, Bluetooth, serial port, and network interface. .
  • the base station authentication information of each base station includes: base station address, base station network number, and base station encryption key;
  • the node authentication information of each node includes: node address, node encryption key, node initial vector and node token;
  • Each access point information includes: node authentication information of each node accessing the access point and base station authentication information of the base station corresponding to each node.
  • the node authentication information of each node is the same or different.
  • the present invention also provides an electronic device including a memory and a processor, the memory is used to store one or more computer instructions, wherein the one or more computer instructions are executed by the processor to implement the method.
  • the present invention also provides a computer-readable storage medium on which a computer program is stored, characterized in that the computer program is executed by a processor to implement the method.
  • the beneficial effects of the present invention are that the hardware devices of various manufacturers can be connected to each other and their safety can be guaranteed.
  • FIG. 1 is a schematic flowchart of a method for two-way authentication for network access according to an exemplary embodiment of the present invention
  • FIG. 2 is a schematic flowchart of S2 in a method for two-way authentication of network access according to an exemplary embodiment of the present invention
  • FIG. 3 is a schematic flowchart of S22 of a method for two-way authentication for network access according to an exemplary embodiment of the present invention
  • FIG. 4 is a schematic flowchart of S23 of a method for two-way authentication for network access according to an exemplary embodiment of the present invention.
  • the directional indication is only used to explain that it is in a specific posture (as shown in the drawings). If the specific posture changes, the relative positional relationship, movement, etc. of the components below will also change the directional indication accordingly.
  • the terms used are for illustrative purposes only, and are not intended to limit the scope of the present invention.
  • the terms “including” and/or “including” are used to specify the existence of the described elements, steps, operations and/or components, but do not exclude the presence or addition of one or more other elements, steps, operations and/or components .
  • the terms “first”, “second”, etc. may be used to describe various elements, do not represent the order, and do not limit these elements.
  • “plurality” means two or more. These terms are only used to distinguish one element from another.
  • Wi-Fi is a widely used wireless protocol.
  • Wi-Fi networking you need to enter Wi-Fi password to complete network access authentication when connecting to Wi-Fi. It cannot be applied to devices without keyboards and screens. This requires device manufacturers to design a set of tools.
  • WIFI password Zigbee and LoraWAN are non-authorized networking protocols.
  • Zigbee and LoraWAN networking each device manufacturer does not have a unified standard to configure and update the encryption key of authentication information, making it impossible for devices between different device manufacturers.
  • NBIOT needs to use external authentication information to complete network access authentication when using NBIOT networking. For example, using an external IoT card similar to a mobile phone card will bring additional costs and volume.
  • the method for two-way authentication for network access according to the embodiment of the present invention is used in a wireless networking communication system, which realizes the mutual connection and communication of hardware devices between various device manufacturers while ensuring security.
  • the method for two-way authentication for network access according to the embodiment of the present invention, as shown in FIG. 1, includes:
  • S1 Configure base station authentication information of each base station, node authentication information of each node, and access point information of each access point;
  • the base station and the access point described in the embodiment of the present invention may be two separate entities, or may be a combined entity.
  • the base station is used for networking and network access, and the access point is used for the exchange of node authentication information and base station authentication information.
  • wireless protocols such as Zigbee and LoraWan are off-network, the node needs to search all the time, so that the radio frequency of the node needs to be kept on, resulting in high power consumption of the node.
  • the radio frequency machine of the node does not need to be kept on all the time, and the radio frequency machine can be turned on periodically (for example, 2s cycle, 8ms) as needed to request the access point
  • the authentication information allows the node to maintain low power consumption when off-grid.
  • configuring base station authentication information of each base station, node authentication information of each node, and access point information of each access point includes:
  • the base station authentication information of each base station includes: base station address, base station network number, and base station encryption key;
  • the node authentication information of each node includes: node address, node encryption key, node initial vector and node token (token);
  • each access point information includes: node authentication information of each node accessing the access point and base station authentication information of the base station corresponding to each node. It can be understood that the access point information includes node authentication information and base station authentication information of the base station corresponding to the node.
  • the configuration of the base station authentication information can specify the connection of the node according to the base station address, or the self-organizing network connection of multiple nodes according to the base station network number, which greatly improves the degree of freedom and flexibility of node access.
  • the encryption ability of the authentication return frame can be improved, and at the same time, different nodes can be designated to use the same node authentication information or different node authentication information, which greatly improves the configuration freedom of node authentication information.
  • the base station authentication information of each base station is configured through any one of APP, web page, NFC, Bluetooth, serial port, and network interface.
  • it can be configured through the base station operation interface of APP, web page, NFC, Bluetooth, serial port or network interface.
  • the present invention does not specifically limit the configuration mode of the base station authentication information of each base station.
  • the node authentication information of each node is configured through any one of APP, web page, NFC, Bluetooth, serial port, network interface, and curing at the factory.
  • it can be configured through the node operation interface of APP, web page, NFC, Bluetooth, serial port or network interface, or it can use the node authentication information fixed at the factory.
  • the present invention does not specifically limit the configuration mode of the node authentication information of each node.
  • the node authentication information of each node is the same or different.
  • the authentication information of each node is the same, for example, the authentication information of each node is partially the same, for example, the authentication information of each node is different (it can be understood that the node authentication information of each node is unique).
  • the present invention does not specifically limit the node authentication information of each node.
  • the access point information of each access point is configured through any one of APP, web page, NFC, Bluetooth, serial port, and network interface.
  • it can be configured through the access point operation interface of APP, web page, NFC, Bluetooth, serial port or network interface.
  • the present invention does not specifically limit the configuration mode of the access point information of each access point.
  • each node when each node needs to access the network of the corresponding base station, the node authentication information of each node and the base station authentication information of each base station are exchanged through each access point, so that each node Performing two-way authentication with each base station, as shown in Figure 2, includes:
  • the access point determines whether the node authentication information of the node is included, and the access point encrypts the authentication return frame containing the base station authentication information of the base station corresponding to the node through the node authentication information of the node. , And return the encrypted authentication return frame to the node;
  • the node decrypts the encrypted authentication return frame returned by the node authentication information of the node, and sends a network access request to the base station corresponding to the node by using the base station authentication information in the encrypted authentication return frame .
  • the node sending an authentication request frame to an access point includes:
  • the node determines whether the base station authentication information of the base station corresponding to the node is included or determines whether there is a matching corresponding base station around the node;
  • the node When the node does not include the base station authentication information of the base station corresponding to the node or there is no matching corresponding base station around the node, the node sends an authentication request frame to an access point.
  • the node needs to obtain the base station authentication information of the corresponding base station.
  • the node will send an authentication request frame to the access point.
  • the node will initiate a network access request to access the network of the corresponding base station.
  • the access point determines whether to include the node authentication information of the node, and the access point encrypts the base station containing the base station corresponding to the node through the node authentication information of the node.
  • the authentication return frame of the authentication information, and the encrypted authentication return frame is returned to the node, as shown in Fig. 3, including:
  • the access point receives the authentication request frame sent by the node, and determines whether the access point contains the node authentication information of the node;
  • the access point When the access point contains the node authentication information of the node, the access point adds the base station authentication information of the base station corresponding to the node in the authentication return frame, and passes the node authentication information of the node
  • the authentication return frame is encrypted, and the access point returns the encrypted authentication return frame to the node.
  • the access point when the access point receives the authentication request frame sent by the node, it needs to first determine whether the access point has the node authentication information of the node. If the access point does not have the node authentication information of the node, the access point will ignore the authentication request frame sent by the node. If the access point contains the node authentication information of the node, the access point first constructs an authentication return frame (the authentication return frame contains the base station authentication information of the base station corresponding to the node), and then uses the node authentication information of the node The authentication return frame constructed by information encryption is then sent to the node with the encrypted authentication return frame.
  • the node decrypts the encrypted authentication return frame returned by the node authentication information of the node, and transmits the base station authentication information in the encrypted authentication return frame to the
  • the node corresponding to the base station sends a network access request, as shown in FIG. 4, including:
  • the node receives the encrypted authentication return frame returned by the access point, and determines whether the encrypted authentication return frame can be decrypted by the node authentication information of the node;
  • the node When the node can decrypt the encrypted authentication return frame through the node authentication information of the node, the node updates the base station authentication information of the node corresponding to the base station with the base station authentication information in the encrypted authentication return frame.
  • Base station authentication information
  • the node searches for the corresponding base station through the base station authentication information in the encrypted authentication return frame, and determines whether the base station authentication information in the encrypted authentication return frame can decrypt the base station authentication of the corresponding base station found.
  • the node can decrypt the base station authentication information of the corresponding base station found by the base station authentication information in the encrypted authentication return frame, the node sends a network access request to the corresponding base station.
