[go: up one dir, main page]

WO2017008556A1 - Procédé et dispositif d'authentification de point d'accès sans fil et plate-forme de gestion - Google Patents

Procédé et dispositif d'authentification de point d'accès sans fil et plate-forme de gestion Download PDF

Info

Publication number
WO2017008556A1
WO2017008556A1 PCT/CN2016/080767 CN2016080767W WO2017008556A1 WO 2017008556 A1 WO2017008556 A1 WO 2017008556A1 CN 2016080767 W CN2016080767 W CN 2016080767W WO 2017008556 A1 WO2017008556 A1 WO 2017008556A1
Authority
WO
WIPO (PCT)
Prior art keywords
access point
wireless access
key
key information
information
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2016/080767
Other languages
English (en)
Chinese (zh)
Inventor
王意军
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
ZTE Corp
Original Assignee
ZTE Corp
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by ZTE Corp filed Critical ZTE Corp
Publication of WO2017008556A1 publication Critical patent/WO2017008556A1/fr
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H04W12/069—Authentication using certificates or pre-shared keys

Definitions

  • This application relates to, but is not limited to, the field of wireless networks.
  • the scale of wireless networks the management methods of wireless access points are more and more, especially the evolution of current wireless networks.
  • Many wireless access points access the management platform through the Internet. Based on the security problems of access devices, they have to Consider the authentication management between the wireless access point and the management platform.
  • the wireless access point In the wireless network management, in order to ensure the security of the device, when registering to the management platform, the wireless access point needs to determine the connection wireless access according to the MAC (Media Access Control) address of the device or the serial number of the device.
  • the legality of the point is generally configured by pre-configuring the MAC address or serial number of the device on the network management platform.
  • the present invention provides a method and device for authenticating a wireless access point and a management platform, which solves the problem of legality verification of an access point device and a network management platform, and provides a more secure and reliable access for devices in the network.
  • the embodiment of the invention provides a method for authenticating a wireless access point and a management platform, which is applied to the management platform side, and includes:
  • the wireless access point Receiving, by the wireless access point, the first authentication information, where the first authentication information includes an identifier of the wireless access point, a first random challenge word, and first key information, where the first key information is For the office Obtaining, by the wireless access point, the identifier of the wireless access point and the first random challenge word by using a key stored by the wireless access point;
  • the method further includes:
  • the method further includes:
  • the wireless access point sends second authentication information to the wireless access point, so that the wireless access point verifies the second authentication information by using a key stored by the wireless access point, the second The right information includes an identification number of the wireless access point, a second random challenge word, and third key information.
  • the identifier of the wireless access point includes one or more of the following:
  • the media is involved in the control layer MAC address, serial number, unique identifier.
  • verifying the first authentication information by using a key corresponding to the wireless access point includes:
  • encrypting the identification number of the wireless access point and the second random challenge word by using a key corresponding to the wireless access point includes:
  • determining that the first key information corresponds to the second key information includes:
  • the first decrypted hash value is the same as the second hash value, it is determined that the first key information corresponds to the second key information.
  • the embodiment of the invention further provides a method for authenticating a wireless access point and a management platform, which is applied to a wireless access point side, and includes:
  • the management platform Transmitting the first authentication information to the management platform, so that the management platform checks the first authentication information by using a key corresponding to the wireless access point, where the first authentication information includes the The identification number of the wireless access point, the first random challenge word, and the first key information.
  • the method further includes:
  • the management platform obtains the identifier of the wireless access point and the second random challenge word by using a key corresponding to the wireless access point;
  • the method further includes:
  • the identifier of the wireless access point includes one or more of the following:
  • the media is involved in the control layer MAC address, serial number, unique identifier.
  • encrypting the identifier of the wireless access point and the first random challenge word by using a key stored by the wireless access point includes:
  • the private key signs the first hash value.
