CN1697386B - A Billing Method Based on Wireless Local Area Network Authentication and Security Infrastructure System - Google Patents

Abstract

The present invention provides a billing method based on the wireless local area network authentication and security infrastructure system. The key is that the ASU that issues and stores the STA certificate is used as the billing subject to count the user's online time, and calculate the STA certificate according to the online time. for billing. Further improved the WAPI system. The invention ensures more accurate timing for end users in the WAPI system. Moreover, even if a certain STA certificate is maliciously intercepted and copied and sends an authentication request to ASU, ASU will not overcharge. In addition, when the AP itself fails, for example, when it crashes, the ASU can also end the current timing of the STA in time, thereby stopping charging.

Description

A Billing Method Based on Wireless Local Area Network Authentication and Security Infrastructure System

technical field

The invention relates to the technical field of wireless local area network authentication and security infrastructure (WAPI) system, in particular to a charging method based on the WAPI system.

Background technique

my country's broadband wireless IP standard working group formulated the national standard GB/T15629.11 for wireless local area network (WLAN), and launched a security solution based on the WAPI system, which provides a secure access method for wireless local area network mobile terminals based on public key certificates .

In the WAPI system, there are three entities: wireless access user terminal (STA, Station), access point (AP, Access Point) and authentication service unit (ASU, Authentication Service Unit). , Authentication SupplicantEntity), the carrier of the authenticator entity (AE, Authentication Entity) and authentication service entity (ASE, Authentication Service Entity). Among them, ASUE is the entity that authenticates through the authentication service unit, and resides in the STA; AE is the entity that provides the authentication operation for the authentication requester before accessing the service, and resides in the AP; ASE provides mutual authentication for the authenticator and the authentication requester. The authenticated entity, resides at the ASU.

ASU manages the APs and STAs within its management range and issues a public key certificate to each legal AP and STA as the digital identity certificate of the network device in the WLAN. The public key certificate includes information such as certificate serial number and user name, where the issuer ASU and serial number uniquely identify each certificate. At the same time, the STA certificate and AP certificate are also saved in the ASU. Mutual identity authentication is implemented between STA and AP through ASU.

Figure 1 shows the schematic diagram of access control based on the WAPI system. The STA sends a connection request to the AP through the uncontrolled port through the WLAN. The AP further encapsulates the request and sends it to the ASU. The ASU assists the AP and the STA in mutual identity authentication, that is, certificate authentication. If the authentication is successful, the AP opens the controlled port to allow the STA Access, and the STA and AP perform key negotiation, use the negotiated session key to encrypt and decrypt data, and perform data communication; if the authentication fails, the AP refuses the STA to access or the STA gives up access to the AP.

The WAPI system proposes a unique authentication method and encryption method, which makes up for the security flaws of the existing international standards and improves the security and reliability of users. But at the same time, WAPI does not give a clear method in terms of billing, nor does it indicate the method it can support. In the actual application of WLAN, it is necessary to perform reasonable billing. In order to better implement WAPI, how to count Fees should be reflected.

Contents of the invention

In view of this, the purpose of the present invention is to provide a billing method based on the WAPI system and further improve the WAPI system.

In order to achieve the above object, technical solution of the present invention is achieved in that way:

A charging method based on wireless local area network authentication and security infrastructure system, the method includes the following steps:

a. The authentication service unit ASU receives the authentication request from the wireless access user terminal STA, and after the authentication of the STA is successful, according to the saved STA certificate of the STA, it sets a timing flag for the STA certificate to record the STA's STA certificate. online time;

b. The ASU periodically detects whether there is STA online information from the access point AP. If so, it further detects whether the STA certificate pointed to by the online information has a timing flag set. If yes, the ASU updates the online time information of the STA. , and then repeat step b. If the STA certificate pointed to by the online information does not have a timing flag set, the online information is considered invalid, the online information is ignored, and no processing is performed; if there is no STA online information from the AP, the STA online information is stopped. The STA online time counting operation counts the STA online time and implements billing for the STA certificate based on the time.

Preferably, in step b, when the ASU does not detect the online information of the STA from the AP within the specified time, the method further includes: the ASU reconfirms whether the STA is online, and if online, updates the online time information of the STA , and then repeatedly execute step b, otherwise, stop counting the online time of the STA, count the online time of the STA, and implement charging according to the time.

