WO2024088165A1 - 一种网络连接方法及装置 - Google Patents

一种网络连接方法及装置 Download PDF

Info

Publication number
WO2024088165A1
WO2024088165A1 PCT/CN2023/125609 CN2023125609W WO2024088165A1 WO 2024088165 A1 WO2024088165 A1 WO 2024088165A1 CN 2023125609 W CN2023125609 W CN 2023125609W WO 2024088165 A1 WO2024088165 A1 WO 2024088165A1
Authority
WO
WIPO (PCT)
Prior art keywords
message
password
access point
association
phase
Prior art date
Application number
PCT/CN2023/125609
Other languages
English (en)
French (fr)
Inventor
任磊
宫相霖
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2024088165A1 publication Critical patent/WO2024088165A1/zh

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/03—Protecting confidentiality, e.g. by encryption
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication

Definitions

  • the present application relates to the field of communication technology, and in particular to a network connection method and device.
  • Wi-Fi networks are widely used in all walks of life, so the security of Wi-Fi networks has attracted more and more attention.
  • Wi-Fi network association some people have proposed that Wi-Fi networks can be attacked by side channel attacks, security group downgrade, etc., so as to invade Wi-Fi networks. Therefore, how to improve the security of Wi-Fi networks is a method that needs to be solved urgently.
  • the present application provides a network connection method and device to improve network security.
  • the present application provides a network connection method, the method comprising: a site generates a first message, the first message is encrypted with a first password, the first message is a message in the network association process of the site accessing an access point; the site sends the first message to the access point.
  • the message transmitted by the site in the association network process is encrypted with the first password, which can improve the security of the association network, avoid user information leakage or service denial during the association network process, and thus improve the security of the network.
  • the first password is determined according to an access password of the access point and a dynamic factor; or, the first password is the access password of the access point.
  • the first password can be continuously changed as the dynamic factor changes, thereby further improving the security of messages sent by the STA in the association and access process and improving the security of the network connection.
  • the first password is determined according to the access password of the access point and a dynamic factor, including: the first password is a password output by the dynamic password generation algorithm when the access password of the access point and the dynamic factor are used as input parameters of the dynamic password generation algorithm.
  • the dynamic factor is time information or a random sequence.
  • the first message is one or more of the following messages:
  • the first message includes a vendor information element field.
  • the length of the first message is changed, which prevents attackers from guessing the type and content of the first message through the length of the message, thereby further improving the security of the network.
  • the method further includes: the station receives a second message from the access point, the second message is encrypted using the first password, and the second message is a message in the network association process of the station accessing the access point.
  • the second message is one or more of the following messages:
  • the second message includes a vendor information element field.
  • the present application provides a network connection method, the method comprising: an access point receiving a first message from a site, the first message being a message in a network association process in which the site accesses the access point;
  • the access point decrypts the first message using the first password.
  • the first password is determined based on an access password of the access point and a dynamic factor
  • the first password is an access password of the access point.
  • the first password is determined according to the access password of the access point and a dynamic factor, including:
  • the first password is a password output by the dynamic password generation algorithm when the access password of the access point and the dynamic factor are used as input parameters of the dynamic password generation algorithm.
  • the dynamic factor is time information or a random sequence.
  • the first message is one or more of the following messages:
  • the first message includes a vendor information element field.
  • the method further includes: the access point sending a second message to the station, the second message is encrypted with the first password, and the second message is a message in the association network access process of the station accessing the access point.
  • the second message is one or more of the following messages:
  • the second message includes a vendor information element field.
  • the present application provides a communication device, which has the function of implementing the first aspect or the second aspect mentioned above.
  • the communication device includes a module or unit or means corresponding to the operations involved in the first aspect or the second aspect mentioned above.
  • the module or unit or means can be implemented by software, or by hardware, or the corresponding software can be implemented by hardware.
  • the communication device includes a processing unit and a communication unit, wherein the communication unit can be used to send and receive signals to achieve communication between the communication device and other devices; the processing unit can be used to perform some internal operations of the communication device.
  • the functions performed by the processing unit and the communication unit can correspond to the operations involved in the first aspect or the second aspect above.
  • the communication device includes a processor, which can be used to couple with a memory.
  • the memory can store necessary computer programs or instructions for implementing the functions involved in the first aspect or the second aspect.
  • the processor can execute the computer program or instructions stored in the memory, and when the computer program or instructions are executed, the communication device implements the method in any possible design or implementation of the first aspect or the second aspect.
  • the communication device includes a processor and a memory
  • the memory can store necessary computer programs or instructions for implementing the functions involved in the first aspect or the second aspect.
  • the processor can execute the computer program or instructions stored in the memory, and when the computer program or instructions are executed, the communication device implements the method in any possible design or implementation of the first aspect or the second aspect.
  • the communication device includes a processor and an interface circuit, wherein the processor is used to communicate with other devices through the interface circuit and execute the method in any possible design or implementation of the first aspect or the second aspect above.
  • the processor can be implemented by hardware or by software.
  • the processor can be a logic circuit, an integrated circuit, etc.; when implemented by software, the processor can be a general-purpose processor, which is implemented by reading the software code stored in the memory.
  • the above processors can be one or more, and the memories can be one or more.
  • the memory can be integrated with the processor, or the memory can be separately provided with the processor. In the specific implementation process, the memory can be integrated with the processor on the same chip, or can be separately provided on different chips.
  • the embodiments of the present application have no restrictions on the type of memory and There is no limitation on the configuration of the memory and the processor.
  • the present application provides a communication system, which may include a site and an access point; wherein the site is used to execute the method provided in the first aspect, and the access point is used to execute the method provided in the second aspect.
  • the present application provides a computer-readable storage medium, in which computer-readable instructions are stored.
  • a computer reads and executes the computer-readable instructions, the computer executes a method in any possible design of the first aspect or the second aspect mentioned above.
  • the present application provides a computer program product.
  • the computer reads and executes the computer program product, the computer executes the method in any possible design of the first aspect or the second aspect mentioned above.
  • the present application provides a chip, comprising a processor, wherein the processor is coupled to a memory and is used to read and execute a software program stored in the memory to implement a method in any possible design of the first aspect or the second aspect above.
  • FIG1 is a schematic diagram of a network architecture applicable to an embodiment of the present application.
  • FIG2 is a schematic diagram of a flow chart of a network connection method provided in an embodiment of the present application.
  • FIG3 is a schematic diagram of a message structure provided in an embodiment of the present application.
  • FIG4 is a schematic diagram of a message structure provided in an embodiment of the present application.
  • FIG5 is a schematic diagram of a message structure provided in an embodiment of the present application.
  • FIG6 is a schematic diagram of a flow chart of a network connection method provided in an embodiment of the present application.
  • FIG7 is a schematic diagram of the structure of a communication device provided in an embodiment of the present application.
  • FIG8 is a schematic diagram of the structure of a communication device provided in an embodiment of the present application.
  • the embodiments of the present application may be applicable to local area networks (LAN), in particular wireless local area networks (WLAN), for example, WLAN using any one of the 802.11 series protocols of the Institute of Electrical and Electronics Engineers (IEEE).
  • the WLAN may include one or more basic service sets (BSS), and the network nodes in the basic service set include access points (AP) and stations (STA).
  • IEEE 802.11ad introduces a personal basic service set (PBSS) and a personal basic service set control point (PBSS control point, PCP) on the basis of the original BSS.
  • the personal basic service set may include an AP/PCP and multiple non-AP/PCPs associated with the AP/PCP.
  • non-AP/PCP may be referred to as STA
  • PCP may be understood as the name of the role of AP in PBSS.
  • the embodiments of the present application may also be applicable to wireless local area networks such as the Internet of Things (IoT) network or the Vehicle to X (V2X) network.
  • IoT Internet of Things
  • V2X Vehicle to X
  • the embodiments of the present application may also be applicable to other possible communication systems, such as the Long Term Evolution (LTE) communication system, the LTE frequency division duplex (FDD) communication system, the LTE time division duplex (TDD) communication system, the universal mobile telecommunication system (UMTS), the worldwide interoperability for microwave access (WiMAX) communication system, the fifth generation (5G) communication system, and future evolved communication systems.
  • LTE Long Term Evolution
  • FDD frequency division duplex
  • TDD LTE time division duplex
  • UMTS universal mobile telecommunication system
  • WiMAX worldwide interoperability for microwave access
  • 5G fifth generation
  • future evolved communication systems future evolved communication systems.
  • FIG1 a network architecture diagram of a WLAN applicable to the application embodiment is shown, and FIG1 takes the WLAN including 1 AP and 2 STAs as an example.
  • the STA associated with the AP can receive wireless frames sent by the AP and can also send wireless frames to the AP.
  • the embodiment of the present application will be described by taking the communication between AP and STA as an example. It can be understood that the embodiment of the present application can also be applied to communication between APs, for example, each AP can communicate with each other through a distributed system (DS), and can also be applied to communication between STAs.