  • verifying the second authentication information by using a key stored by the wireless access point includes:
  • the management platform When the third key information is used by the management platform to hash the identification number of the wireless access point and the second random challenge word by using a shared key corresponding to the wireless access point, And obtaining the third hash value by using a private key stored by the management platform, and decrypting the third key information by using a public key corresponding to the management platform, Obtaining a second decrypted hash value; and hashing the identification number of the wireless access point and the second random challenge word by using a shared key stored by the wireless access point to obtain a fourth hash value.
  • determining that the third key information corresponds to the fourth key information includes:
  • the embodiment of the invention further provides a method for authenticating a wireless access point and a management platform, including:
  • the wireless access point generates a first random challenge word
  • the wireless access point encrypts the identification number of the wireless access point and the first random challenge word by using a key stored by the wireless access point to obtain first key information
  • the wireless access point sends the first authentication information to the management platform, where the first authentication information includes an identifier of the wireless access point, a first random challenge word, and first key information;
  • the management platform performs verification on the first authentication information by using a key corresponding to the wireless access point to obtain second key information
  • the management platform determines that the first key information corresponds to the second key information, it is determined that the wireless access point is legal.
  • the method further includes:
  • the management platform determines that the first key information does not correspond to the second key information, it is determined that the wireless access point is illegal.
  • the method further includes:
  • the management platform generates a second random challenge word
  • the management platform encrypts the identification number of the wireless access point and the second random challenge word by using a key corresponding to the wireless access point to obtain third key information;
  • the management platform sends the second authentication information to the wireless access point;
  • the second authentication information includes an identifier of the wireless access point, a second random challenge word, and third key information;
  • the wireless access point performs verification on the second authentication information by using a key stored by the wireless access point to obtain fourth key information
  • the wireless access point determines that the third key information corresponds to the fourth key information, it is determined that the management platform is legal.
  • the wireless access point determines that the third key information does not correspond to the fourth key information, it is determined that the management platform is illegal.
  • the encrypting, by the wireless access point, the identifier of the wireless access point and the first random challenge word by using a key stored by the wireless access point including:
  • the private key signs the first hash value.
  • the verifying, by the management platform, the first authentication information by using a key corresponding to the wireless access point includes:
  • Decrypting the first key information by using a public key corresponding to the wireless access point to obtain a first decrypted hash value; and using the shared key corresponding to the wireless access point to connect the wireless connection
  • the identification number of the in point and the first random challenge word are hashed to obtain a second hash value.
  • determining that the first key information corresponds to the second key information includes:
  • the first decrypted hash value is the same as the second hash value, it is determined that the first key information corresponds to the second key information.
  • the managing platform encrypts the identification number of the wireless access point and the second random challenge word by using a key corresponding to the wireless access point, including:
  • the verifying, by the wireless access point, the second authentication information by using a key stored by the wireless access point includes:
  • the identification number and the second random challenge word are hashed to obtain a fourth hash value.
  • determining that the third key information corresponds to the fourth key information includes:
  • the embodiment of the invention further provides a wireless access point and a management platform authentication device, which are disposed on the management platform side, and includes:
  • the first receiving module is configured to: receive first authentication information sent by the wireless access point, where the first authentication information includes an identifier of the wireless access point, a first random challenge word, and first key information.
  • the first key information is obtained by the wireless access point encrypting the identification number of the wireless access point and the first random challenge word by using a key stored by the wireless access point;
  • the first authentication module is configured to: perform verification on the first authentication information by using a key corresponding to the wireless access point, to obtain second key information;
  • the first determining module is configured to: when it is determined that the first key information corresponds to the second key information, determine that the wireless access point is legal.
  • the first determining module is further configured to: when it is determined that the first key information does not correspond to the second key information, determine that the wireless access point is illegal.