  • the node needs to decrypt the encrypted authentication return frame first, and determine whether the authentication return frame is the node’s authentication return frame. Right to return to the frame. If the node cannot decrypt the authentication return frame through its own node authentication information, it means that the authentication return frame is not the authentication return frame of the node, and the node will ignore the authentication return frame. If the node can successfully decrypt the authentication return frame through its own node authentication information, it means that the authentication return frame is the authentication return frame of the node, and the node can use the base station authentication in the authentication return frame. The right information is used to decrypt the base station authentication information of the corresponding base station of the node. Once successfully decrypted, the node can send a network access request to the corresponding base station.
  • the device for two-way authentication of network access adopts the method, and the device includes:
  • Each base station of the network Each base station of the network;
  • Each node that sends a network access request to each base station Each node that sends a network access request to each base station;
  • Each access point that exchanges node authentication information of each node and base station authentication information of each base station, so that each node and each base station perform two-way authentication;
  • each base station is configured with base station authentication information
  • each node is configured with node authentication information
  • each access point is configured with access point information
  • the base station and the access point described in the embodiment of the present invention may be two separate entities, or may be a combined entity.
  • the base station is used for networking and network access, and the access point is used for the exchange of node authentication information and base station authentication information.
  • wireless protocols such as Zigbee and LoraWan are off-network, the node needs to search all the time, so that the radio frequency of the node needs to be kept on, resulting in high power consumption of the node.
  • the radio frequency machine of the node does not need to be kept on all the time, and the radio frequency machine can be turned on periodically (for example, 2s cycle, 8ms) as needed to request the access point
  • the authentication information allows the node to maintain low power consumption when off-grid.
  • configuring base station authentication information of each base station, node authentication information of each node, and access point information of each access point includes:
  • the base station authentication information of each base station includes: base station address, base station network number, and base station encryption key;
  • the node authentication information of each node includes: node address, node encryption key, node initial vector and node token (token);
  • each access point information includes: node authentication information of each node accessing the access point and base station authentication information of the base station corresponding to each node. It can be understood that the access point information includes node authentication information and base station authentication information of the base station corresponding to the node.
  • the configuration of the base station authentication information can specify the connection of the node according to the base station address, or the self-organizing network connection of multiple nodes according to the base station network number, which greatly improves the degree of freedom and flexibility of node access.
  • the encryption ability of the authentication return frame can be improved, and at the same time, different nodes can be designated to use the same node authentication information or different node authentication information, which greatly improves the configuration freedom of node authentication information.
  • the base station authentication information of each base station is configured through any one of APP, web page, NFC, Bluetooth, serial port, and network interface.
  • it can be configured through the base station operation interface of APP, web page, NFC, Bluetooth, serial port or network interface.
  • the present invention does not specifically limit the configuration mode of the base station authentication information of each base station.
  • the node authentication information of each node is configured through any one of APP, web page, NFC, Bluetooth, serial port, network interface, and curing at the factory.
  • it can be configured through the node operation interface of APP, web page, NFC, Bluetooth, serial port or network interface, or it can use the node authentication information fixed at the factory.
  • the present invention does not specifically limit the configuration mode of the node authentication information of each node.
  • the node authentication information of each node is the same or different.
  • the authentication information of each node is the same, for example, the authentication information of each node is partially the same, for example, the authentication information of each node is different (it can be understood that the node authentication information of each node is unique).
  • the present invention does not specifically limit the node authentication information of each node.
  • the access point information of each access point is configured through any one of APP, web page, NFC, Bluetooth, serial port, and network interface.
  • it can be configured through the access point operation interface of APP, web page, NFC, Bluetooth, serial port or network interface.
  • the present invention does not specifically limit the configuration mode of the access point information of each access point.
  • the node when a node needs to access the network of its corresponding base station, the node sends an authentication request frame to an access point;
  • the access point determines whether the node authentication information of the node is included, and the access point encrypts the authentication return frame containing the base station authentication information of the base station corresponding to the node through the node authentication information of the node, and Return an encrypted authentication return frame to the node;
  • the node decrypts the returned encrypted authentication return frame through the node authentication information of the node, and sends a network access request to the base station corresponding to the node through the base station authentication information in the encrypted authentication return frame.
  • the node sending an authentication request frame to an access point includes:
  • the node determines whether the base station authentication information of the base station corresponding to the node is included or determines whether there is a matching corresponding base station around the node;
  • the node When the node does not include the base station authentication information of the base station corresponding to the node or there is no matching corresponding base station around the node, the node sends an authentication request frame to an access point.
  • the node needs to obtain the base station authentication information of the corresponding base station.
  • the node will send an authentication request frame to the access point.
  • the node will initiate a network access request to access the network of the corresponding base station.
  • the access point determines whether to include the node authentication information of the node, and the access point encrypts the base station containing the base station corresponding to the node through the node authentication information of the node.
  • the authentication return frame of the authentication information and the encrypted authentication return frame to the node including:
  • the access point receives the authentication request frame sent by the node, and determines whether the access point contains the node authentication information of the node;
  • the access point When the access point contains the node authentication information of the node, the access point adds the base station authentication information of the base station corresponding to the node in the authentication return frame, and passes the node authentication information of the node
  • the authentication return frame is encrypted, and the access point returns the encrypted authentication return frame to the node.
  • the access point when the access point receives the authentication request frame sent by the node, it needs to first determine whether the access point has the node authentication information of the node. If the access point does not have the node authentication information of the node, the access point will ignore the authentication request frame sent by the node. If the access point contains the node authentication information of the node, the access point first constructs an authentication return frame (the authentication return frame contains the base station authentication information of the base station corresponding to the node), and then uses the node authentication information of the node The authentication return frame constructed by information encryption is then sent to the node with the encrypted authentication return frame.
  • the node decrypts the encrypted authentication return frame returned by the node authentication information of the node, and transmits the base station authentication information in the encrypted authentication return frame to the
  • the network access request sent by the node corresponding to the base station includes:
  • the node receives the encrypted authentication return frame returned by the access point, and determines whether the encrypted authentication return frame can be decrypted by the node authentication information of the node;
  • the node When the node can decrypt the encrypted authentication return frame through the node authentication information of the node, the node updates the base station authentication information of the node corresponding to the base station with the base station authentication information in the encrypted authentication return frame.
  • Base station authentication information
  • the node searches for the corresponding base station through the base station authentication information in the encrypted authentication return frame, and determines whether the base station authentication information in the encrypted authentication return frame can decrypt the base station authentication of the corresponding base station found.
  • the node can decrypt the base station authentication information of the corresponding base station found by the base station authentication information in the encrypted authentication return frame, the node sends a network access request to the corresponding base station.
  • the node needs to decrypt the encrypted authentication return frame first, and determine whether the authentication return frame is the node’s authentication return frame. Right to return to the frame. If the node cannot decrypt the authentication return frame through its own node authentication information, it means that the authentication return frame is not the authentication return frame of the node, and the node will ignore the authentication return frame. If the node can successfully decrypt the authentication return frame through its own node authentication information, it means that the authentication return frame is the authentication return frame of the node, and the node can use the base station authentication in the authentication return frame. The right information is used to decrypt the base station authentication information of the corresponding base station of the node. Once successfully decrypted, the node can send a network access request to the corresponding base station.
  • the present disclosure also relates to an electronic device, including a server, a terminal, and the like.
  • the electronic device includes: at least one processor; a memory communicatively connected with the at least one processor; and a communication component communicatively connected with the storage medium, the communication component receiving and sending data under the control of the processor; wherein the memory stores An instruction that can be executed by at least one processor, and the instruction is executed by at least one processor to implement the method for network access bidirectional authentication in the foregoing embodiment.
  • the memory as a non-volatile computer-readable storage medium, can be used to store non-volatile software programs, non-volatile computer-executable programs, and modules.
  • the processor executes various functional applications and data processing of the device by running non-volatile software programs, instructions, and modules stored in the memory, that is, a method for two-way authentication of network access.
  • the memory may include a program storage area and a data storage area, where the program storage area can store an operating system and an application program required by at least one function; the data storage area can store a list of options and the like.
  • the memory may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one magnetic disk storage device, a flash memory device, or other non-volatile solid-state storage devices.
  • the memory may optionally include a memory remotely arranged with respect to the processor, and these remote memories may be connected to an external device through a network. Examples of the aforementioned networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.
  • One or more modules are stored in the memory, and when executed by one or more processors, the method for network access bidirectional authentication in any of the foregoing method embodiments is executed.
  • the present disclosure also relates to a computer-readable storage medium for storing a computer-readable program, and the computer-readable program is used for a computer to execute some or all of the above-mentioned network access bidirectional authentication method embodiments.
  • the program is stored in a storage medium and includes several instructions.
  • a device may be a single-chip microcomputer, a chip, etc.
  • a processor processor
  • the aforementioned storage media include: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), magnetic disks or optical disks and other media that can store program codes. .