Preferably, the method further includes: when the STA goes offline, the AP sends the STA offline information to the ASU, and after the ASU receives the STA offline information from the AP, it stops the timing operation of the STA's online time, and counts the STA's online time. Online time and billing based on time.

Preferably, the method further comprises:

In step b, after the ASU stops counting the online time of the STA, it cancels the timing mark of the STA certificate stored locally, and then executes the subsequent steps.

Preferably, the method of the STA offline information sent by the AP to the ASU is: the AP directly sends the STA offline information to the ASU, or the AP signs the entire STA offline information with a private key, and signs the signed offline information. Information sent to ASU.

Preferably, the STA offline information includes at least: the user name and serial number in the STA certificate; or, the STA offline information includes the complete STA certificate and AP certificate, and the private key signature information of the entire message by the AP ; Or, the offline information includes the user name and serial number in the STA certificate, the user name and serial number in the AP certificate, and the private key signature information of the entire message by the AP.

Preferably, the online information of the STA includes at least: a user name and a serial number in the STA certificate.

Preferably, the method further includes: if a STA certificate is only allowed to be used by one STA, after the ASU successfully authenticates the STA, and after the ASU updates the online time of the STA, before the STA certificate user goes offline, the ASU Refuse to authenticate the authentication request of the same STA certificate, and send an authentication failure to the AP; if an STA certificate allows more than one STA to use it at the same time, ASU will count the online time of the STA and implement billing for the STA certificate based on this time, including:

The ASU accumulates the time of using the STA certificate for multiple communication ports using the STA certificate to realize the billing of the STA certificate.

Preferably, the method further includes: exchanging STA online information between ASUs of the same level, or the lower-level ASU sends the STA online information stored by itself to a higher-level ASU.

In the present invention, the ASU that issues and stores the STA certificate is used as the billing subject, counts the online time of the user, and charges the STA certificate according to the online time. Further improved the WAPI system.

The invention ensures more accurate timing for end users in the WAPI system. Even if a certain STA certificate is maliciously intercepted and copied and sends an authentication request to ASU, ASU will not overcharge. Because even if such a certificate passes the authentication, it cannot negotiate an effective session key with the AP without the user's private key, so the AP will not send STA online information to the ASU. In addition, when the AP itself fails, for example, when it crashes, because the AP cannot send online information to the ASU, the ASU cannot receive the online information of the STA within the time limit. In this way, the ASU can end the timing of the STA in time. , thereby stopping billing.

Under authorization, ASUs at the same level can exchange STA online information, or a lower-level ASU can send STA online information saved by itself to a higher-level ASU, so that the higher-level ASU can perform effective billing management. It is convenient for users to inquire. This point is very necessary for networked operation projects, such as some networked hotels.

Description of drawings

Figure 1 shows a schematic diagram of access control based on the WAPI system;

Fig. 2 is a schematic flow chart of implementing charging by the ASU of the present invention.

Detailed ways

In order to make the technical solution of the present invention clearer, the present invention will be further described in detail below in conjunction with the accompanying drawings.

The idea of the present invention is: the ASU which has issued and stored the STA certificate is used as the billing subject, counts the online time of the user, and charges the STA certificate according to the online time.

Fig. 2 is a schematic flow chart of implementing charging by the ASU of the present invention.

Step 201, the STA sends an authentication request message to the AP;

Step 202, the AP sends the authentication request message to the ASU;

In step 203, the ASU assists the AP and the STA to perform identity mutual authentication, that is, certificate authentication. After the authentication is successful, a timer flag is set for the STA certificate stored locally, and the online time information of the STA is started to be recorded according to the STA certificate. When the recording starts, usually is 0 minutes;

Step 204, the ASU sends the successful authentication result information to the AP;

Step 205, the AP sends the successful authentication result information to the STA;

Step 206, negotiating a session key between the STA and the AP, and using the negotiated session key to encrypt and decrypt data for data communication;

Step 207, when the AP starts effective communication with the STA, that is, the session key negotiation between the AP and the STA is completed, and after the STA starts data communication with the AP through the controlled port, the AP sends the online information of the STA certificate to the ASU regularly, and also It is the online information of the STA;