  • the device further includes:
  • a first generating module configured to: generate a second random challenge word
  • the first encryption module is configured to: encrypt the identification number of the wireless access point and the second random challenge word by using a key corresponding to the wireless access point, to obtain third key information;
  • the first sending module is configured to: send second authentication information to the wireless access point, so that the wireless access point performs the second authentication information by using a key stored by the wireless access point. Verifying that the second authentication information includes an identification number of the wireless access point, a second random challenge word, and third key information.
  • the first authentication module comprises a first dissolving unit and/or a first decrypting unit, wherein:
  • the first dissolving unit is configured to: when the first key information is an identifier number of the wireless access point shared by the wireless access point by using the shared key stored by the wireless access point, Obtaining, by using a shared key corresponding to the wireless access point, hashing the identification number of the wireless access point and the first random challenge word, and obtaining the first random challenge word. Second decryption information;
  • the first decryption unit is configured to: when the first key information is an identifier number of the wireless access point shared by the wireless access point by using the shared key stored by the wireless access point, The first random challenge word is hashed to obtain a first hash value, and the first hash value is obtained by using a private key stored by the wireless access point, and the wireless access point is utilized Decrypting the first key information by the corresponding public key to obtain a first decrypted hash value; and using the shared key corresponding to the wireless access point to identify the identification number of the wireless access point and the The first random challenge word performs a hash operation to obtain a second hash value.
  • the first encryption module comprises a first hash unit and/or a first signature unit, wherein:
  • the first hashing unit is configured to: hash the identification number of the wireless access point and the second random challenge word by using a shared key corresponding to the wireless access point; or
  • the first signature unit is configured to: perform a hash operation on the identifier of the wireless access point and the second random challenge word by using a shared key corresponding to the wireless access point to obtain a third hash And signing the third hash value with a value and using a private key stored by the management platform.
  • the first determining module includes a first direct corresponding unit and/or a first indirect corresponding unit, where:
  • the first direct correspondence unit is configured to: when the first key information and the second decryption information are the same, determine that the first key information corresponds to the second key information; or
  • the first indirect corresponding unit is configured to: when the first decrypted hash value and the second hash value are the same, determine that the first key information corresponds to the second key information.
  • the embodiment of the present invention further provides a wireless access point and a management platform authentication device, which are disposed on the wireless access point side, and includes:
  • a second generation module configured to: generate a first random challenge word
  • the second encryption module is configured to: encrypt the identification number of the wireless access point and the first random challenge word by using a key stored by the wireless access point, to obtain first key information;
  • the second sending module is configured to: send the first authentication information to the management platform, so that the management platform performs verification on the first authentication information by using a key corresponding to the wireless access point, where
  • the first authentication information includes an identification number of the wireless access point, a first random challenge word, and first key information.
  • the device further includes:
  • the second receiving module is configured to: receive second authentication information sent by the management platform, where the second authentication information includes an identifier number, a second random challenge word, and a third key information of the wireless access point, where The third key information is obtained by the management platform encrypting the identification number of the wireless access point and the second random challenge word by using a key corresponding to the wireless access point;
  • the second authentication module is configured to: perform verification on the second authentication information by using a key stored by the wireless access point, to obtain fourth key information;
  • the second determining module is configured to: when it is determined that the third key information corresponds to the fourth key information, determine that the management platform is legal.
  • the second determining module is further configured to:
  • the second encryption module comprises a second hash unit and/or a second signature unit, wherein:
  • the second hashing unit is configured to: hash the identification number of the wireless access point and the first random challenge word by using a shared key stored by the wireless access point; or
  • the second signature unit is configured to perform a hash operation on the identifier of the wireless access point and the first random challenge word by using a shared key stored by the wireless access point to obtain a first hash value. And signing the first hash value with a private key stored by the wireless access point.