Abstract

本发明公开了一种入网双向鉴权的方法，包括：配置各基站的基站鉴权信息、各节点的节点鉴权信息和各接入点的接入点信息；当各节点需要接入对应基站的网络时，通过各接入点交换各节点的节点鉴权信息和各基站的基站鉴权信息，以使所述各节点和所述各基站进行双向鉴权。本发明还公开了一种入网双向鉴权的装置。本发明的有益效果为：可以实现各个生产厂商之间的硬件设备相互连接，并保证各自的安全性。

Description

一种入网双向鉴权的方法及装置 技术领域
本发明涉及无线通信技术领域，具体而言，涉及一种入网双向鉴权的方法及装置。
背景技术
目前，物联网的主流联网方式有WIFI、Zigbee、LoRaWAN、NBIOT等，各个智能硬件设备生产厂商在使用这些协议时，会通过各自的私有协议来保护自己产品的安全性，这使得各个生产厂商之间的硬件设备无法实现相互连接和通信。
发明内容
本发明的目的在于提供一种入网双向鉴权的方法及装置，解决各个生产厂商之间的硬件设备无法同时实现相互连接的问题。
本发明提供了一种入网双向鉴权的方法，包括：
配置各基站的基站鉴权信息、各节点的节点鉴权信息和各接入点的接入点信息；
当各节点需要接入对应基站的网络时，通过各接入点交换各节点的节点鉴权信息和各基站的基站鉴权信息，以使所述各节点和所述各基站进行双向鉴权。
作为本发明进一步的改进，当各节点需要接入对应基站的网络时，通过各接入点交换各节点的节点鉴权信息和各基站的基站鉴权信息，以使所述各节点和所述各基站进行双向鉴权，包括：
当一节点需要接入其对应基站的网络时，所述节点向一接入点发送鉴权请求帧；
所述接入点确定是否包含所述节点的节点鉴权信息，所述接入点通过所述节点的节点鉴权信息加密包含所述节点对应基站的基站鉴权信息的鉴权返回帧，并向所述节点返回加密的鉴权返回帧；
所述节点通过所述节点的节点鉴权信息解密所返回的加密的鉴权返回 帧，并通过所述加密的鉴权返回帧中的基站鉴权信息向所述节点对应基站发送入网请求。
作为本发明进一步的改进，当一节点需要接入其对应基站的网络时，所述节点向一接入点发送鉴权请求帧，包括：
当一节点需要接入其对应基站的网络时，所述节点确定是否包含所述节点对应基站的基站鉴权信息或确定所述节点周围是否有匹配的对应基站；
当所述节点不包含所述节点对应基站的基站鉴权信息或所述节点周围没有匹配的对应基站，所述节点向一接入点发送鉴权请求帧。
作为本发明进一步的改进，所述接入点确定是否包含所述节点的节点鉴权信息，所述接入点通过所述节点的节点鉴权信息加密包含所述节点对应基站的基站鉴权信息的鉴权返回帧，并向所述节点返回加密的鉴权返回帧，包括：
所述接入点接收所述节点发送的所述鉴权请求帧，并确定所述接入点是否包含所述节点的节点鉴权信息；
当所述接入点包含所述节点的节点鉴权信息时，所述接入点在鉴权返回帧中加入所述节点对应基站的基站鉴权信息，并通过所述节点的节点鉴权信息对所述鉴权返回帧进行加密，所述接入点向所述节点返回加密的鉴权返回帧。
作为本发明进一步的改进，所述节点通过所述节点的节点鉴权信息解密所返回的加密的鉴权返回帧，并通过所述加密的鉴权返回帧中的基站鉴权信息向所述节点对应基站发送入网请求，包括：
所述节点接收所述接入点所返回的加密的鉴权返回帧，并确定是否能通过所述节点的节点鉴权信息解密所述加密的鉴权返回帧；
当所述节点能通过所述节点的节点鉴权信息解密所述加密的鉴权返回帧时，所述节点通过所述加密的鉴权返回帧中的基站鉴权信息更新所述节点对应基站的基站鉴权信息；
所述节点通过所述加密的鉴权返回帧中的基站鉴权信息搜索对应基站，并确定是否能通过所述加密的鉴权返回帧中的基站鉴权信息解密搜索到的对 应基站的基站鉴权信息，当所述节点能通过所述加密的鉴权返回帧中的基站鉴权信息解密搜索到的对应基站的基站鉴权信息时，所述节点向对应基站发送入网请求。
作为本发明进一步的改进，配置各基站的基站鉴权信息、各节点的节点鉴权信息和各接入点的接入点信息，包括：
配置各基站的基站鉴权信息，每个基站的基站鉴权信息包括：基站地址、基站网络号和基站加密密钥；
配置各节点的节点鉴权信息，每个节点的节点鉴权信息包括：节点地址、节点加密密钥、节点初始向量和节点令牌；
配置各接入点的接入点信息，每个接入点信息包括：接入该接入点的各节点的节点鉴权信息以及各节点所对应基站的基站鉴权信息。
作为本发明进一步的改进，所述各节点的节点鉴权信息通过APP、web页面、NFC、蓝牙、串口、网络接口和出厂时固化中的任意一种方式进行配置。
作为本发明进一步的改进，所述各基站的基站鉴权信息和所述各接入点的接入点信息通过APP、web页面、NFC、蓝牙、串口和网络接口中的任意一种方式进行配置。
作为本发明进一步的改进，所述各节点的节点鉴权信息相同或不同。
本发明还提供了一种入网双向鉴权的装置，采用所述的方法，所述装置包括：
组网的各基站；
向各基站发送入网请求的各节点；以及
交换各节点的节点鉴权信息和各基站的基站鉴权信息的各接入点，以使所述各节点和所述各基站进行双向鉴权；
其中，所述各基站分别配置有基站鉴权信息，所述各节点分别配置有节点鉴权信息，所述各接入点分别配置有接入点信息。
作为本发明进一步的改进，当一节点需要接入其对应基站的网络时，所述节点向一接入点发送鉴权请求帧；
所述接入点确定是否包含所述节点的节点鉴权信息，所述接入点通过所述节点的节点鉴权信息加密包含所述节点对应基站的基站鉴权信息的鉴权返回帧，并向所述节点返回加密的鉴权返回帧；
所述节点通过所述节点的节点鉴权信息解密所返回的加密的鉴权返回帧，并通过所述加密的鉴权返回帧中的基站鉴权信息向所述节点对应基站发送入网请求。
作为本发明进一步的改进，当一节点需要接入其对应基站的网络时，所述节点向一接入点发送鉴权请求帧，包括：
当一节点需要接入其对应基站的网络时，所述节点确定是否包含所述节点对应基站的基站鉴权信息或确定所述节点周围是否有匹配的对应基站；
当所述节点不包含所述节点对应基站的基站鉴权信息或所述节点周围没有匹配的对应基站，所述节点向一接入点发送鉴权请求帧。
作为本发明进一步的改进，所述接入点确定是否包含所述节点的节点鉴权信息，所述接入点通过所述节点的节点鉴权信息加密包含所述节点对应基站的基站鉴权信息的鉴权返回帧，并向所述节点返回加密的鉴权返回帧，包括：
所述接入点接收所述节点发送的所述鉴权请求帧，并确定所述接入点是否包含所述节点的节点鉴权信息；
当所述接入点包含所述节点的节点鉴权信息时，所述接入点在鉴权返回帧中加入所述节点对应基站的基站鉴权信息，并通过所述节点的节点鉴权信息对所述鉴权返回帧进行加密，所述接入点向所述节点返回加密的鉴权返回帧。
作为本发明进一步的改进，所述节点通过所述节点的节点鉴权信息解密所返回的加密的鉴权返回帧，并通过所述加密的鉴权返回帧中的基站鉴权信息向所述节点对应基站发送入网请求，包括：
所述节点接收所述接入点所返回的加密的鉴权返回帧，并确定是否能通过所述节点的节点鉴权信息解密所述加密的鉴权返回帧；
当所述节点能通过所述节点的节点鉴权信息解密所述加密的鉴权返回帧 时，所述节点通过所述加密的鉴权返回帧中的基站鉴权信息更新所述节点对应基站的基站鉴权信息；