The above online information needs to include at least the user name and serial number of the STA certificate, and the sending frequency of this information should match the timing unit of ASU, such as sending once every minute, so that ASU can calculate the online time of the user more accurately;

Step 208: While the AP regularly sends STA online information to the ASU, the ASU also regularly detects whether there is STA online information sent by the AP. If detected, the ASU further checks whether the STA certificate pointed to by the online information has set a timing flag , if yes, then update the online time information of the STA certificate, if the ASU finds that the STA certificate pointed to by the detection does not set the timing flag, it will consider the information invalid, ignore the information, and do nothing; this can prevent the AP from Errors in operation, or the occurrence of attacks, etc., resulting in incorrect charges for users;

If the ASU does not detect the online information of the STA from the AP, in order to prevent occasional communication disturbances between the AP and the ASU, the ASU reconfirms whether the STA is online. If the STA is not online, then directly execute step 210; if the STA is still online, then update the online time information of the STA, and continue to regularly detect whether there is STA online information sent by the AP; the time of the timing detection also needs to match the timing time match;

Step 209, in order to better cooperate with the ASU billing, when the user goes offline, the AP can send the STA offline information to the ASU. Sign the offline information with the private key, and send the signed offline information to the ASU, and the ASU directly executes step 210 after receiving the information;

The above offline information includes at least the user name and serial number in the STA certificate. If the private key signature is required for the offline information, the offline information includes the complete STA certificate and AP certificate, as well as the private key of the AP for the entire message. Signature; or, the offline information includes the user name and serial number in the STA certificate, the user name and serial number in the AP certificate, and the private key signature of the AP to the entire message;

Step 210, stop the timing operation of the STA's online time, clear the timing flag of the STA certificate, the user's offline time is based on the time when the STA's online information is not detected for the first time, count the online time of the STA, and realize the tracking according to the time. STA certificate billing.

Since WLAN adopts a connectionless communication mode, it may happen that the user does not receive or cannot receive the authentication result information in time. Therefore, WAPI allows a user certificate to send authentication requests multiple times. If a certificate is only allowed to be used by one STA, after the ASU authenticates the certificate successfully, the timing flag of the STA certificate is set and the timing starts, and before the ASU receives the STA online information from the AP, the same STA certificate can still be issued. However, when the ASU has acquired the online information of the STA, that is, after updating the online time of the STA, the ASU refuses to authenticate the same STA before the certificate user goes offline. The authentication request of the certificate is authenticated, and the authentication failure is sent to the AP; if more than one STA is allowed to use the same certificate, when the same certificate is used by multiple ports at the same time, the ASU can calculate the time by accumulating the usage time of multiple ports. fee.

When more than one STA uses the same certificate, the implementation method of ASU charging by accumulating the usage time of multiple ports is described as follows:

When the system allows more than one STA to use the same certificate, the AP regularly sends the online information of the STA to the ASU, including not only the user name and serial number of the STA certificate, but also parameter information identifying the communication between the AP and the STA. The parameter information includes AP The user name and serial number of the certificate, the logical port identification of the communication controlled port, etc.;

After the ASU regularly detects the online information from the AP, it further judges whether the parameter information identifying the communication between the AP and the STA in the online information matches the locally saved parameter information identifying the communication between the AP and the STA, and if so, updates the matching If the STA's online time does not match, save the received parameter information identifying the communication between the AP and the STA, so as to distinguish different terminals using the same certificate, and start timing for the terminal.

When the AP sends offline information to the ASU, the offline information not only includes the user name and serial number of the STA certificate, but also includes parameter information identifying the communication between the AP and the STA; when the ASU receives the offline information from the AP, all The AP matches the communication parameter information of the STA, queries the corresponding port, and ends the billing of the corresponding communication port used by the STA certificate.

Finally, the ASU adds up the online time of all STAs using the same STA certificate to obtain the accumulated time for the STA certificate, and implements billing for the STA certificate based on this time.

Under authorization, ASUs at the same level can exchange STA online information, or a lower-level ASU can send STA online information saved by itself to a higher-level ASU, so that the higher-level ASU can perform effective billing management. It is convenient for users to inquire. This point is very necessary for networked operation projects, such as some networked hotels.