  • the second authentication module comprises a second dissolving unit and/or a second decrypting unit, wherein:
  • the second dissolving unit is configured to: when the third key information is the management platform, use the shared key corresponding to the wireless access point to identify the identification number of the wireless access point and the Obtaining, by using the shared key stored by the wireless access point, hashing the identification number of the wireless access point and the second random challenge word to obtain a fourth Decrypt information;
  • the second decryption unit is configured to: when the third key information is the management platform, use the shared key corresponding to the wireless access point to identify the identification number of the wireless access point and the The second random challenge word is hashed to obtain a third hash value, and the third hash value is obtained by using the private key stored by the management platform, and the public key pair corresponding to the management platform is utilized. Decrypting the third key information to obtain a second decrypted hash value; and performing, by using a shared key stored by the wireless access point, the identification number of the wireless access point and the second random challenge word The hash operation obtains a fourth hash value.
  • the second determining module includes a second direct corresponding unit and/or a second indirect corresponding unit, where:
  • the second direct correspondence unit is configured to: when the third key information is the same as the fourth decryption information, determine that the third key information corresponds to the fourth key information; or
  • the second indirect corresponding unit is configured to: when the second decrypted hash value is the same as the fourth hash value, determine that the third key information corresponds to the fourth key information.
  • the authentication method and device provided by the embodiments of the present invention can verify the mutuality of the legality of the access point device and the network management platform, ensure the legality of the wireless access point, and provide more secure and reliable access for the devices in the network. .
  • FIG. 1 is a flowchart of a method for authenticating a wireless access point and a management platform applied to a management platform side according to an embodiment of the present invention
  • FIG. 2 is a flowchart of a method for authenticating a wireless access point and a management platform applied to a wireless access point side according to an embodiment of the present invention
  • FIG. 3 is a flowchart of a method for authenticating a wireless access point and a management platform according to an embodiment of the present invention
  • FIG. 4 is a schematic structural diagram of a wireless access point and a management platform authentication device disposed on a management platform side according to an embodiment of the present invention
  • FIG. 5 is a schematic structural diagram of a wireless access point and a management platform device disposed on a wireless access point side according to an embodiment of the present invention
  • FIG. 6 is a schematic diagram 1 of wireless access point encryption according to an embodiment of the present invention.
  • FIG. 7 is a schematic diagram 2 of wireless access point encryption according to an embodiment of the present invention.
  • FIG. 8 is a schematic diagram 1 of a management platform authentication according to an embodiment of the present invention.
  • FIG. 9 is a schematic diagram 2 of a management platform authentication according to an embodiment of the present invention.
  • FIG. 10 is a schematic diagram 1 of a management platform encryption according to an embodiment of the present invention.
  • FIG. 11 is a schematic diagram 2 of a management platform encryption according to an embodiment of the present invention.
  • Figure 12 is a schematic diagram 1 of wireless access point authentication according to an embodiment of the present invention.
  • FIG. 13 is a schematic diagram 2 of wireless access point authentication according to an embodiment of the present invention.
  • FIG. 15 is a flowchart of authentication of a wireless access point and a management platform according to Embodiment 2 of the present invention.
  • an embodiment of the present invention provides a method for authenticating a wireless access point and a management platform, which is applied to a management platform side.
  • the management platform authenticates a wireless access point
  • the method includes:
  • S101 Receive first authentication information that is sent by the wireless access point, where the first authentication information includes an identifier of the wireless access point, a first random challenge word, and first key information, where the first secret is
  • the key information is obtained by the wireless access point encrypting the identification number of the wireless access point and the first random challenge word by using a key stored by the wireless access point;
  • S102 Perform verification on the first authentication information by using a key corresponding to the wireless access point, to obtain second key information.
  • the method when requesting the wireless access point to authenticate the management platform, the method includes:
  • the second authentication information includes an identification number of the wireless access point, a second random challenge word, and third key information.
  • the identifier of the wireless access point includes one or more of the following:
  • the media is involved in the control layer MAC address, serial number, unique identifier.