所述节点通过所述加密的鉴权返回帧中的基站鉴权信息搜索对应基站，并确定是否能通过所述加密的鉴权返回帧中的基站鉴权信息解密搜索到的对应基站的基站鉴权信息，当所述节点能通过所述加密的鉴权返回帧中的基站鉴权信息解密搜索到的对应基站的基站鉴权信息时，所述节点向对应基站发送入网请求。
作为本发明进一步的改进，所述各节点的节点鉴权信息通过APP、web页面、NFC、蓝牙、串口、网络接口和出厂时固化中的任意一种方式进行配置。
作为本发明进一步的改进，所述各基站的基站鉴权信息和所述各接入点的接入点信息通过APP、web页面、NFC、蓝牙、串口和网络接口中的任意一种方式进行配置。
作为本发明进一步的改进，每个基站的基站鉴权信息包括：基站地址、基站网络号和基站加密密钥；
每个节点的节点鉴权信息包括：节点地址、节点加密密钥、节点初始向量和节点令牌；
每个接入点信息包括：接入该接入点的各节点的节点鉴权信息以及各节点所对应基站的基站鉴权信息。
作为本发明进一步的改进，所述各节点的节点鉴权信息相同或不同。
本发明还提供了一种电子设备，包括存储器和处理器，所述存储器用于存储一条或多条计算机指令，其中，所述一条或多条计算机指令被处理器执行以实现所述的方法。
本发明还提供了一种计算机可读存储介质，其上存储有计算机程序，其特征在于，所述计算机程序被处理器执行以实现所述的方法。
本发明的有益效果为：可以实现各个生产厂商之间的硬件设备相互连接，并保证各自的安全性。
附图说明
为了更清楚地说明本发明实施例或现有技术中的技术方案，下面将对实施例或现有技术描述中所需要使用的附图作简单地介绍。显而易见地，下面描述中的附图仅仅是本发明的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动性的前提下，还可以根据这些附图获得其他的附图。
图1为本发明一示例性实施例所述的一种入网双向鉴权的方法的流程示意图；
图2为本发明一示例性实施例所述的一种入网双向鉴权的方法中S2的流程示意图；
图3为本发明一示例性实施例所述的一种入网双向鉴权的方法的S22的流程示意图；
图4为本发明一示例性实施例所述的一种入网双向鉴权的方法的S23的流程示意图。
具体实施方式
下面将结合本发明实施例中的附图，对本发明实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例仅仅是本发明一部分实施例，而不是全部的实施例。基于本发明中的实施例，本领域普通技术人员在没有作出创造性劳动前提下所获得的所有其他实施例，都属于本发明保护的范围。
需要说明，若本发明实施例中有涉及方向性指示(诸如上、下、左、右、前、后……)，则该方向性指示仅用于解释在某一特定姿态(如附图所示)下各部件之间的相对位置关系、运动情况等，如果该特定姿态发生改变时，则该方向性指示也相应地随之改变。
另外，在本发明的描述中，所用术语仅用于说明目的，并非旨在限制本发明的范围。术语“包括”和/或“包含”用于指定所述元件、步骤、操作和/或组件的存在，但并不排除存在或添加一个或多个其他元件、步骤、操作和/或组件的情况。术语“第一”、“第二”等可能用于描述各种元件，不代表顺序，且不对这些元件起限定作用。此外，在本发明的描述中，除非另有说明，“多个”的含义是两个及两个以上。这些术语仅用于区分一个元素和另一个元素。结合以下附图，这些和/或其他方面变得显而易见，并且，本领域普通 技术人员更容易理解关于本发明所述实施例的说明。附图仅出于说明的目的用来描绘本发明所述实施例。本领域技术人员将很容易地从以下说明中认识到，在不背离本发明所述原理的情况下，可以采用本发明所示结构和方法的替代实施例。
物联网的主流联网方式有WIFI、Zigbee、LoRaWAN、NBIOT等。WIFI为一种广泛应用的无线协议，在使用WIFI组网时，需要在连接WIFI时输入WIFI密码来完成入网鉴权，无法适用于没有键盘和屏幕的设备，这使得需要设备厂商设计一套工具来输入WIFI密码。Zigbee、LoraWAN作为非授权有组网协议，在使用Zigbee、LoraWAN组网时，各个设备厂商没有统一的标准来对鉴权信息的加密密钥进行配置和更新，使得不同设备厂商之间的设备无法相互连接，这就需要预先在设备中配置好鉴权信息或单独开发一套工具配置入网鉴权信息来完成入网鉴权。另外，如果各个设备厂商使用相同的加密密钥，一旦加密密钥泄露，就会带来安全性的问题。NBIOT作为一种授权协议，在使用NBIOT组网时，需要使用外置鉴权信息的方式来完成入网鉴权，例如使用类似手机卡的即外置物联网卡方式，这会带来额外的成本和体积。
本发明实施例所述的一种入网双向鉴权的方法，用于无线组网通信系统，在保证安全性的同时，实现各设备厂商之间硬件设备相互连接和通信。本发明实施例所述的一种入网双向鉴权的方法，如图1所示，包括：
S1，配置各基站的基站鉴权信息、各节点的节点鉴权信息和各接入点的接入点信息；
S2，当各节点需要接入对应基站的网络时，通过各接入点交换各节点的节点鉴权信息和各基站的基站鉴权信息，以使所述各节点和所述各基站进行双向鉴权。
本发明实施例所述的基站和接入点可以是两个单独的实体，也可以是一个组合的实体。基站用于组网和入网，接入点用于节点鉴权信息和基站鉴权信息的交换。Zigbee、LoraWan等无线协议在离网状态下，节点需要一直搜索，使得节点的射频机需要保持开启状态，导致节点的功耗高。本发明由于接入点的存在，使得节点附近不存在可用的网络时，节点的射频机无需一直保持 开启，可以根据需要周期性(例如2s的周期，开启8ms)开启射频机向接入点请求鉴权信息，让节点可以在离网状态下保持低功耗。
在一种可选的实施方式中，配置各基站的基站鉴权信息、各节点的节点鉴权信息和各接入点的接入点信息，包括：
配置各基站的基站鉴权信息，每个基站的基站鉴权信息包括：基站地址、基站网络号和基站加密密钥；
配置各节点的节点鉴权信息，每个节点的节点鉴权信息包括：节点地址、节点加密密钥、节点初始向量和节点token(令牌)；
配置各接入点的接入点信息，每个接入点信息包括：接入该接入点的各节点的节点鉴权信息以及各节点所对应基站的基站鉴权信息。可以理解的是，接入点信息包含节点鉴权信息和节点对应基站的基站鉴权信息。
基站鉴权信息的配置，可以根据基站地址指定节点的连接，也可以根据基站网络号对多个节点进行自组织组网连接，大大提高了节点接入的自由度和灵活度。通过加入节点token可以提高鉴权返回帧的加密能力，同时可以指定不同的节点使用相同的节点鉴权信息或者不同的节点鉴权信息，大大提高了节点鉴权信息的配置自由度。
在一种可选的实施方式中，各基站的基站鉴权信息通过APP、web页面、NFC、蓝牙、串口和网络接口中的任意一种方式进行配置。例如可以通过APP、web页面、NFC、蓝牙、串口或网络接口的基站操作界面进行配置。本发明对各基站的基站鉴权信息的配置方式不做具体限制。
在一种可选的实施方式中，所述各节点的节点鉴权信息通过APP、web页面、NFC、蓝牙、串口、网络接口和出厂时固化中的任意一种方式进行配置。例如可以通过APP、web页面、NFC、蓝牙、串口或网络接口的节点操作界面进行配置，也可以使用出厂固化的节点鉴权信息。本发明对各节点的节点鉴权信息的配置方式不做具体限制。