The invention ensures more accurate timing for end users in the WAPI system. Even if a certain STA certificate is maliciously intercepted and copied and sends an authentication request to ASU, ASU will not overcharge. Because even if such a certificate passes the authentication, it cannot negotiate an effective session key with the AP without the user's private key, so the AP will not send STA online information to the ASU.

In addition, when the AP itself fails, for example, when it crashes, because the AP cannot send online information to the ASU, the ASU cannot receive the online information of the STA within the time limit. In this way, the ASU can end the timing of the STA in time. , thereby stopping billing.

Furthermore, because the key negotiation time between STA and AP is very short relative to the timing unit, the general key negotiation process is a few seconds at most, and if the key negotiation between AP and STA fails, the online timing of ASU to STA is 0 Minutes, therefore, there will be no overtime, and therefore no overbilling.

WAPI's security system can be easily applied in public places such as hotels, Internet cafes, and libraries. ASU charges STAs that use resources reasonably according to their online time. For example, when a customer checks into a hotel, the hotel uses its own WAPI security equipment to provide wireless Internet access services to the user, that is, to generate a public key certificate and issue it to the user. , settle the relevant fees.

The above descriptions are only preferred embodiments of the present invention, and are not intended to limit the present invention. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present invention shall be included in the scope of the present invention. within the scope of protection.

Claims (9)

1. A charging method based on wireless local area network identification and security infrastructure system, characterized in that, the method may further comprise the steps: a. The authentication service unit ASU receives the authentication request from the wireless access user terminal STA, and after the authentication of the STA is successful, according to the saved STA certificate of the STA, it sets a timing flag for the STA certificate to record the STA's STA certificate. online time; b. The ASU periodically detects whether there is STA online information from the access point AP. If so, it further detects whether the STA certificate pointed to by the online information has a timing flag set. If yes, the ASU updates the online time information of the STA. , and then repeat step b. If the STA certificate pointed to by the online information does not have a timing flag set, the online information is considered invalid, the online information is ignored, and no processing is performed; if there is no STA online information from the AP, the STA online information is stopped. The STA online time counting operation counts the STA online time and implements billing for the STA certificate based on the time. 2. The method according to claim 1, wherein in step b, when the ASU does not detect the online information of the STA from the AP within the specified time, the method further comprises: the ASU reconfirms whether the STA is online, if online, then update the online time information of the STA, and then repeat step b, otherwise, stop the counting operation of the STA online time, count the online time of the STA and implement charging according to the time. 3. The method according to claim 1, further comprising: when the STA goes offline, the AP sends the STA offline information to the ASU, and the ASU stops the STA after receiving the STA offline information from the AP The counting operation of the online time counts the online time of the STA and implements billing according to the time. 4. The method according to claim 1, 2 or 3, characterized in that the method further comprises: In step b, after the ASU stops counting the online time of the STA, it cancels the timing mark of the STA certificate stored locally, and then executes the subsequent steps. 5. The method according to claim 3, wherein the method of the STA offline information sent by the AP to the ASU is: the AP directly sends the STA offline information to the ASU, or the AP sends the entire STA offline information Sign with the private key and send the signed offline information to ASU. 6. The method according to claim 3, wherein the STA offline information includes at least: the user name and serial number in the STA certificate; or, the STA offline information includes a complete STA certificate and AP certificate , and the AP’s private key signature information for the entire message; or, the offline information includes the user name and serial number in the STA certificate, the user name and serial number in the AP certificate, and the AP’s private key signature information for the entire message . 7. The method according to claim 1, wherein the online information of the STA includes at least: a user name and a serial number in the STA certificate. 8. The method of claim 1, further comprising: If a STA certificate can only be used by one STA, after the ASU authenticates the STA successfully and the ASU updates the STA’s online time, before the STA certificate user goes offline, the ASU rejects the authentication request for the same STA certificate. Authentication processing, and send authentication failure to AP; If a STA certificate allows more than one STA to use it at the same time, the ASU counts the online time of the STA and implements billing for the STA certificate based on the time, including: The ASU accumulates the time of using the STA certificate for multiple communication ports using the STA certificate to realize the billing of the STA certificate. 9. The method according to claim 1, further comprising: exchanging STA online information between ASUs of the same level, or sending the STA online information saved by itself to a higher-level ASU .

Images