  • Step S102 includes:
  • the wireless access point Obtaining, by the wireless access point, the identifier of the wireless access point and the first random challenge word by using a shared key stored by the wireless access point by the wireless access point And obtaining, by using a private key stored by the wireless access point, the first hash value by using a private key stored by the wireless access point (as shown in FIG. 7 ), using a public corresponding to the wireless access point Decrypting the first key information to obtain a first decrypted hash value; and using an shared key corresponding to the wireless access point to identify an identifier of the wireless access point and the first random number
  • the challenge word performs a hash operation to obtain a second hash value (as shown in Figure 9).
  • the management platform may determine, according to the protocol agreement, that the wireless access point obtains the encryption method of the first key information, and does not necessarily have to pass the judgment.
  • Step S106 includes:
  • Step S103 includes:
  • the first decrypted hash value is the same as the second hash value, it is determined that the first key information corresponds to the second key information.
  • an embodiment of the present invention provides a method for authenticating a wireless access point and a management platform, which is applied to a wireless access point side, and when the request management platform authenticates the wireless access point, the method includes:
  • the first authentication information is sent to the management platform, so that the management platform checks the first authentication information by using a key corresponding to the wireless access point, where the first authentication information includes The identification number of the wireless access point, the first random challenge word, and the first key information.
  • the method further includes:
  • S204 Receive second authentication information that is sent by the management platform, where the second authentication information includes an identifier of the wireless access point, a second random challenge word, and third key information, where the third key information is Obtaining, by the management platform, the identifier of the wireless access point and the second random challenge word by using a key corresponding to the wireless access point;
  • the identifier of the wireless access point includes one or more of the following:
  • the media is involved in the control layer MAC address, serial number, unique identifier.
  • Step S202 includes:
  • Step S205 includes:
  • the management platform When the third key information is used by the management platform to hash the identification number of the wireless access point and the second random challenge word by using a shared key corresponding to the wireless access point, And obtaining the third hash value by using a private key stored by the management platform, as shown in FIG. 11 , by using a public key corresponding to the management platform Decrypting the third key information to obtain a second decrypted hash value; and hashing the identification number of the wireless access point and the second random challenge word by using a shared key stored by the wireless access point A fourth hash value is obtained (as shown in Figure 13).
  • Step S206 includes:
  • an embodiment of the present invention provides a wireless access point and a management platform authentication method, where a wireless access point performs encryption by using a stored key, and requests the management platform to authenticate the wireless access point, including:
  • the wireless access point generates a first random challenge word.
  • the wireless access point encrypts the identifier of the wireless access point and the first random challenge word by using a key stored by the wireless access point to obtain first key information.
  • the wireless access point sends the first authentication information to the management platform, where the first authentication information includes an identifier of the wireless access point, a first random challenge word, and first key information.
  • the management platform uses the key corresponding to the wireless access point to perform the first authentication.
  • the information is verified to obtain the second key information;
  • the key stored by the wireless access point is the same as or corresponds to the key corresponding to the wireless access point stored by the management platform, and the authentication may pass if the wireless access point It is illegal. For example, if the wireless access point is masquerading, the key stored by the wireless access point is different from or different from the key corresponding to the wireless access point stored by the management platform. At this time, the authentication cannot pass.
  • the management platform encrypts by using the key corresponding to the wireless access point, and requests the wireless access point to authenticate the management platform (if the authentication is not required, the following steps are not required), including:
  • the management platform generates a second random challenge word.
  • the management platform encrypts the identification number of the wireless access point and the second random challenge word by using a key corresponding to the wireless access point to obtain third key information.
  • the management platform sends second authentication information to the wireless access point.
  • the second authentication information includes an identifier of the wireless access point, a second random challenge word, and third key information.
  • the wireless access point performs verification on the second authentication information by using a key stored by the wireless access point to obtain fourth key information.