在另一种可选的实施方式中，所述各节点的节点鉴权信息相同或不同。例如，各个节点鉴权信息均相同，例如，各个节点鉴权信息部分相同，例如，各个节点鉴权信息均不相同(可以理解为每个节点的节点鉴权信息都是唯一 的)。本发明对各节点的节点鉴权信息不做具体限制。
在一种可选的实施方式中，所述各接入点的接入点信息通过APP、web页面、NFC、蓝牙、串口和网络接口中的任意一种方式进行配置。例如可以通过APP、web页面、NFC、蓝牙、串口或网络接口的接入点操作界面进行配置。本发明对各接入点的接入点信息的配置方式不做具体限制。
在一种可选的实施方式中，当各节点需要接入对应基站的网络时，通过各接入点交换各节点的节点鉴权信息和各基站的基站鉴权信息，以使所述各节点和所述各基站进行双向鉴权，如图2所示，包括：
S21，当一节点需要接入其对应基站的网络时，所述节点向一接入点发送鉴权请求帧；
S22，所述接入点确定是否包含所述节点的节点鉴权信息，所述接入点通过所述节点的节点鉴权信息加密包含所述节点对应基站的基站鉴权信息的鉴权返回帧，并向所述节点返回加密的鉴权返回帧；
S23，所述节点通过所述节点的节点鉴权信息解密所返回的加密的鉴权返回帧，并通过所述加密的鉴权返回帧中的基站鉴权信息向所述节点对应基站发送入网请求。
在一种可选的实施方式中，当一节点需要接入其对应基站的网络时，所述节点向一接入点发送鉴权请求帧，包括：
当一节点需要接入其对应基站的网络时，所述节点确定是否包含所述节点对应基站的基站鉴权信息或确定所述节点周围是否有匹配的对应基站；
当所述节点不包含所述节点对应基站的基站鉴权信息或所述节点周围没有匹配的对应基站，所述节点向一接入点发送鉴权请求帧。
上述过程中，该节点需要获取对应基站的基站鉴权信息，当该节点无基站鉴权信息或该节点周围没有找到匹配的基站时，该节点就会向接入点发送鉴权请求帧，当该节点已经有基站鉴权信息并且该节点周围有匹配的基站时，该节点就会发起入网请求接入对应基站的网络。
在一种可选的实施方式中，所述接入点确定是否包含所述节点的节点鉴权信息，所述接入点通过所述节点的节点鉴权信息加密包含所述节点对应基 站的基站鉴权信息的鉴权返回帧，并向所述节点返回加密的鉴权返回帧，如图3所示，包括：
所述接入点接收所述节点发送的所述鉴权请求帧，并确定所述接入点是否包含所述节点的节点鉴权信息；
当所述接入点包含所述节点的节点鉴权信息时，所述接入点在鉴权返回帧中加入所述节点对应基站的基站鉴权信息，并通过所述节点的节点鉴权信息对所述鉴权返回帧进行加密，所述接入点向所述节点返回加密的鉴权返回帧。
上述过程中，该接入点收到该节点发送的鉴权请求帧时，需要先判断该接入点是否有该节点的节点鉴权信息。如果该接入点没有该节点的节点鉴权信息时，该接入点就会忽略该节点发送的鉴权请求帧。如果该接入点包含该节点的节点鉴权信息，该接入点先构建鉴权返回帧(该鉴权返回帧包含该节点对应基站的基站鉴权信息)，再用该节点的节点鉴权信息加密构建好的鉴权返回帧，再向该节点发送加密的鉴权返回帧。
在一种可选的实施方式中，所述节点通过所述节点的节点鉴权信息解密所返回的加密的鉴权返回帧，并通过所述加密的鉴权返回帧中的基站鉴权信息向所述节点对应基站发送入网请求，如图4所示，包括：
所述节点接收所述接入点所返回的加密的鉴权返回帧，并确定是否能通过所述节点的节点鉴权信息解密所述加密的鉴权返回帧；
当所述节点能通过所述节点的节点鉴权信息解密所述加密的鉴权返回帧时，所述节点通过所述加密的鉴权返回帧中的基站鉴权信息更新所述节点对应基站的基站鉴权信息；
所述节点通过所述加密的鉴权返回帧中的基站鉴权信息搜索对应基站，并确定是否能通过所述加密的鉴权返回帧中的基站鉴权信息解密搜索到的对应基站的基站鉴权信息，当所述节点能通过所述加密的鉴权返回帧中的基站鉴权信息解密搜索到的对应基站的基站鉴权信息时，所述节点向对应基站发送入网请求。
上述过程中，该节点收到该接入点返回的加密的鉴权返回帧后，该节点 需要先对该加密的鉴权返回帧进行解密，并判断此鉴权返回帧是否为该节点的鉴权返回帧。如果该节点不能通过其自身的节点鉴权信息解密该鉴权返回帧，则说明此鉴权返回帧不是该节点的鉴权返回帧，该节点就会忽略该鉴权返回帧。如果该节点能通过其自身的节点鉴权信息成功解密该鉴权返回帧，则说明此鉴权返回帧是该节点的鉴权返回帧，该节点则可以利用该鉴权返回帧中的基站鉴权信息来解密该节点对应基站的基站鉴权信息，一旦成功解密，该节点即可向对应基站发送入网请求。
本发明实施例所述的一种入网双向鉴权的装置，采用所述的方法，所述装置包括：
组网的各基站；
向各基站发送入网请求的各节点；以及
交换各节点的节点鉴权信息和各基站的基站鉴权信息的各接入点，以使所述各节点和所述各基站进行双向鉴权；
其中，所述各基站分别配置有基站鉴权信息，所述各节点分别配置有节点鉴权信息，所述各接入点分别配置有接入点信息。
本发明实施例所述的基站和接入点可以是两个单独的实体，也可以是一个组合的实体。基站用于组网和入网，接入点用于节点鉴权信息和基站鉴权信息的交换。Zigbee、LoraWan等无线协议在离网状态下，节点需要一直搜索，使得节点的射频机需要保持开启状态，导致节点的功耗高。本发明由于接入点的存在，使得节点附近不存在可用的网络时，节点的射频机无需一直保持开启，可以根据需要周期性(例如2s的周期，开启8ms)开启射频机向接入点请求鉴权信息，让节点可以在离网状态下保持低功耗。
在一种可选的实施方式中，配置各基站的基站鉴权信息、各节点的节点鉴权信息和各接入点的接入点信息，包括：
配置各基站的基站鉴权信息，每个基站的基站鉴权信息包括：基站地址、基站网络号和基站加密密钥；
配置各节点的节点鉴权信息，每个节点的节点鉴权信息包括：节点地址、节点加密密钥、节点初始向量和节点token(令牌)；
配置各接入点的接入点信息，每个接入点信息包括：接入该接入点的各节点的节点鉴权信息以及各节点所对应基站的基站鉴权信息。可以理解的是，接入点信息包含节点鉴权信息和节点对应基站的基站鉴权信息。
基站鉴权信息的配置，可以根据基站地址指定节点的连接，也可以根据基站网络号对多个节点进行自组织组网连接，大大提高了节点接入的自由度和灵活度。通过加入节点token可以提高鉴权返回帧的加密能力，同时可以指定不同的节点使用相同的节点鉴权信息或者不同的节点鉴权信息，大大提高了节点鉴权信息的配置自由度。
在一种可选的实施方式中，各基站的基站鉴权信息通过APP、web页面、NFC、蓝牙、串口和网络接口中的任意一种方式进行配置。例如可以通过APP、web页面、NFC、蓝牙、串口或网络接口的基站操作界面进行配置。本发明对各基站的基站鉴权信息的配置方式不做具体限制。
在一种可选的实施方式中，所述各节点的节点鉴权信息通过APP、web页面、NFC、蓝牙、串口、网络接口和出厂时固化中的任意一种方式进行配置。例如可以通过APP、web页面、NFC、蓝牙、串口或网络接口的节点操作界面进行配置，也可以使用出厂固化的节点鉴权信息。本发明对各节点的节点鉴权信息的配置方式不做具体限制。
在另一种可选的实施方式中，所述各节点的节点鉴权信息相同或不同。例如，各个节点鉴权信息均相同，例如，各个节点鉴权信息部分相同，例如，各个节点鉴权信息均不相同(可以理解为每个节点的节点鉴权信息都是唯一的)。本发明对各节点的节点鉴权信息不做具体限制。