  • DS distributed system
  • AP can be an access point for terminal devices (such as mobile phones) to enter a wired (or wireless) network.
  • AP is equivalent to a bridge connecting a wired network and a wireless network. Its main function is to connect various wireless network clients together and then connect the wireless network to Ethernet.
  • AP can be a terminal device (such as a mobile phone) or a network device (such as a router) with a Wi-Fi chip.
  • AP can be a device that supports the 802.11be standard, or it can be a device that supports multiple WLAN standards of the 802.11 series such as 802.11ax, 802.11ay, 802.11ac, 802.11n, 802.11g, 802.11b, 802.11a, and 802.11be next generation.
  • STA can be a wireless communication chip, a wireless sensor or a wireless communication terminal, etc., and can also be called a user.
  • STA can be a mobile phone that supports Wi-Fi communication function, a tablet computer that supports Wi-Fi communication function, a set-top box that supports Wi-Fi communication function, a smart TV that supports Wi-Fi communication function, a smart wearable device that supports Wi-Fi communication function, a vehicle-mounted communication device that supports Wi-Fi communication function, and a computer that supports Wi-Fi communication function, etc.
  • STA can support the 802.11be standard, or can also support multiple WLAN standards of the 802.11 series such as 802.11ax, 802.11ay, 802.11ac, 802.11n, 802.11g, 802.11b, 802.11a, 802.11be next generation, etc.
  • FIG. 1 the number of APs and STAs shown in FIG. 1 is only an example, and may be more or less.
  • the AP and STA involved in FIG1 may be communication devices with dual-mode communication functions, that is, communication devices with low-frequency (LF) band (or channel or link) communication mode and high-frequency (HF) band communication mode.
  • the low-frequency band includes, for example, sub 1 GHz, 2.4 GHz, 5 GHz, and 6 GHz
  • the high-frequency band includes, for example, 45 GHz and 60 GHz.
  • the network architecture and business scenarios described in the embodiments of the present application are intended to more clearly illustrate the technical solutions of the embodiments of the present application, and do not constitute a limitation on the technical solutions provided in the embodiments of the present application.
  • a person of ordinary skill in the art can appreciate that with the evolution of the network architecture and the emergence of new business scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.
  • the association process of STA accessing AP includes three stages: authentication stage, association stage, and four-way handshake stage based on the extended authentication protocol over LAN (EAPOL).
  • the authentication stage can also be called the link authentication stage, and the authentication mechanism involved in this application can be open system authentication;
  • the association stage implements link service negotiation, and the negotiation content includes: the rate and channel supported by the STA;
  • the EAPOL four-way handshake stage is mainly to determine the key between the STA and the AP for subsequent data encryption.
  • the present application provides a network connection method, which can improve the security of the association process of STA accessing AP, thereby improving the security of the network and preventing user information leakage or service denial of STA during the association process.
  • the method provided in the embodiment of the present application is described in detail below in conjunction with specific embodiments.
  • the method provided in the embodiment of the present application is applied to the network architecture shown in Figure 1 as an example.
  • the method can be performed by two communication devices, such as the STA and AP in Figure 1.
  • the AP can also be replaced by a communication device that can support the AP to implement the functions required by the method, and of course it can also be other communication devices, such as a chip or a chip system.
  • the STA can also be replaced by a communication device that can support the STA to implement the functions required by the method, and of course it can also be other communication devices, such as a chip or a chip system.
  • the following description takes the interaction between AP and STA as an example.
  • FIG2 is a flow chart of a network connection method provided in an embodiment of the present application.
  • the STA Before the process, the STA has not connected to the AP, that is, there is no network connection between the STA and the AP.
  • the STA can obtain the service set identifier (SSID) and access password of the AP, which can also be called the SSID password.
  • SSID service set identifier
  • the present application does not limit how the STA obtains the SSID and access password.
  • the AP can broadcast the SSID corresponding to the WLAN it has established, and the user can enter the corresponding access password in the AP.
  • the process may include:
  • S201 STA generates a first message.
  • the first message is encrypted using a first password.
  • the STA and the AP may pre-negotiate the first password.
  • the first password is an access password of the AP.
  • a user can obtain the access password of the AP and input the access password of the AP into the STA, so that the STA and the AP can obtain the same first password.
  • the STA and the AP use the same method to generate the first password, so that the STA and the AP can obtain the same first password.
  • the first password is determined according to the access password and dynamic factor of the AP.
  • the STA and the AP may pre-agree on the same dynamic password generation algorithm, wherein the specific type of the dynamic password generation algorithm is not limited, for example, the dynamic password generation algorithm may be a one-time password generation algorithm based on event counting, or a one-time password generation algorithm based on time, etc.
  • the STA and the AP respectively use the access password and the dynamic factor of the AP as input parameters of the dynamic password generation algorithm, the password output by the dynamic password generation algorithm is used as the first password.
  • the first password can be continuously changed as the dynamic factor changes, thereby further improving the security of messages sent by the STA in the association and network access process and improving the security of the network connection.
  • the AP can indicate the dynamic password generation algorithm and dynamic factor supported by the AP through a broadcast message, so that the STA can determine the dynamic factor for generating the first password and the corresponding dynamic password generation algorithm.
  • the broadcast message is encrypted by an agreed password, such as the access password of the AP.
  • the STA can also download a key certificate, which indicates the dynamic factor for generating the first password and the dynamic password generation algorithm.
  • the download address of the key certificate can be indicated by the AP or pre-agreed.
  • the STA can verify the identity of the STA before downloading the key certificate, and only the STA that passes the identity authentication can download the key certificate.
  • the specific identity authentication process is not limited in this application and will not be repeated here.
  • the dynamic factor may be time information, for example, the dynamic factor may be system time; the dynamic factor may also be a random sequence, the random sequence may also be generated independently by the AP and the STA according to an agreed algorithm, the random sequence may also be generated by the AP and indicated to the STA, and the random sequence may also be generated by the STA and indicated to the AP.
  • the dynamic factor may also be information that can be obtained by both the SAT and the AP, and the present application does not limit this.
  • the dynamic factor corresponds to an update cycle, and the duration of the cycle can be set according to the actual situation.
  • the dynamic factor remains unchanged, and the first key generated according to the dynamic factor also remains unchanged in the cycle. If the dynamic factor changes, the first key generated according to the dynamic factor also changes.
  • STA1 and STA2 access the AP in the same cycle, that is, start the association access process of accessing the AP in the same cycle, then the dynamic factors obtained by STA1 and STA2 are the same, and thus the first passwords calculated are also the same.
  • STA1 and STA2 use the same password to encrypt messages.
  • STA1 and STA2 access the AP in different cycles, for example, STA1 starts the association access process to the AP in the first cycle, and STA2 starts the association access process to the AP in the second cycle, then the dynamic factors obtained by STA1 and STA2 are different, even if STA1 and STA2 use the same dynamic password generation algorithm, the calculated first passwords are also different. STA1 and STA2 use different passwords to encrypt messages in the association access process.
  • the first message is a message in the association access process of STA accessing AP. That is, STA has not yet accessed AP.
  • SAT can generate the first message.
  • the association process includes three stages: authentication stage, association stage, and EAPOL four-step handshake stage.
  • the first message can be a message sent by the STA to the AP in at least one of the three stages. Specifically, the first message is one or more of the following messages:
  • the STA can also perform a salting operation on the first message, that is, add a vendor information element field to the first message to change the length of the first message, thereby preventing attackers from guessing the type and content of the first message through the length of the message, thereby further improving the security of the network.
  • the structure of the authentication request message after salting may be as shown in Figure 3.
  • the authentication request message includes a media access control (MAC) header field, an authentication algorithm field, an authentication sequence field, a status code field, and a vendor information element field.
  • MAC media access control
  • the specific content and meaning of the fields in the authentication request message other than the vendor information element field can refer to the description in the 802.11 series, and this application does not limit this.
  • the vendor information element field is a field newly added in the authentication request message of this application.
  • the vendor information element field can include element identification (element identification, EID), length (length, len), organizationally unique identifier (organizationally unique identifier, OUI) and data (data).
  • EID element identification
  • Len organizationally unique identifier
  • OUI organizationally unique identifier
  • data data
  • the value of EID is not limited, for example, it can be 221; len represents the total length of OUI and data; the specific content of data is not limited by this application.
  • the structure of the association request message after salting may be as shown in FIG4.
  • the association request message includes not only the MAC header field, the capability information field, the listen interval field, etc., but also a newly added vendor information element field.
  • the specific content and meaning of the fields in the association request message except the vendor information element field can be referred to the description in the 802.11 series, and this application is not limited to this.
  • the STA sends a first message to the AP; correspondingly, the AP receives the first message from the STA.
  • S203 The AP decrypts the first message using the first password.
  • the AP sends a second message to the STA; correspondingly, the STA receives the second message from the AP.
  • the second message is encrypted using the first password.
  • the STA when the STA receives the second message, it decrypts the second message using the first password.
  • the second message is a message in the association access process of the STA accessing the AP.
  • the second message is one or more of the following messages:
  • the AP may also perform a salting operation on the second message, that is, add a vendor information element field to the second message, so that the length of the second message changes, thereby preventing attackers from guessing the type and content of the second message through the length of the message, thereby further improving the security of the network.