  • the key stored by the wireless access point is the same as or corresponds to the key corresponding to the wireless access point stored by the management platform, and the authentication may be passed if the management platform is If the authentication platform is spoofed, the key stored by the wireless access point is different from or different from the key corresponding to the wireless access point stored by the management platform. In this case, the authentication cannot pass.
  • Step S302 includes:
  • Step S304 includes:
  • Decrypting the first key information by using a public key corresponding to the wireless access point to obtain a first decrypted hash value; and using the shared key corresponding to the wireless access point to connect the wireless connection
  • the identification number of the in point and the first random challenge word are hashed to obtain a second hash value (as shown in FIG. 9).
  • Step S305 includes:
  • the first decrypted hash value is the same as the second hash value, it is determined that the first key information corresponds to the second key information.
  • Step S308 includes:
  • Step S310 includes:
  • the second random challenge word is hashed (as shown in FIG. 12) to obtain the fourth decrypted information
  • the identification number and the second random challenge word are hashed to obtain a fourth hash value (as shown in FIG. 13).
  • Step S311 includes:
  • the shared key of each wireless access point is different from that of other wireless access points.
  • the shared wireless access point and the legitimate management platform both store the shared key, and both parties use the shared key to authenticate the key information.
  • the wireless access point stores the signed private key and the public key corresponding to the management platform.
  • the management platform stores the private key of the platform and the public key corresponding to the wireless access point, and the two parties use the corresponding public key or private key to perform key information. Authentication.
  • the present invention further provides a wireless access point and management platform authentication device, which is disposed on the management platform side, and includes:
  • the first receiving module 401 is configured to: receive first authentication information sent by the wireless access point, where the first authentication information includes an identifier of the wireless access point, a first random challenge word, and a first key Information, the first key information is obtained by the wireless access point encrypting the identification number of the wireless access point and the first random challenge word by using a key stored by the wireless access point;
  • the first authentication module 402 is configured to: perform verification on the first authentication information by using a key corresponding to the wireless access point, to obtain second key information;
  • the first determining module 403 is configured to: when determining the first key information and the second key When the information corresponds, it is determined that the wireless access point is legal.
  • the first determining module 403 is further configured to: when it is determined that the first key information does not correspond to the second key information, determine that the wireless access point is illegal.
  • the above device also includes:
  • the first generating module 404 is configured to: generate a second random challenge word
  • the first encryption module 405 is configured to: encrypt the identification number of the wireless access point and the second random challenge word by using a key corresponding to the wireless access point, to obtain third key information;
  • the first sending module 406 is configured to: send second authentication information to the wireless access point, so that the wireless access point uses the key stored by the wireless access point to the second authentication information.
  • the second authentication information includes an identification number of the wireless access point, a second random challenge word, and third key information.
  • the first authentication module 402 includes a first dissolving unit 4021 and/or a first decrypting unit 4022:
  • the first dissolving unit 4021 is configured to: when the first key information is an identifier number of the wireless access point and the number of the wireless access point using a shared key stored by the wireless access point Obtaining a random challenge word by performing a hash operation, and hashing the identification number of the wireless access point and the first random challenge word by using a shared key corresponding to the wireless access point to obtain a first Second decryption information;
  • the first decrypting unit 4022 is configured to: when the first key information is an identifier number of the wireless access point and the number of the wireless access point using a shared key stored by the wireless access point And a random challenge word is obtained by performing a hash operation to obtain a first hash value, and signing the first hash value by using a private key stored by the wireless access point, and using the wireless access point
  • the public key decrypts the first key information to obtain a first decrypted hash value; and uses the shared key corresponding to the wireless access point to identify the identification number of the wireless access point and the A random challenge word performs a hash operation to obtain a second hash value.
  • the first encryption module 405 includes a first hash unit 4051 and/or a first signature unit 4052, where:
  • the first hash unit 4051 is configured to: utilize a shared key corresponding to the wireless access point Hashing the identification number of the wireless access point and the second random challenge word; or
  • the first signature unit 4052 is configured to: hash the identification number of the wireless access point and the second random challenge word by using a shared key corresponding to the wireless access point to obtain a third hash value. And signing the third hash value with a private key stored by the management platform.