在一种可选的实施方式中，所述各接入点的接入点信息通过APP、web页面、NFC、蓝牙、串口和网络接口中的任意一种方式进行配置。例如可以通过APP、web页面、NFC、蓝牙、串口或网络接口的接入点操作界面进行配置。本发明对各接入点的接入点信息的配置方式不做具体限制。
在一种可选的实施方式中，当一节点需要接入其对应基站的网络时，所述节点向一接入点发送鉴权请求帧；
所述接入点确定是否包含所述节点的节点鉴权信息，所述接入点通过所 述节点的节点鉴权信息加密包含所述节点对应基站的基站鉴权信息的鉴权返回帧，并向所述节点返回加密的鉴权返回帧；
所述节点通过所述节点的节点鉴权信息解密所返回的加密的鉴权返回帧，并通过所述加密的鉴权返回帧中的基站鉴权信息向所述节点对应基站发送入网请求。
在一种可选的实施方式中，当一节点需要接入其对应基站的网络时，所述节点向一接入点发送鉴权请求帧，包括：
当一节点需要接入其对应基站的网络时，所述节点确定是否包含所述节点对应基站的基站鉴权信息或确定所述节点周围是否有匹配的对应基站；
当所述节点不包含所述节点对应基站的基站鉴权信息或所述节点周围没有匹配的对应基站，所述节点向一接入点发送鉴权请求帧。
上述过程中，该节点需要获取对应基站的基站鉴权信息，当该节点无基站鉴权信息或该节点周围没有找到匹配的基站时，该节点就会向接入点发送鉴权请求帧，当该节点已经有基站鉴权信息并且该节点周围有匹配的基站时，该节点就会发起入网请求接入对应基站的网络。
在一种可选的实施方式中，所述接入点确定是否包含所述节点的节点鉴权信息，所述接入点通过所述节点的节点鉴权信息加密包含所述节点对应基站的基站鉴权信息的鉴权返回帧，并向所述节点返回加密的鉴权返回帧，包括：
所述接入点接收所述节点发送的所述鉴权请求帧，并确定所述接入点是否包含所述节点的节点鉴权信息；
当所述接入点包含所述节点的节点鉴权信息时，所述接入点在鉴权返回帧中加入所述节点对应基站的基站鉴权信息，并通过所述节点的节点鉴权信息对所述鉴权返回帧进行加密，所述接入点向所述节点返回加密的鉴权返回帧。
上述过程中，该接入点收到该节点发送的鉴权请求帧时，需要先判断该接入点是否有该节点的节点鉴权信息。如果该接入点没有该节点的节点鉴权信息时，该接入点就会忽略该节点发送的鉴权请求帧。如果该接入点包含该 节点的节点鉴权信息，该接入点先构建鉴权返回帧(该鉴权返回帧包含该节点对应基站的基站鉴权信息)，再用该节点的节点鉴权信息加密构建好的鉴权返回帧，再向该节点发送加密的鉴权返回帧。
在一种可选的实施方式中，所述节点通过所述节点的节点鉴权信息解密所返回的加密的鉴权返回帧，并通过所述加密的鉴权返回帧中的基站鉴权信息向所述节点对应基站发送入网请求，包括：
所述节点接收所述接入点所返回的加密的鉴权返回帧，并确定是否能通过所述节点的节点鉴权信息解密所述加密的鉴权返回帧；
当所述节点能通过所述节点的节点鉴权信息解密所述加密的鉴权返回帧时，所述节点通过所述加密的鉴权返回帧中的基站鉴权信息更新所述节点对应基站的基站鉴权信息；
所述节点通过所述加密的鉴权返回帧中的基站鉴权信息搜索对应基站，并确定是否能通过所述加密的鉴权返回帧中的基站鉴权信息解密搜索到的对应基站的基站鉴权信息，当所述节点能通过所述加密的鉴权返回帧中的基站鉴权信息解密搜索到的对应基站的基站鉴权信息时，所述节点向对应基站发送入网请求。
上述过程中，该节点收到该接入点返回的加密的鉴权返回帧后，该节点需要先对该加密的鉴权返回帧进行解密，并判断此鉴权返回帧是否为该节点的鉴权返回帧。如果该节点不能通过其自身的节点鉴权信息解密该鉴权返回帧，则说明此鉴权返回帧不是该节点的鉴权返回帧，该节点就会忽略该鉴权返回帧。如果该节点能通过其自身的节点鉴权信息成功解密该鉴权返回帧，则说明此鉴权返回帧是该节点的鉴权返回帧，该节点则可以利用该鉴权返回帧中的基站鉴权信息来解密该节点对应基站的基站鉴权信息，一旦成功解密，该节点即可向对应基站发送入网请求。
本公开还涉及一种电子设备，包括服务器、终端等。该电子设备包括：至少一个处理器；与至少一个处理器通信连接的存储器；以及与存储介质通信连接的通信组件，所述通信组件在处理器的控制下接收和发送数据；其中，存储器存储有可被至少一个处理器执行的指令，指令被至少一个处理器执行以实现上述实施例中的入网双向鉴权的方法。
在一种可选的实施方式中，存储器作为一种非易失性计算机可读存储介质，可用于存储非易失性软件程序、非易失性计算机可执行程序以及模块。处理器通过运行存储在存储器中的非易失性软件程序、指令以及模块，从而执行设备的各种功能应用以及数据处理，即实现入网双向鉴权的方法。
存储器可以包括存储程序区和存储数据区，其中，存储程序区可存储操作系统、至少一个功能所需要的应用程序；存储数据区可存储选项列表等。此外，存储器可以包括高速随机存取存储器，还可以包括非易失性存储器，例如至少一个磁盘存储器件、闪存器件、或其他非易失性固态存储器件。在一些实施例中，存储器可选包括相对于处理器远程设置的存储器，这些远程存储器可以通过网络连接至外接设备。上述网络的实例包括但不限于互联网、企业内部网、局域网、移动通信网及其组合。
一个或者多个模块存储在存储器中，当被一个或者多个处理器执行时，执行上述任意方法实施例中的入网双向鉴权的方法。
上述产品可执行本申请实施例所提供的方法，具备执行方法相应的功能模块和有益效果，未在本实施例中详尽描述的技术细节，可参见本申请实施例所提供的入网双向鉴权的方法。
本公开还涉及一种计算机可读存储介质，用于存储计算机可读程序，所述计算机可读程序用于供计算机执行上述部分或全部的入网双向鉴权的方法实施例。
即，本领域技术人员可以理解，实现上述实施例入网双向鉴权的方法中的全部或部分步骤是可以通过程序来指令相关的硬件来完成，该程序存储在一个存储介质中，包括若干指令用以使得一个设备(可以是单片机，芯片等)或处理器(processor)执行本申请各实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(ROM，Read-Only Memory)、随机存取存储器(RAM，Random Access Memory)、磁碟或者光盘等各种可以存储程序代码的介质。
在此处所提供的说明书中，说明了大量具体细节。然而，能够理解，本发明的实施例可以在没有这些具体细节的情况下实践。在一些实例中，并未详细示出公知的方法、结构和技术，以便不模糊对本说明书的理解。
此外，本领域普通技术人员能够理解，尽管在此所述的一些实施例包括其它实施例中所包括的某些特征而不是其它特征，但是不同实施例的特征的 组合意味着处于本发明的范围之内并且形成不同的实施例。例如，在权利要求书中，所要求保护的实施例的任意之一都可以以任意的组合方式来使用。
本领域技术人员应理解，尽管已经参考示例性实施例描述了本发明，但是在不脱离本发明的范围的情况下，可进行各种改变并可用等同物替换其元件。另外，在不脱离本发明的实质范围的情况下，可进行许多修改以使特定情况或材料适应本发明的教导。因此，本发明不限于所公开的特定实施例，而是本发明将包括落入所附权利要求范围内的所有实施例。