  • the structure of the association response message after salting may be as shown in FIG5.
  • the association response message includes a vendor information element field in addition to the MAC header field, the capability information field, the status code field, and other fields.
  • the specific content and meaning of the fields in the association response message except the vendor information element field can be referred to the description in the 802.11 series, and this application is not limited to this.
  • the message in the association process of the STA accessing the AP is encrypted with the first password, which can improve the security of the association process and prevent the user information of the STA from being leaked or denied service during the association process.
  • FIG6 it is a schematic diagram of a flow chart of a network connection method provided in an embodiment of the present application.
  • the input parameters of the dynamic password generation algorithm are the AP's access password and a dynamic factor, and the dynamic factor is time information.
  • STA sends an authentication request message to AP, where the authentication request message is encrypted with a first password and includes a vendor information element field.
  • the AP sends an authentication response message to the STA.
  • the authentication request message is encrypted using the first password, and the authentication request message includes a vendor information element field.
  • S601 and S602 are messages in the authentication phase. Through S601 and S602, the AP completes authentication of the STA.
  • the authentication mechanism in this authentication phase may refer to development system authentication.
  • the STA sends an association request message to the AP.
  • the association request message is encrypted with a first password and includes a vendor information element field.
  • the association request message can carry various parameters of the STA itself and various parameters selected according to the service configuration, such as the rate supported by the STA, the supported channels, the supported quality of service (QoS) capabilities, etc.
  • the service configuration such as the rate supported by the STA, the supported channels, the supported quality of service (QoS) capabilities, etc.
  • the AP sends an association response message to the STA.
  • the association request message is encrypted using the first password, and the association request message includes a vendor information element field.
  • S603 and S604 are messages in the association phase. Through S601 and S602, the AP and the STA implement link service negotiation.
  • the negotiation content includes: information such as the rate, channel, and QoS supported by the STA.
  • S605 The AP sends a message 1 in the EAPOL four-step handshake phase to the STA, where the message 1 is encrypted using the first password.
  • the message 1 includes a vendor information element field.
  • S606 The STA sends a message 2 in the EAPOL four-step handshake phase to the AP, where the message 2 is encrypted using the first password.
  • the message 2 includes a vendor information element field.
  • S607 The AP sends message 3 in the EAPOL four-step handshake phase to the STA, where the message 3 is encrypted using the first password.
  • the message 3 includes a vendor information element field.
  • S608 The STA sends a message 4 in the EAPOL four-step handshake phase to the AP, where the message 4 is encrypted using the first password.
  • the message 4 includes a vendor information element field.
  • the AP and the STA implement the EAPOL four-step handshake and determine the key used for subsequent data encryption between the STA and the AP.
  • the STA accesses the AP, and the STA can communicate with other devices through the AP.
  • the STA and the AP may include hardware structures and/or software modules corresponding to the execution of each function.
  • the embodiments of the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in the form of hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to exceed the scope of this application.
  • the embodiment of the present application can divide the functional units of STA and AP according to the above method example.
  • each functional unit can be divided according to each function, or two or more functions can be integrated into one unit.
  • the above integrated unit can be implemented in the form of hardware or software functional unit.
  • the embodiment of the present application also provides a communication device 700 for implementing the functions of the access network device or the core network device or the terminal device in the above method.
  • the device may be a software module or a chip system.
  • the chip system may be composed of a chip, or may include a chip and other discrete devices.
  • the communication device 700 may include: a processing unit 701 and a communication unit 702.
  • the communication unit may also be referred to as a transceiver unit, and may include a sending unit and/or a receiving unit, which are respectively used to execute the sending and receiving steps performed by the access network device or core network device or terminal device in the above method embodiment.
  • the communication unit may also be referred to as a transceiver, a transceiver, a transceiver device, etc.
  • the processing unit may also be referred to as a processor, a processing board, a processing module, a processing device, etc.
  • the device used to implement the receiving function in the communication unit 702 may be regarded as a receiving unit, and the device used to implement the sending function in the communication unit 702 may be regarded as a sending unit, that is, the communication unit 702 includes a receiving unit and a sending unit.
  • the communication unit may also be sometimes referred to as a transceiver, a transceiver, or a transceiver circuit, etc.
  • the receiving unit may also be sometimes referred to as a receiver, a receiver, or a receiving circuit, etc.
  • the sending unit may also be sometimes referred to as a transmitter, a transmitter, or a transmitting circuit, etc.
  • the communication device 700 may perform the following functions:
  • a processing unit configured to generate a first message, the first message being encrypted with a first password, the first message being a message in a network association process of a site accessing an access point;
  • the communication unit is configured to send a first message to an access point.
  • the first password is determined based on an access password of the access point and a dynamic factor
  • the first password is an access password of the access point.
  • the processing unit is specifically configured to:
  • the password output by the dynamic password generation algorithm is used as the first password.
  • the dynamic factor is time information or a random sequence.
  • the first message is one or more of the following messages:
  • the first message includes a vendor information element field.
  • the communication unit is further configured to:
  • a second message is received from the access point, where the second message is encrypted with the first password and is a message in a network association process of the site accessing the access point.
  • the second message is one or more of the following messages:
  • the second message includes a vendor information element field.
  • the communication device 700 may perform the following functions:
  • a communication unit configured to receive a first message from a site, where the first message is a message in a process of associating a site with an access point;
  • the processing unit is configured to decrypt the first message using a first password.
  • the first password is determined based on an access password of the access point and a dynamic factor
  • the first password is an access password of the access point.
  • the processing unit is specifically configured to:
  • the password output by the dynamic password generation algorithm is used as the first password.
  • the dynamic factor is time information or a random sequence.
  • the first message is one or more of the following messages:
  • the first message includes a vendor information element field.
  • the communication unit is further used for:
  • a second message is sent to the site, the second message is encrypted with the first password, and the second message is a message in the network association process of the site accessing the access point.
  • the second message is one or more of the following messages:
  • the second message includes a vendor information element field.
  • processing unit 701 and the communication unit 702 may also perform other functions.
  • processing unit 701 and the communication unit 702 may also perform other functions.
  • a communication device 800 provided in an embodiment of the present application is shown.
  • the device shown in FIG8 may be a hardware circuit implementation of the device shown in FIG7 .
  • the communication device may be applicable to the flowchart shown above to perform the functions of the access network device, core network device, or terminal device in the above method embodiment.
  • FIG8 only shows the main components of the communication device.
  • the communication device 800 includes a processor 810 and an interface circuit 820.
  • the processor 810 and the interface circuit 820 are coupled to each other.
  • the interface circuit 820 may be a transceiver or an input/output interface.
  • the communication device 800 may further include a memory 830 for storing instructions executed by the processor 810 or storing input data required by the processor 810 to execute instructions or storing data generated after the processor 810 executes instructions.
  • the processor 810 is used to implement the function of the processing unit 701
  • the interface circuit 820 is used to implement the function of the communication unit 702.
  • the chip of the access network device implements the functions of the access network device in the above method embodiment.
  • the access network device chip receives information from other modules (such as a radio frequency module or an antenna) in the terminal device; or the access network device chip sends information to other modules (such as a radio frequency module or an antenna) in the access network device.
  • the chip of the core network device implements the functions of the core network device in the above method embodiment.
  • the chip of the core network device receives information from other modules (such as a radio frequency module or an antenna) in the core network device; or the chip of the core network device sends information to other modules (such as a radio frequency module or an antenna) in the core network device.
  • the processor in the embodiments of the present application may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field programmable gate arrays (FPGA) or other programmable logic devices, transistor logic devices, hardware components or any combination thereof.
  • the general-purpose processor may be a microprocessor or any conventional processor.
  • the processor may be a random access memory (RAM), a flash memory, a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), a register, a hard disk, a mobile hard disk, a CD-ROM, or any other form of storage medium known in the art.
  • An exemplary storage medium is coupled to the processor so that the processor can read information from the storage medium and write information to the storage medium.
  • the storage medium may also be a component of the processor.
  • the processor and the storage medium may be located in an ASIC.
  • the ASIC may be located in a network device or a terminal device.
  • the processor and the storage medium may also exist as discrete components in a network device or a terminal device.
  • the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, optical storage, etc.) that contain computer-usable program code.
  • a computer-usable storage media including but not limited to disk storage, optical storage, etc.
  • These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including an instruction device that implements the functions specified in one or more processes in the flowchart and/or one or more boxes in the block diagram.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本申请涉及通信技术领域，公开了一种网络连接方法及装置，其中方法包括：站点生成第一消息，所述第一消息采用第一密码加密，所述第一消息为所述站点接入接入点的关联入网流程中的消息；所述站点向所述接入点发送所述第一消息。通过上面的方法，在站点接入接入点的关联入网流程中的消息采用第一密码进行加密，可以提高关联入网的安全性，避免关联入网过程中用户信息泄露或被拒绝服务。