  • the first determining module 403 includes a first direct corresponding unit 4031 and/or a first indirect corresponding unit 4032, where:
  • the first direct correspondence unit 4031 is configured to: when the first key information is the same as the second decryption information, determine that the first key information corresponds to the second key information; or
  • the first indirect corresponding unit 4032 is configured to: when the first decrypted hash value is the same as the second hash value, determine that the first key information corresponds to the second key information.
  • an embodiment of the present invention further provides a wireless access point and a management platform authentication device, which are disposed on a wireless access point side, and includes:
  • the second generating module 501 is configured to: generate a first random challenge word
  • the second encryption module 502 is configured to: encrypt the identification number of the wireless access point and the first random challenge word by using a key stored by the wireless access point, to obtain first key information;
  • the second sending module 503 is configured to: send the first authentication information to the management platform, so that the management platform performs verification on the first authentication information by using a key corresponding to the wireless access point, where
  • the first authentication information includes an identification number of the wireless access point, a first random challenge word, and first key information.
  • the above device also includes:
  • the second receiving module 504 is configured to: receive second authentication information sent by the management platform, where the second authentication information includes an identifier of the wireless access point, a second random challenge word, and third key information, where The third key information is obtained by the management platform encrypting the identification number of the wireless access point and the second random challenge word by using a key corresponding to the wireless access point;
  • the second authentication module 505 is configured to: perform verification on the second authentication information by using a key stored by the wireless access point, to obtain fourth key information;
  • the second determining module 506 is configured to: when it is determined that the third key information corresponds to the fourth key information, determine that the management platform is legal.
  • the second determining module 506 is further configured to:
  • the second encryption module 502 includes a second hash unit 5021 and/or a second signature unit 5022:
  • the second hashing unit 5021 is configured to: hash the identification number of the wireless access point and the first random challenge word by using a shared key stored by the wireless access point; or
  • the second signature unit 5022 is configured to: hash the identification number of the wireless access point and the first random challenge word by using a shared key stored by the wireless access point to obtain a first hash value, And signing the first hash value with a private key stored by the wireless access point.
  • the second authentication module 505 includes a second dissolving unit 5051 and/or a second decrypting unit 5052, wherein:
  • the second dissolving unit 5051 is configured to: when the third key information is the management platform, use the shared key corresponding to the wireless access point to identify the identification number of the wireless access point and the second Obtaining, by using a shared key stored by the wireless access point, hashing the identification number of the wireless access point and the second random challenge word to obtain a fourth decryption. information;
  • the second decryption unit 5052 is configured to: when the third key information is the management platform, use the shared key corresponding to the wireless access point to identify the identification number of the wireless access point and the second The random challenge word is hashed to obtain a third hash value, and the third hash value is obtained by using the private key stored by the management platform, and the public key pair corresponding to the management platform is utilized. Deciphering the third key information to obtain a second decrypted hash value; and dispersing the identification number of the wireless access point and the second random challenge word by using a shared key stored by the wireless access point The column operation obtains a fourth hash value.
  • the second determining module 506 includes a second direct corresponding unit 5061 and/or a second indirect corresponding unit 5062, wherein:
  • the second direct correspondence unit 5061 is configured to: when the third key information is the same as the fourth decryption information, determine that the third key information corresponds to the fourth key information; or
  • the second indirect correspondence unit 5062 is configured to: when the second decrypted hash value is the same as the fourth hash value, determine that the third key information corresponds to the fourth key information.