Claims (20)

  1. 一种入网双向鉴权的方法，其特征在于，包括：
    配置各基站的基站鉴权信息、各节点的节点鉴权信息和各接入点的接入点信息；
    当各节点需要接入对应基站的网络时，通过各接入点交换各节点的节点鉴权信息和各基站的基站鉴权信息，以使所述各节点和所述各基站进行双向鉴权。
  2. 根据权利要求1所述的方法，其特征在于，当各节点需要接入对应基站的网络时，通过各接入点交换各节点的节点鉴权信息和各基站的基站鉴权信息，以使所述各节点和所述各基站进行双向鉴权，包括：
    当一节点需要接入其对应基站的网络时，所述节点向一接入点发送鉴权请求帧；
    所述接入点确定是否包含所述节点的节点鉴权信息，所述接入点通过所述节点的节点鉴权信息加密包含所述节点对应基站的基站鉴权信息的鉴权返回帧，并向所述节点返回加密的鉴权返回帧；
    所述节点通过所述节点的节点鉴权信息解密所返回的加密的鉴权返回帧，并通过所述加密的鉴权返回帧中的基站鉴权信息向所述节点对应基站发送入网请求。
  3. 根据权利要求2所述的方法，其特征在于，当一节点需要接入其对应基站的网络时，所述节点向一接入点发送鉴权请求帧，包括：
    当一节点需要接入其对应基站的网络时，所述节点确定是否包含所述节点对应基站的基站鉴权信息或确定所述节点周围是否有匹配的对应基站；
    当所述节点不包含所述节点对应基站的基站鉴权信息或所述节点周围没有匹配的对应基站，所述节点向一接入点发送鉴权请求帧。
  4. 根据权利要求2所述的方法，其特征在于，所述接入点确定是否包含所述节点的节点鉴权信息，所述接入点通过所述节点的节点鉴权信息加密包含所述节点对应基站的基站鉴权信息的鉴权返回帧，并向所述节点返回加密的鉴权返回帧，包括：
    所述接入点接收所述节点发送的所述鉴权请求帧，并确定所述接入点是 否包含所述节点的节点鉴权信息；
    当所述接入点包含所述节点的节点鉴权信息时，所述接入点在鉴权返回帧中加入所述节点对应基站的基站鉴权信息，并通过所述节点的节点鉴权信息对所述鉴权返回帧进行加密，所述接入点向所述节点返回加密的鉴权返回帧。
  5. 根据权利要求2所述的方法，其特征在于，所述节点通过所述节点的节点鉴权信息解密所返回的加密的鉴权返回帧，并通过所述加密的鉴权返回帧中的基站鉴权信息向所述节点对应基站发送入网请求，包括：
    所述节点接收所述接入点所返回的加密的鉴权返回帧，并确定是否能通过所述节点的节点鉴权信息解密所述加密的鉴权返回帧；
    当所述节点能通过所述节点的节点鉴权信息解密所述加密的鉴权返回帧时，所述节点通过所述加密的鉴权返回帧中的基站鉴权信息更新所述节点对应基站的基站鉴权信息；
    所述节点通过所述加密的鉴权返回帧中的基站鉴权信息搜索对应基站，并确定是否能通过所述加密的鉴权返回帧中的基站鉴权信息解密搜索到的对应基站的基站鉴权信息，当所述节点能通过所述加密的鉴权返回帧中的基站鉴权信息解密搜索到的对应基站的基站鉴权信息时，所述节点向对应基站发送入网请求。
  6. 根据权利要求1所述的方法，其特征在于，配置各基站的基站鉴权信息、各节点的节点鉴权信息和各接入点的接入点信息，包括：
    配置各基站的基站鉴权信息，每个基站的基站鉴权信息包括：基站地址、基站网络号和基站加密密钥；
    配置各节点的节点鉴权信息，每个节点的节点鉴权信息包括：节点地址、节点加密密钥、节点初始向量和节点令牌；
    配置各接入点的接入点信息，每个接入点信息包括：接入该接入点的各节点的节点鉴权信息以及各节点所对应基站的基站鉴权信息。
  7. 如权利要求6所述的方法，其特征在于，所述各节点的节点鉴权信息通过APP、web页面、NFC、蓝牙、串口、网络接口和出厂时固化中的任意 一种方式进行配置。
  8. 如权利要求6所述的方法，其特征在于，所述各基站的基站鉴权信息和所述各接入点的接入点信息通过APP、web页面、NFC、蓝牙、串口和网络接口中的任意一种方式进行配置。
  9. 根据权利要求1所述的方法，其特征在于，所述各节点的节点鉴权信息相同或不同。
  10. 一种入网双向鉴权的装置，其特征在于，采用如权利要求1-9中任意一项所述的方法，所述装置包括：
    组网的各基站；
    向各基站发送入网请求的各节点；以及
    交换各节点的节点鉴权信息和各基站的基站鉴权信息的各接入点，以使所述各节点和所述各基站进行双向鉴权；
    其中，所述各基站分别配置有基站鉴权信息，所述各节点分别配置有节点鉴权信息，所述各接入点分别配置有接入点信息。
  11. 根据权利要求10所述的装置，其特征在于，当一节点需要接入其对应基站的网络时，所述节点向一接入点发送鉴权请求帧；
    所述接入点确定是否包含所述节点的节点鉴权信息，所述接入点通过所述节点的节点鉴权信息加密包含所述节点对应基站的基站鉴权信息的鉴权返回帧，并向所述节点返回加密的鉴权返回帧；
    所述节点通过所述节点的节点鉴权信息解密所返回的加密的鉴权返回帧，并通过所述加密的鉴权返回帧中的基站鉴权信息向所述节点对应基站发送入网请求。
  12. 根据权利要求11所述的装置，其特征在于，当一节点需要接入其对应基站的网络时，所述节点向一接入点发送鉴权请求帧，包括：
    当一节点需要接入其对应基站的网络时，所述节点确定是否包含所述节点对应基站的基站鉴权信息或确定所述节点周围是否有匹配的对应基站；
    当所述节点不包含所述节点对应基站的基站鉴权信息或所述节点周围没有匹配的对应基站，所述节点向一接入点发送鉴权请求帧。
  13. 根据权利要求11所述的装置，其特征在于，所述接入点确定是否包含所述节点的节点鉴权信息，所述接入点通过所述节点的节点鉴权信息加密包含所述节点对应基站的基站鉴权信息的鉴权返回帧，并向所述节点返回加密的鉴权返回帧，包括：
    所述接入点接收所述节点发送的所述鉴权请求帧，并确定所述接入点是否包含所述节点的节点鉴权信息；
    当所述接入点包含所述节点的节点鉴权信息时，所述接入点在鉴权返回帧中加入所述节点对应基站的基站鉴权信息，并通过所述节点的节点鉴权信息对所述鉴权返回帧进行加密，所述接入点向所述节点返回加密的鉴权返回帧。
  14. 根据权利要求11所述的装置，其特征在于，所述节点通过所述节点的节点鉴权信息解密所返回的加密的鉴权返回帧，并通过所述加密的鉴权返回帧中的基站鉴权信息向所述节点对应基站发送入网请求，包括：
    所述节点接收所述接入点所返回的加密的鉴权返回帧，并确定是否能通过所述节点的节点鉴权信息解密所述加密的鉴权返回帧；
    当所述节点能通过所述节点的节点鉴权信息解密所述加密的鉴权返回帧时，所述节点通过所述加密的鉴权返回帧中的基站鉴权信息更新所述节点对应基站的基站鉴权信息；
    所述节点通过所述加密的鉴权返回帧中的基站鉴权信息搜索对应基站，并确定是否能通过所述加密的鉴权返回帧中的基站鉴权信息解密搜索到的对应基站的基站鉴权信息，当所述节点能通过所述加密的鉴权返回帧中的基站鉴权信息解密搜索到的对应基站的基站鉴权信息时，所述节点向对应基站发送入网请求。
  15. 根据权利要求10所述的装置，其特征在于，所述各节点的节点鉴权信息通过APP、web页面、NFC、蓝牙、串口、网络接口和出厂时固化中的任意一种方式进行配置。
  16. 根据权利要求10所述的装置，其特征在于，所述各基站的基站鉴权信息和所述各接入点的接入点信息通过APP、web页面、NFC、蓝牙、串口 和网络接口中的任意一种方式进行配置。
  17. 根据权利要求10所述的装置，其特征在于，每个基站的基站鉴权信息包括：基站地址、基站网络号和基站加密密钥；
    每个节点的节点鉴权信息包括：节点地址、节点加密密钥、节点初始向量和节点令牌；
    每个接入点信息包括：接入该接入点的各节点的节点鉴权信息以及各节点所对应基站的基站鉴权信息。
  18. 根据权利要求10所述的装置，其特征在于，所述各节点的节点鉴权信息相同或不同。
  19. 一种电子设备，包括存储器和处理器，其特征在于，所述存储器用于存储一条或多条计算机指令，其中，所述一条或多条计算机指令被处理器执行以实现如权利要求1-9中任一项所述的方法。
  20. 一种计算机可读存储介质，其上存储有计算机程序，其特征在于，所述计算机程序被处理器执行以实现如权利要求1-9中任一项所述的方法。
PCT/CN2020/085156 2020-04-15 2020-04-16 一种入网双向鉴权的方法及装置 WO2021208027A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202010297034.7A CN111479270B (zh) 2020-04-15 2020-04-15 一种入网双向鉴权的方法及装置
CN202010297034.7 2020-04-15