Description

一种网络连接方法及装置
相关申请的交叉引用
本申请要求在2022年10月28日提交中国专利局、申请号为202211331696.7、申请名称为“一种网络连接方法及装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及通信技术领域，尤其涉及一种网络连接方法及装置。
背景技术
无线保真(wireless-fidelity，Wi-Fi)网络在各行各业都被普遍的使用，因此Wi-Fi网络的安全性也越来越被人们所关注。近年来，在Wi-Fi网络的关联入网过程中，有人提出可以采用侧信道攻击、安全组降级等方式对Wi-Fi网络进行攻击，从而入侵Wi-Fi网络。因此如何提升Wi-Fi网络的安全性，是一个亟待解决的方法。
发明内容
本申请提供一种网络连接方法及装置，用以提升网络的安全性。
第一方面，本申请提供一种网络连接方法，该方法包括：站点生成第一消息，第一消息采用第一密码加密，第一消息为站点接入接入点的关联入网流程中的消息；站点向接入点发送第一消息。
通过上面的方法，站点在关联入网流程中传输的消息采用第一密码进行加密，可以提高关联入网的安全性，避免关联入网过程中用户信息泄露或被拒绝服务，从而提升网络的安全性。
一种可能的实现方式中，第一密码根据接入点的接入密码和动态因子确定；或者，第一密码为接入点的接入密码。
如果第一密码根据接入密码和动态因子确定，可以使得第一密码随着动态因子的变化而不断变化，从而进一步提高STA在关联入网流程中发送的消息的安全性，提高网络连接的安全性。
一种可能的实现方式中，第一密码根据接入点的接入密码和动态因子确定，包括：第一密码为将接入点的接入密码和动态因子作为动态密码生成算法的输入参数时，动态密码生成算法输出的密码。
一种可能的实现方式中，动态因子为时间信息或随机序列。
一种可能的实现方式中，第一消息为以下一项或多项消息：
认证阶段的认证请求消息；
关联阶段的关联请求消息；
基于局域网的扩展认证协议(extensible authentication protocol over LAN，EAPOL)四步握手阶段中的消息2；
EAPOL四步握手阶段中的消息4。
通过对认证阶段、关联阶段以及EAPOL四步握手阶段中的消息进行加密，可以避免关联入网过程中用户信息泄露，从而提升网络的安全性。
一种可能的实现方式中，第一消息包括供应商信息元素字段。
通过在第一消息中添加供应商信息元素字段，使得第一消息的长度发生改变，避免被攻击者通过消息的长度猜测出第一消息的类型以及内容等信息，从而进一步提高网络的安全性。
一种可能的实现方式中，该方法还包括：站点接收来自接入点第二消息，第二消息采用第一密码加密，第二消息为站点接入接入点的关联入网流程中的消息。
一种可能的实现方式中，第二消息为以下一项或多项消息：
认证阶段的认证响应消息；
关联阶段的关联响应消息；
EAPOL四步握手阶段中的消息1；
EAPOL四步握手阶段中的消息3。
一种可能的实现方式中，第二消息包括供应商信息元素字段。
第二方面，本申请提供一种网络连接方法，该方法包括：接入点接收来自站点的第一消息，第一消息为站点接入接入点的关联入网流程中的消息；
接入点采用第一密码对第一消息进行解密。
一种可能的实现方式中，第一密码根据接入点的接入密码和动态因子确定；
或者，第一密码为接入点的接入密码。
一种可能的实现方式中，第一密码根据接入点的接入密码和动态因子确定，包括：
第一密码为将接入点的接入密码和动态因子作为动态密码生成算法的输入参数时，动态密码生成算法输出的密码。
一种可能的实现方式中，动态因子为时间信息或随机序列。
一种可能的实现方式中，第一消息为以下一项或多项消息：
认证阶段的认证请求消息；
关联阶段的关联请求消息；
基于局域网的扩展认证协议EAPOL四步握手阶段中的消息2；
EAPOL四步握手阶段中的消息4。
一种可能的实现方式中，第一消息包括供应商信息元素字段。
一种可能的实现方式中，该方法还包括：接入点向站点发送第二消息，第二消息采用第一密码加密，第二消息为站点接入接入点的关联入网流程中的消息。
一种可能的实现方式中，第二消息为以下一项或多项消息：
认证阶段的认证响应消息；
关联阶段的关联响应消息；
EAPOL四步握手阶段中的消息1；
EAPOL四步握手阶段中的消息3。
一种可能的实现方式中，第二消息包括供应商信息元素字段。
可以理解的是，上述第二方面所描述的方法与第一方面所描述的方法相对应，第二方面中相关技术特征的有益效果可以参照第一方面的描述，不再赘述。
第三方面，本申请提供一种通信装置，所述通信装置具备实现上述第一方面或第二方面的功能，比如，所述通信装置包括执行上述第一方面或第二方面涉及操作所对应的模块或单元或手段(means)，所述模块或单元或手段可以通过软件实现，或者通过硬件实现，也可以通过硬件执行相应的软件实现。
在一种可能的设计中，所述通信装置包括处理单元、通信单元，其中，通信单元可以用于收发信号，以实现该通信装置和其它装置之间的通信；处理单元可以用于执行该通信装置的一些内部操作。处理单元、通信单元执行的功能可以和上述第一方面或第二方面涉及的操作相对应。
在一种可能的设计中，所述通信装置包括处理器，处理器可以用于与存储器耦合。所述存储器可以保存实现上述第一方面或第二方面涉及的功能的必要计算机程序或指令。所述处理器可执行所述存储器存储的计算机程序或指令，当所述计算机程序或指令被执行时，使得所述通信装置实现上述第一方面或第二方面中任意可能的设计或实现方式中的方法。
在一种可能的设计中，所述通信装置包括处理器和存储器，存储器可以保存实现上述第一方面或第二方面涉及的功能的必要计算机程序或指令。所述处理器可执行所述存储器存储的计算机程序或指令，当所述计算机程序或指令被执行时，使得所述通信装置实现上述第一方面或第二方面中任意可能的设计或实现方式中的方法。
在一种可能的设计中，所述通信装置包括处理器和接口电路，其中，处理器用于通过所述接口电路与其它装置通信，并执行上述第一方面或第二方面中任意可能的设计或实现方式中的方法。
可以理解地，上述第三方面中，处理器可以通过硬件来实现也可以通过软件来实现，当通过硬件实现时，该处理器可以是逻辑电路、集成电路等；当通过软件来实现时，该处理器可以是一个通用处理器，通过读取存储器中存储的软件代码来实现。此外，以上处理器可以为一个或多个，存储器可以为一个或多个。存储器可以与处理器集成在一起，或者存储器与处理器分离设置。在具体实现过程中，存储器可以与处理器集成在同一块芯片上，也可以分别设置在不同的芯片上，本申请实施例对存储器的类型以及 存储器与处理器的设置方式不做限定。
第四方面，本申请提供一种通信系统，该通信系统可以包括站点和接入点；其中，站点用于执行上述第一方面所提供的方法，接入点用于执行上述第二方面所提供的方法。
第五方面，本申请提供一种计算机可读存储介质，所述计算机存储介质中存储有计算机可读指令，当计算机读取并执行所述计算机可读指令时，使得计算机执行上述第一方面或第二方面的任一种可能的设计中的方法。
第六方面，本申请提供一种计算机程序产品，当计算机读取并执行所述计算机程序产品时，使得计算机执行上述第一方面或第二方面的任一种可能的设计中的方法。
第七方面，本申请提供一种芯片，所述芯片包括处理器，所述处理器与存储器耦合，用于读取并执行所述存储器中存储的软件程序，以实现上述第一方面或第二方面的任一种可能的设计中的方法。
附图说明
图1为本申请实施例适用的一种网络架构示意图；
图2为本申请实施例提供的一种网络连接方法流程示意图；
图3为本申请实施例提供的一种消息结构示意图；
图4为本申请实施例提供的一种消息结构示意图；
图5为本申请实施例提供的一种消息结构示意图；
图6为本申请实施例提供的一种网络连接方法流程示意图；
图7为本申请实施例提供的一种通信装置结构示意图；
图8为本申请实施例提供的一种通信装置结构示意图。
具体实施方式
下面结合说明书附图对本申请实施例做详细描述。
本申请实施例可以适用于局域网(local area networks，LAN)，特别是无线局域网(wireless local area networks，WLAN)，比如可以适用于采用电气电子工程师协会(institute of electrical and electronics engineers，IEEE)802.11系列协议中的任意一种协议的WLAN。其中，WLAN可以包括一个或多个基本服务集(basic service set，BSS)，基本服务集中的网络节点包括接入点(access point，AP)和站点(station，STA)。此外，IEEE 802.11ad在原有的BSS基础上，引入个人基本服务集(personal basic service set，PBSS)和个人基本服务集控制节点(PBSS control point，PCP)，个人基本服务集可以包含一个AP/PCP和多个关联于该AP/PCP的非(non)AP/PCP，本申请实施例中non AP/PCP可以称为STA，PCP可以理解为AP在PBSS里的角色的称呼。
本申请实施例也可以适用于物联网(internet of things，IoT)网络或车联网(vehicle to X，V2X)网络等无线局域网中。当然，本申请实施例还可以适用于其它可能的通信系统，例如长期演进(long term evolution，LTE)通信系统、LTE频分双工(frequency division duplex，FDD)通信系统、LTE时分双工(time division duplex，TDD)通信系统、通用移动通信系统(universal mobile telecommunication system，UMTS)、全球互联微波接入(worldwide interoperability for microwave access，WiMAX)通信系统、第五代(5th generation，5G)通信系统以及未来演进的通信系统等。
下文以本申请实施例适用于WLAN为例。参见图1，示出了本申请实施例适用的一种WLAN的网络架构图，图1是以该WLAN包括1个AP和2个STA为例。其中，与AP关联的STA，能够接收该AP发送的无线帧，也能够向该AP发送无线帧。本申请实施例将以AP和STA之间的通信为例进行描述，可以理解的是，本申请实施例也可以适用于AP与AP之间的通信，例如各个AP之间可通过分布式系统(distributed system，DS)相互通信，也可以适用于STA与STA之间的通信。
AP可以为终端设备(如手机)进入有线(或无线)网络的接入点。AP相当于一个连接有线网络和无线网络的桥梁，主要作用是将各个无线网络客户端连接到一起，然后将无线网络接入以太网。比如，AP可以是带有Wi-Fi芯片的终端设备(如手机)或者网络设备(如路由器)。本申请实施例中，AP可以为支持802.11be制式的设备，或者也可以为支持802.11ax、802.11ay、802.11ac、802.11n、802.11g、802.11b、802.11a以及802.11be下一代等802.11系列的多种WLAN制式的设备。
STA可以为无线通讯芯片、无线传感器或无线通信终端等，也可称为用户。例如，STA可以为支持Wi-Fi通讯功能的移动电话、支持Wi-Fi通讯功能的平板电脑、支持Wi-Fi通讯功能的机顶盒、支持Wi-Fi通讯功能的智能电视、支持Wi-Fi通讯功能的智能可穿戴设备、支持Wi-Fi通讯功能的车载通信设备和支持Wi-Fi通讯功能的计算机等等。可选地，STA可以支持802.11be制式，或者也可以支持802.11ax、802.11ay、802.11ac、802.11n、802.11g、802.11b、802.11a、802.11be下一代等802.11系列的多种WLAN制式。
可以理解的是，图1中所示意的AP和STA的数量仅是举例，还可以更多或者更少。
图1中所涉及的AP和STA可以为具有双模通信功能的通信装置，也就是具有低频(low frequency，LF)频段(或信道或链路)通信模式，和高频(highfrequency，HF)频段通信模式的通信装置。其中，低频频段比如包括sub 1吉赫兹(GHz)、2.4GHz、5GHz以及6GHz等，高频频段比如包括45GHz以及60GHz等。
本申请实施例描述的网络架构以及业务场景是为了更加清楚的说明本申请实施例的技术方案，并不构成对于本申请实施例提供的技术方案的限定，本领域普通技术人员可知，随着网络架构的演变和新业务场景的出现，本申请实施例提供的技术方案对于类似的技术问题，同样适用。
目前，STA接入AP的关联入网流程依次包括三个阶段：认证阶段，关联阶段，以及基于局域网的扩展认证协议(extensible authentication protocol over LAN，EAPOL)四步握手阶段。其中，认证阶段也可以称为链路认证阶段，本申请涉及到的认证机制可以为开放系统认证；关联阶段实现链路服务协商，协商内容包括：STA支持的速率、信道等信息；EAPOL四次握手阶段主要是为了确定出STA与AP之间用于后续数据加密的密钥。
本申请提供一种网络连接方法，可以提高STA接入AP的关联入网流程的安全性，从而提高网络的安全性，避免STA在关联入网过程中用户信息泄露或被拒绝服务。
下面结合具体实施例对本申请实施例提供的方法进行详细描述。在具体实施例中，将以本申请实施例所提供的方法应用于图1所示的网络架构为例。另外，该方法可由两个通信装置执行，这两个通信装置例如为图1中的STA和AP。其中，AP也可以替换为能够支持AP实现该方法所需的功能的通信装置，当然还可以是其他通信装置，例如芯片或芯片系统。STA也可以替换为能够支持STA实现该方法所需的功能的通信装置，当然还可以是其他通信装置，例如芯片或芯片系统。为了便于介绍，在下文中，以AP和STA之间的交互为例进行描述。
图2为本申请实施例提供的一种网络连接方法所对应的流程示意图。该流程之前，STA没有接入AP，即STA与AP之间没有网络连接。STA可以获取AP的服务集标识(service set identifier，SSID)以及接入密码，该接入密码也可以称为SSID密码。STA如何获取SSID以及接入密码，本申请并不限定，例如，AP可以广播其建立的WLAN对应的SSID，用户可以在AP中输入相应的接入密码。该流程可以包括：
S201：STA生成第一消息。
其中，第一消息采用第一密码加密。
本申请中，SAT生成第一消息之前，STA和AP之间可以预先协商第一密码。
一种实现方式中，第一密码为AP的接入密码。例如，在该实现方式中，用户可以获得AP的接入密码，并将AP的接入密码输入至STA中，STA和AP之间从而能够获得相同的第一密码。
另一种实现方式中，STA和AP之间采用相同的方法生成第一密码，STA和AP之间从而能够获得相同的第一密码。
具体的，第一密码根据AP的接入密码和动态因子确定。举例来说，STA和AP之间可以预先约定相同的动态密码生成算法，其中，动态密码生成算法的具体类型并不限定，例如动态密码生成算法可以为基于事件计数的一次性密码生成算法，或者基于时间的一次性密码生成算法等。STA和AP分别将AP的接入密码和动态因子作为动态密码生成算法的输入参数时，动态密码生成算法输出的密码作为第一密码。
通过使用动态密码生成算法生成第一密码，可以使得第一密码随着动态因子的变化而不断变化，从而进一步提高STA在关联入网流程中发送的消息的安全性，提高网络连接的安全性。
在该实现方式中，AP可以通过广播消息指示AP支持的动态密码生成算法以及动态因子，STA从而可以确定生成第一密码的动态因子，以及相应的动态密码生成算法。可选地，为了保证安全性，该广 播消息是通过约定密码加密的，例如通过AP的接入密码加密。
在该实现方式中，STA还可以下载密钥证书，该密钥证书中指示了生成第一密码的动态因子以及动态密码生成算法。其中，密钥证书的下载地址可以是AP指示的，也可以是预先约定的。可选地，为了保证安全性，STA在下载密钥证书之前，可以对STA的身份进行验证，只有身份验证通过的STA才能够下载密钥证书。具体身份验证过程，本申请对此并不限定，在此不再赘述。
本申请中，动态因子可以是时间信息，例如该动态因子可以是系统时间；动态因子也可以是随机序列，该随机序列也可以是AP和STA按照约定的算法各自独立生成的，该随机序列也可以是AP生成后指示给STA的，该随机序列也可以是STA生成后指示给AP的。以上只是示例，该动态因子也可以是SAT和AP都能够获取到的信息，本申请对此并不限定。
本申请中，动态因子对应一个更新周期，该周期的时长可以根据实际情况设置。每个周期内，动态因子保持不变，根据该动态因子生成的第一密钥在该周期内也保持不变。如果动态因子发生改变，那么根据该动态因子生成的第一密钥也发生改变。