Publications (1)

Publication Number Publication Date
WO2021208027A1 true WO2021208027A1 (zh) 2021-10-21

Family

ID=71754151

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/085156 WO2021208027A1 (zh) 2020-04-15 2020-04-16 一种入网双向鉴权的方法及装置

Country Status (2)

Country Link
CN (1) CN111479270B (zh)
WO (1) WO2021208027A1 (zh)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111479270B (zh) * 2020-04-15 2021-10-12 青岛交互物联科技有限公司 一种入网双向鉴权的方法及装置

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1467943A (zh) * 2002-07-10 2004-01-14 ����ͨѶ�ɷ����޹�˾ 实现双向鉴权的码分多址系统和方法
CN1728635A (zh) * 2004-07-30 2006-02-01 华为技术有限公司 一种在码分多址系统中开展数字集群业务时的鉴权方法
CN108174380A (zh) * 2016-12-08 2018-06-15 华为技术有限公司 接入网络设备的方法及其终端设备、网络设备
WO2018142381A1 (en) * 2017-01-23 2018-08-09 Begley Luke Methods and systems for generating one or more service set identifier communication signals
CN111479270A (zh) * 2020-04-15 2020-07-31 青岛交互物联科技有限公司 一种入网双向鉴权的方法及装置

Family Cites Families (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
DE69330065T2 (de) * 1993-12-08 2001-08-09 Ibm Verfahren und System zur Schlüsselverteilung und Authentifizierung in einem Datenübertragungssystem
CN1633067A (zh) * 2003-12-24 2005-06-29 上海华虹集成电路有限责任公司 一种网络数据传输的方法
US20060104282A1 (en) * 2004-11-15 2006-05-18 Telefonaktiebolaget L M Ericsson (Publ) Mobile node (MN) discovery using the protocol for carrying authentication for network access (PANA) in a telecommunications network
CN101111047B (zh) * 2006-07-18 2011-03-30 华为技术有限公司 利用中继基站进行通信的方法及系统
CN101640886B (zh) * 2008-07-29 2012-04-25 上海华为技术有限公司 鉴权方法、重认证方法和通信装置
US8873752B1 (en) * 2009-01-16 2014-10-28 Sprint Communications Company L.P. Distributed wireless device association with basestations
CN101646223A (zh) * 2009-09-08 2010-02-10 上海华为技术有限公司 一种终端选择接入小区的方法、装置和系统
CN104254069B (zh) * 2013-06-25 2019-05-21 深圳富泰宏精密工业有限公司 无sim卡手机的网络注册系统及方法

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1467943A (zh) * 2002-07-10 2004-01-14 ����ͨѶ�ɷ����޹�˾ 实现双向鉴权的码分多址系统和方法
CN1728635A (zh) * 2004-07-30 2006-02-01 华为技术有限公司 一种在码分多址系统中开展数字集群业务时的鉴权方法
CN108174380A (zh) * 2016-12-08 2018-06-15 华为技术有限公司 接入网络设备的方法及其终端设备、网络设备
WO2018142381A1 (en) * 2017-01-23 2018-08-09 Begley Luke Methods and systems for generating one or more service set identifier communication signals
CN111479270A (zh) * 2020-04-15 2020-07-31 青岛交互物联科技有限公司 一种入网双向鉴权的方法及装置

Also Published As

Publication number Publication date
CN111479270A (zh) 2020-07-31
CN111479270B (zh) 2021-10-12

Similar Documents

Publication Publication Date Title
JP6877524B2 (ja) ワイヤレス通信のための装置および方法
US11824643B2 (en) Security lifecycle management of devices in a communications network
US11647548B2 (en) Network access method, device, and system
US11258781B2 (en) Context and device state driven authorization for devices
JP6812421B2 (ja) モビリティ管理エンティティ再配置を伴うモビリティ手順のための装置および方法
CA2665854C (en) Wireless device registration, such as automatic registration of a wi-fi enabled device
US11395148B2 (en) Method and device for protecting privacy
KR101830940B1 (ko) Wifi 설정 포팅
US10009760B2 (en) Providing network credentials
US20220191700A1 (en) Communication method and communication device
EP4187952A1 (en) Method, system and apparatus for determining user plane security algorithm
WO2018113113A1 (zh) 一种双系统终端wifi共享的方法和装置
TW202112101A (zh) 密鑰產生以及終端配網方法、裝置、設備
CN112449323B (zh) 一种通信方法、装置和系统
KR101980986B1 (ko) 네트워크에 액세스하기 위해 무선 랜 기능을 갖는 디바이스를 위한 방법 및 이 방법을 실행하기 위한 디바이스
WO2021208027A1 (zh) 一种入网双向鉴权的方法及装置
EP3281431B1 (en) Uicc key provisioning
WO2017101211A1 (zh) 无线通信系统接入方法、装置及终端
CN104902473A (zh) 一种基于cpk标识认证的无线网络接入认证的方法及装置
KR102477263B1 (ko) 보안 부품을 포함하는 장치 및 그것에 보안 정보를 주입하는 방법
JP6443918B2 (ja) アクセスポイント装置、接続情報設定プログラム及び接続情報設定方法
TW202402077A (zh) 無線通訊裝置配網方法
WO2018201429A1 (zh) 蓝牙通信方法、装置及其应用系统和设备
KR20140084444A (ko) 랜덤 링크키를 이용하여 보안화된 지그비 네트워크에서의 네트워크 접속 방법 및 지그비 통신 시스템

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20931237

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC (EPO FORM 1205A DATED 07/03/23)

122 Ep: pct application non-entry in european phase

Ref document number: 20931237

Country of ref document: EP

Kind code of ref document: A1