假如STA1和STA2在同一个周期内接入AP，即在同一个周期内启动接入AP的关联入网流程，那么STA1和STA2获得的动态因子是相同的，从而计算出的第一密码也是相同的。STA1和STA2在关联入网流程中，采用相同的密码对消息进行加密。
假如STA1和STA2在不同周期内接入AP，例如STA1在第一周期内启动接入AP的关联入网流程，STA2在第二周期内启动接入AP的关联入网流程，那么STA1和STA2获得的动态因子是不同的，即时STA1和STA2采用相同的动态密码生成算法，计算出的第一密码也是不同的。STA1和STA2在关联入网流程中，采用不同的密码对消息进行加密。
本申请中，第一消息为STA接入AP的关联入网流程中的消息。也就是说，STA当前还没有接入AP，当用户通过在STA中输入AP的接入密码，触发启动接入AP的关联入网流程时，SAT可以生成第一消息。
关联入网流程包括三个阶段：认证阶段，关联阶段，以及EAPOL四步握手阶段。第一消息可以为上述三个阶段中的至少一个阶段中，STA向AP发送的消息。具体的，第一消息为以下一项或多项消息：
认证阶段的认证请求(authentication request)消息；
关联阶段的关联请求(association request)消息；
EAPOL四步握手阶段中的消息2；
EAPOL四步握手阶段中的消息4。
由于目前关联入网流程中的消息的内容和长度是固定的，本申请中，STA还可以对第一消息进行加盐操作，即在第一消息中添加供应商信息元素(vendor information element)字段，使得第一消息的长度发生改变，避免被攻击者通过消息的长度猜测出第一消息的类型以及内容等信息，从而进一步提高网络的安全性。
举例来说，假如第一消息为认证请求消息，经过加盐后的认证请求消息的结构可以如图3所示。图3中，认证请求消息包括媒体接入控制(medium access control，MAC)头(header)字段、认证算法(authentication algorithm)字段、认证序号(authentication sequence)字段、状态码(status code)字段以及供应商信息元素字段。
其中，认证请求消息中除了供应商信息元素字段之外的字段的具体内容和含义，可以参考802.11系列中的描述，本申请对此并不限定。供应商信息元素字段为本申请在认证请求消息中新增加的字段，供应商信息元素字段可以包括元素标识(element identification，EID)、长度(length，len)、组织唯一标志符(organizationally unique identifier，OUI)以及数据(data)。其中，EID的取值并不限定，例如可以为221；len表示OUI以及数据的总长度；数据的具体内容，本申请并不限定。
举例来说，假如第一消息为关联请求消息，经过加盐后的关联请求消息的结构可以如图4所示。图4中，关联请求消息除了包括MAC头字段、能力信息(capability info)字段、聆听间隔(listen interval)字段等字段之外，还包括新增加供应商信息元素字段。
其中，关联请求消息中除了供应商信息元素字段之外的字段的具体内容和含义，可以参考802.11系列中的描述，本申请对此并不限定。
S202：STA向AP发送第一消息；相应的，AP接收来自STA的第一消息。
STA发送第一消息的具体过程，本申请对此并不限定，在此不再赘述。
S203：AP采用第一密码对第一消息进行解密。
AP如何确定第一密码，可以参考前面的描述方式，在此不再赘述。
S204：AP向STA发送第二消息；相应的，STA接收来自AP的第二消息。
其中，第二消息采用第一密码加密。相应的，STA接收到第二消息时，采用第一密码解密第二消息。
本申请中，第二消息为STA接入AP的关联入网流程中的消息。举例来说，第二消息为以下一项或多项消息：
认证阶段的认证响应(authentication response)消息；
关联阶段的关联响应(association response)消息；
EAPOL四步握手阶段中的消息1；
EAPOL四步握手阶段中的消息3。
本申请中，AP也可以对第二消息进行加盐操作，即在第二消息中添加供应商信息元素字段，使得第二消息的长度发生改变，避免被攻击者通过消息的长度猜测出第二消息的类型以及内容等信息，从而进一步提高网络的安全性。
举例来说，假如第二消息为关联响应消息，经过加盐后的关联响应消息的结构可以如图5所示。图5中，关联响应消息除了包括MAC头字段、能力信息(capability info)字段、状态码字段等字段之外，还包括供应商信息元素字段。
其中，关联响应消息中除了供应商信息元素字段之外的字段的具体内容和含义，可以参考802.11系列中的描述，本申请对此并不限定。
通过上面的方法，在STA接入AP的关联入网流程中的消息采用第一密码进行加密，可以提高关联入网的安全性，避免STA在关联入网过程中用户信息泄露或被拒绝服务。
结合前面的描述，下面通过一个具体的实施例描述前面的过程。
如图6所示，为本申请实施例提供的一种网络连接方法流程示意图。
图6所示的流程之前，AP和STA之间约定采用相同的动态密码生成算法生成第一密码。动态密码生成算法的输入参数为AP的接入密码和动态因子，动态因子为时间信息。
当用户通过在STA中输入AP的接入密码触发启动接入AP的关联入网流程时，包括以下流程。
S601：STA向AP发送认证请求消息，该认证请求消息采用第一密码加密，且认证请求消息包括供应商信息元素字段。
S602：AP向STA发送认证响应消息，该认证请求消息采用第一密码加密，且认证请求消息包括供应商信息元素字段。
S601和S602为认证阶段的消息，通过S601和S602，AP对STA完成认证。该认证阶段的认证机制可以是指开发系统认证。
S603：STA向AP发送关联请求消息，该关联请求消息采用第一密码加密，且关联请求消息包括供应商信息元素字段。
其中，该关联请求消息中可以携带STA自身的各种参数以及根据服务配置选择的各种参数，例如STA支持的速率、支持的信道、支持的服务质量(quality of service，QoS)的能力等。
S604：AP向STA发送关联响应消息，该关联请求消息采用第一密码加密，且关联请求消息包括供应商信息元素字段。
S603和S604为关联阶段的消息，通过S601和S602，AP和STA实现链路服务协商，协商内容包括：STA支持的速率、信道以及QoS等信息。
S605：AP向STA发送EAPOL四步握手阶段中的消息1，该消息1采用第一密码加密。
可选地，该消息1包括供应商信息元素字段。
S606：STA向AP发送EAPOL四步握手阶段中的消息2，该消息2采用第一密码加密。
可选地，该消息2包括供应商信息元素字段。
S607：AP向STA发送EAPOL四步握手阶段中的消息3，该消息3采用第一密码加密。
可选地，该消息3包括供应商信息元素字段。
S608：STA向AP发送EAPOL四步握手阶段中的消息4，该消息4采用第一密码加密。
可选地，该消息4包括供应商信息元素字段。
通过S605至S608，AP和STA实现EAPOL四步握手，并确定出STA与AP之间用于后续数据加密的密钥。
通过上述过程，STA实现接入AP，STA从而可以通过AP与其它设备进行通信。
上述主要从通信装置交互的角度对本申请实施例提供的方案进行了介绍。可以理解的是，为了实现上述功能，STA和AP可以包括执行各个功能相应的硬件结构和/或软件模块。本领域技术人员应该很容易意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，本申请的实施例能够以硬件或硬件和计算机软件的结合形式来实现。某个功能究竟以硬件还是计算机软件驱动硬件的方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。
本申请实施例可以根据上述方法示例对STA和AP进行功能单元的划分，例如，可以对应各个功能划分各个功能单元，也可以将两个或两个以上的功能集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。
与上述构思相同，如图7所示，本申请实施例还提供一种通信装置700用于实现上述方法中接入网设备或核心网设备或终端设备的功能。例如，该装置可以为软件模块或者芯片系统。本申请实施例中，芯片系统可以由芯片构成，也可以包含芯片和其他分立器件。该通信装置700可以包括：处理单元701和通信单元702。
本申请实施例中，通信单元也可以称为收发单元，可以包括发送单元和/或接收单元，分别用于执行上文方法实施例中接入网设备或核心网设备或终端设备执行的发送和接收的步骤。
以下，结合图7至图8详细说明本申请实施例提供的通信装置。应理解，装置实施例的描述与方法实施例的描述相互对应，因此，未详细描述的内容可以参见上文方法实施例，为了简洁，这里不再赘述。
通信单元也可以称为收发器、收发机、收发装置等。处理单元也可以称为处理器，处理单板，处理模块、处理装置等。可选的，可以将通信单元702中用于实现接收功能的器件视为接收单元，将通信单元702中用于实现发送功能的器件视为发送单元，即通信单元702包括接收单元和发送单元。通信单元有时也可以称为收发机、收发器、或收发电路等。接收单元有时也可以称为接收机、接收器、或接收电路等。发送单元有时也可以称为发射机、发射器或者发射电路等。
一种实现方式中，通信装置700可以执行以下功能：
处理单元，用于生成第一消息，第一消息采用第一密码加密，第一消息为站点接入接入点的关联入网流程中的消息；
通信单元，用于向接入点发送第一消息。
一种可能的实现方式中，第一密码根据接入点的接入密码和动态因子确定；
或者，第一密码为接入点的接入密码。
一种可能的实现方式中，处理单元具体用于：
将接入点的接入密码和动态因子作为动态密码生成算法的输入参数时，动态密码生成算法输出的密码作为第一密码。
一种可能的实现方式中，动态因子为时间信息或随机序列。
一种可能的实现方式中，第一消息为以下一项或多项消息：
认证阶段的认证请求消息；
关联阶段的关联请求消息；
基于局域网的扩展认证协议EAPOL四步握手阶段中的消息2；
EAPOL四步握手阶段中的消息4。
一种可能的实现方式中，第一消息包括供应商信息元素字段。
一种可能的实现方式中，通信单元还用于：
接收来自接入点第二消息，第二消息采用第一密码加密，第二消息为站点接入接入点的关联入网流程中的消息。
一种可能的实现方式中，第二消息为以下一项或多项消息：
认证阶段的认证响应消息；
关联阶段的关联响应消息；
EAPOL四步握手阶段中的消息1；
EAPOL四步握手阶段中的消息3。
一种可能的实现方式中，第二消息包括供应商信息元素字段。
一种实现方式中，通信装置700可以执行以下功能：
通信单元，用于接收来自站点的第一消息，第一消息为站点接入接入点的关联入网流程中的消息；
处理单元，用于采用第一密码对第一消息进行解密。
一种可能的实现方式中，第一密码根据接入点的接入密码和动态因子确定；
或者，第一密码为接入点的接入密码。
一种可能的实现方式中，处理单元具体用于：
将接入点的接入密码和动态因子作为动态密码生成算法的输入参数时，动态密码生成算法输出的密码作为第一密码。
一种可能的实现方式中，动态因子为时间信息或随机序列。
一种可能的实现方式中，第一消息为以下一项或多项消息：
认证阶段的认证请求消息；
关联阶段的关联请求消息；
基于局域网的扩展认证协议EAPOL四步握手阶段中的消息2；
EAPOL四步握手阶段中的消息4。
一种可能的实现方式中，第一消息包括供应商信息元素字段。
一种可能的实现方式中，该通信单元还用于：
向站点发送第二消息，第二消息采用第一密码加密，第二消息为站点接入接入点的关联入网流程中的消息。
一种可能的实现方式中，第二消息为以下一项或多项消息：
认证阶段的认证响应消息；
关联阶段的关联响应消息；
EAPOL四步握手阶段中的消息1；
EAPOL四步握手阶段中的消息3。
一种可能的实现方式中，第二消息包括供应商信息元素字段。
以上只是示例，处理单元701和通信单元702还可以执行其他功能，更详细的描述可以参考前面所示的方法实施例中相关描述，这里不加赘述。
如图8所示为本申请实施例提供的通信装置800，图8所示的装置可以为图7所示的装置的一种硬件电路的实现方式。该通信装置可适用于前面所示出的流程图中，执行上述方法实施例中接入网设备或核心网设备或终端设备的功能。为了便于说明，图8仅示出了该通信装置的主要部件。
如图8所示，通信装置800包括处理器810和接口电路820。处理器810和接口电路820之间相互耦合。可以理解的是，接口电路820可以为收发器或输入输出接口。可选的，通信装置800还可以包括存储器830，用于存储处理器810执行的指令或存储处理器810运行指令所需要的输入数据或存储处理器810运行指令后产生的数据。
当通信装置800用于实现前面所示的方法时，处理器810用于实现上述处理单元701的功能，接口电路820用于实现上述通信单元702的功能。
当上述通信装置为应用于接入网设备的芯片时，该接入网设备的芯片实现上述方法实施例中接入网设备的功能。该接入网设备芯片从终端设备中的其它模块(如射频模块或天线)接收信息；或者，该接入网设备的芯片向接入网设备中的其它模块(如射频模块或天线)发送信息。
当上述通信装置为应用于核心网设备的芯片时，该核心网设备的芯片实现上述方法实施例中核心网设备的功能。该核心网设备的芯片从核心网设备中的其它模块(如射频模块或天线)接收信息；或者，该核心网设备的芯片向核心网设备中的其它模块(如射频模块或天线)发送信息。
可以理解的是，本申请的实施例中的处理器可以是中央处理单元(Central Processing Unit，CPU)，还可以是其它通用处理器、数字信号处理器(Digital Signal Processor，DSP)、专用集成电路(Application Specific Integrated Circuit，ASIC)、现场可编程门阵列(Field Programmable Gate Array，FPGA)或者其它可编程逻辑器件、晶体管逻辑器件，硬件部件或者其任意组合。通用处理器可以是微处理器，也可以是任何常规的处理器。
本申请的实施例中处理器可以是随机存取存储器(Random Access Memory，RAM)、闪存、只读存储器(Read-Only Memory，ROM)、可编程只读存储器(Programmable ROM，PROM)、可擦除可编程只读存储器(Erasable PROM，EPROM)、电可擦除可编程只读存储器(Electrically EPROM，EEPROM)、寄存器、硬盘、移动硬盘、CD-ROM或者本领域熟知的任何其它形式的存储介质中。一种示例性的存储介质耦合至处理器，从而使处理器能够从该存储介质读取信息，且可向该存储介质写入信息。当然，存储介质也可以是处理器的组成部分。处理器和存储介质可以位于ASIC中。另外，该ASIC可以位于网络设备或终端设备中。处理器和存储介质也可以作为分立组件存在于网络设备或终端设备中。
本领域内的技术人员应明白，本申请的实施例可提供为方法、系统、或计算机程序产品。因此，本申请可采用完全硬件实施例、完全软件实施例、或结合软件和硬件方面的实施例的形式。而且，本申请可采用在一个或多个其中包含有计算机可用程序代码的计算机可用存储介质(包括但不限于磁盘存储器、光学存储器等)上实施的计算机程序产品的形式。
本申请是参照根据本申请的方法、设备(系统)、和计算机程序产品的流程图和/或方框图来描述的。应理解可由计算机程序指令实现流程图和/或方框图中的每一流程和/或方框、以及流程图和/或方框图中的流程和/或方框的结合。可提供这些计算机程序指令到通用计算机、专用计算机、嵌入式处理机或其他可编程数据处理设备的处理器以产生一个机器，使得通过计算机或其他可编程数据处理设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的装置。
这些计算机程序指令也可存储在能引导计算机或其他可编程数据处理设备以特定方式工作的计算机可读存储器中，使得存储在该计算机可读存储器中的指令产生包括指令装置的制造品，该指令装置实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能。
显然，本领域的技术人员可以对本申请进行各种改动和变型而不脱离本申请的范围。这样，倘若本申请的这些修改和变型属于本申请权利要求及其等同技术的范围之内，则本申请也意图包含这些改动和变型在内。

Claims (21)

  1. 一种网络连接方法，其特征在于，包括：
    站点生成第一消息，所述第一消息采用第一密码加密，所述第一消息为所述站点接入接入点的关联入网流程中的消息；
    所述站点向所述接入点发送所述第一消息。
  2. 根据权利要求1所述的方法，其特征在于，所述第一密码根据所述接入点的接入密码和动态因子确定；
    或者，所述第一密码为所述接入点的接入密码。
  3. 根据权利要求2所述的方法，其特征在于，所述动态因子为时间信息或随机序列。
  4. 根据权利要求1至3任一所述的方法，其特征在于，所述第一消息为以下一项或多项消息：
    认证阶段的认证请求消息；
    关联阶段的关联请求消息；
    基于局域网的扩展认证协议EAPOL四步握手阶段中的消息2；
    所述EAPOL四步握手阶段中的消息4。
  5. 根据权利要求1至4任一所述的方法，其特征在于，所述第一消息包括供应商信息元素字段。
  6. 根据权利要求1至5任一所述的方法，其特征在于，所述方法还包括：
    所述站点接收来自所述接入点第二消息，所述第二消息采用所述第一密码加密，所述第二消息为所述站点接入所述接入点的关联入网流程中的消息。
  7. 根据权利要求6所述的方法，其特征在于，所述第二消息为以下一项或多项消息：
    认证阶段的认证响应消息；
    关联阶段的关联响应消息；
    EAPOL四步握手阶段中的消息1；
    所述EAPOL四步握手阶段中的消息3。
  8. 根据权利要求6或7所述的方法，其特征在于，所述第二消息包括供应商信息元素字段。
  9. 一种网络连接方法，其特征在于，包括：
    接入点接收来自所述站点的第一消息，所述第一消息为所述站点接入接入点的关联入网流程中的消息；
    所述接入点采用所述第一密码对所述第一消息进行解密。
  10. 根据权利要求9所述的方法，其特征在于，所述第一密码根据所述接入点的接入密码和动态因子确定；
    或者，所述第一密码为所述接入点的接入密码。
  11. 根据权利要求10所述的方法，其特征在于，所述动态因子为时间信息或随机序列。
  12. 根据权利要求9至11任一所述的方法，其特征在于，所述第一消息为以下一项或多项消息：
    认证阶段的认证请求消息；
    关联阶段的关联请求消息；
    基于局域网的扩展认证协议EAPOL四步握手阶段中的消息2；
    所述EAPOL四步握手阶段中的消息4。
  13. 根据权利要求9至12任一所述的方法，其特征在于，所述第一消息包括供应商信息元素字段。
  14. 根据权利要求9至13任一所述的方法，其特征在于，所述方法还包括：
    所述接入点向所述站点发送第二消息，所述第二消息采用所述第一密码加密，所述第二消息为所述站点接入接入点的关联入网流程中的消息。
  15. 根据权利要求14所述的方法，其特征在于，所述第二消息为以下一项或多项消息：
    认证阶段的认证响应消息；
    关联阶段的关联响应消息；
    EAPOL四步握手阶段中的消息1；
    所述EAPOL四步握手阶段中的消息3。
  16. 根据权利要求14或15所述的方法，其特征在于，所述第二消息包括供应商信息元素字段。
  17. 一种通信装置，其特征在于，包括：
    处理单元，用于生成第一消息，所述第一消息采用第一密码加密，所述第一消息为所述站点接入接入点的关联入网流程中的消息；
    通信单元，用于向所述接入点发送所述第一消息。
  18. 一种通信装置，其特征在于，包括：
    通信单元，用于接收来自所述站点的第一消息，所述第一消息为所述站点接入接入点的关联入网流程中的消息；
    处理单元，用于采用所述第一密码对所述第一消息进行解密。
  19. 一种通信装置，其特征在于，包括处理器，所述处理器和存储器耦合，所述存储器中存储有计算机程序；所述处理器用于调用所述存储器中的计算机程序，使得所述通信装置执行如权利要求1至8中任一项所述的方法或者如权利要求9至16中任一项所述的方法。
  20. 一种计算机可读存储介质，其特征在于，所述存储介质中存储有计算机程序或指令，当所述计算机程序或指令被计算机执行时，实现如权利要求1至8中任一项所述的方法或者如权利要求9至16中任一项所述的方法。
  21. 一种计算机程序产品，其特征在于，当计算机读取并执行所述计算机程序产品时，使得计算机执行如权利要求1至8中任一项所述的方法或者如权利要求9至16中任一项所述的方法。
PCT/CN2023/125609 2022-10-28 2023-10-20 一种网络连接方法及装置 WO2024088165A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202211331696.7 2022-10-28
CN202211331696.7A CN117956449A (zh) 2022-10-28 2022-10-28 一种网络连接方法及装置

Publications (1)

Publication Number Publication Date
WO2024088165A1 true WO2024088165A1 (zh) 2024-05-02

Family

ID=90800589

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2023/125609 WO2024088165A1 (zh) 2022-10-28 2023-10-20 一种网络连接方法及装置

Country Status (2)

Country Link
CN (1) CN117956449A (zh)
WO (1) WO2024088165A1 (zh)

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101568107A (zh) * 2008-04-22 2009-10-28 日电（中国）有限公司 票据分发装置、快速认证装置、接入点及其方法
US20160127901A1 (en) * 2014-11-05 2016-05-05 Qualcomm Incorporated Authenticating messages in a wireless communication
CN114521010A (zh) * 2020-11-20 2022-05-20 苹果公司 Mld私密性和操作增强
WO2022157239A1 (en) * 2021-01-20 2022-07-28 Huawei Technologies Co., Ltd. Device and method for multi-link transmissions

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101568107A (zh) * 2008-04-22 2009-10-28 日电（中国）有限公司 票据分发装置、快速认证装置、接入点及其方法
US20160127901A1 (en) * 2014-11-05 2016-05-05 Qualcomm Incorporated Authenticating messages in a wireless communication
CN114521010A (zh) * 2020-11-20 2022-05-20 苹果公司 Mld私密性和操作增强
WO2022157239A1 (en) * 2021-01-20 2022-07-28 Huawei Technologies Co., Ltd. Device and method for multi-link transmissions

Also Published As

Publication number Publication date
CN117956449A (zh) 2024-04-30

Similar Documents

Publication Publication Date Title
CN108293185B (zh) 无线设备认证方法和装置
US11140725B2 (en) Wireless communications involving a fast initial link setup, FILS, discovery frame for network signaling
US8731194B2 (en) Method of establishing security association in inter-rat handover
US8447978B2 (en) Wireless communication method using WPS
US8036183B2 (en) Method and system for transporting configuration protocol messages across a distribution system (DS) in a wireless local area network (WLAN)
CN110891271B (zh) 一种鉴权方法及装置
US10798082B2 (en) Network authentication triggering method and related device
CN110830993B (zh) 一种数据处理的方法、装置和计算机可读存储介质
US20180184428A1 (en) Associating and securitizing distributed multi-band link aggregation devices
JP2017538345A (ja) 方法、装置およびシステム
WO2016209382A1 (en) Reducing re-association time for sta connected to ap
CN108353269A (zh) Wlan中的订户简档预配置
US20190149326A1 (en) Key obtaining method and apparatus
WO2022237561A1 (zh) 一种通信方法及装置
WO2024088165A1 (zh) 一种网络连接方法及装置
WO2023016160A1 (zh) 一种会话建立方法和相关装置
US20210368343A1 (en) Multi-band communication method and apparatus
CN111465007B (zh) 一种认证方法、装置和系统
WO2023159603A1 (zh) 一种安全实现方法及装置、终端设备、网元
WO2022213425A1 (zh) 无线通信方法及设备
WO2023246457A1 (zh) 安全决策协商方法及网元
WO2024093708A1 (zh) 一种网络连接方法及装置
WO2023143022A1 (zh) 用于随机接入过程中数据处理的方法和装置
WO2009051405A2 (en) Method of establishing security association in inter-rat handover
CN116546490A (zh) 密钥生成方法及装置