  • the shared key in the embodiment of the present invention refers to a shared key used for performing hash operations on a certain hash algorithm (such as SHA-256). As shown in Figure 14, the steps are as follows:
  • the wireless access point uses its own NodeID (the NodeID can be the MAC address, serial number, or other unique identifier of the wireless access point), and a randomly generated challenge word X, which is stored using the shared key. Hash operation, get the hash value A (see Figure 6);
  • the packet carries the NodeID, the challenge word, and the hash value A;
  • the management platform After receiving the connection request of the wireless access point, the management platform uses the shared key of the wireless access point to perform a hash algorithm on the received NodeID and the challenge word X to obtain a hash value AA (see FIG. 8). .
  • A AA
  • the management platform determines that the wireless access point is legal, otherwise it is illegal.
  • the management platform randomly generates a challenge word Y, and for receiving the NodeID, hashing is performed by using the shared key corresponding to the wireless access point to obtain a hash value B (see FIG. 10);
  • the management platform carries the NodeID, the challenge word, and the encrypted hash value B of the wireless access point in the response message sent to the wireless access point (see FIG. 10);
  • the wireless access point After receiving the response message, the wireless access point performs a hash operation on the received NodeID and the challenge word Y using the stored shared key to obtain a hash value BB;
  • the hash value can be further cryptographically signed (such as the RSA algorithm). As shown in Figure 15, the steps are as follows:
  • the wireless access point with its own NodeID can be the wireless access point's MAC address, serial number, or other unique identifier
  • a randomly generated challenge word X use the storage shared key to spread them Column operation, get the hash value A, use RSA signature of the private key stored by the wireless access point to obtain the RSA signature ciphertext AAA (see Figure 7);
  • the packet carries the NodeID, the challenge string, and the RSA signature ciphertext AAA;
  • the management platform After receiving the connection request of the wireless access point, the management platform uses the public key corresponding to the wireless access point to perform RSA decryption on the signature result AAA, obtains the original text of the RSA signature, and obtains the decrypted hash value AAAA, and then uses The wireless access point performs a hash operation on the NodeID and the challenge word X corresponding to the shared key to obtain a hash result AA (see FIG. 9);
  • the management platform compares the RSA signature decryption hash value AAAA with the calculated hash value AA result. If the agreement is consistent, the wireless access point is legal, otherwise it is illegal.
  • the management platform randomly generates a challenge word Y, and receives the NodeID, and uses the shared key corresponding to the wireless access point to perform a hash operation to obtain a hash value B;
  • Ciphertext BBB Ciphertext BBB.
  • the wireless access point After receiving the response message, the wireless access point uses the public key corresponding to the pre-stored management platform to perform RSA decryption on the received signature result BBB, and obtains the original text of the RSA signature, and obtains the decrypted hash value BBBB. Hashing the BB with the NodeID and the challenge word using the shared key stored by the wireless access point (see Figure 13);
  • the wireless access point compares the RSA signature decryption hash value BBBB with the calculated hash value BB. If the two results are consistent, the management platform is legal, otherwise illegal.
  • all or part of the steps of the above embodiments may also be implemented by using an integrated circuit. These steps may be separately fabricated into individual integrated circuit modules, or multiple modules or steps may be fabricated into a single integrated circuit module. achieve.
  • the devices/function modules/functional units in the above embodiments may be implemented by a general-purpose computing device, which may be centralized on a single computing device or distributed over a network of multiple computing devices.
  • the device/function module/functional unit in the above embodiment When the device/function module/functional unit in the above embodiment is implemented in the form of a software function module and sold or used as a stand-alone product, it can be stored in a computer readable storage medium.
  • the above mentioned computer readable storage medium may be a read only memory, a magnetic disk or an optical disk or the like.
  • the authentication method and device provided by the embodiments of the present invention can verify the mutual legality of the access point device and the network management platform, ensure the legality of the wireless access point, and provide a more secure and reliable connection for the devices in the network. In.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Storage Device Security (AREA)

Abstract

La présente invention se rapporte au domaine des réseaux sans fil et porte sur un procédé et sur un dispositif d'authentification d'un point d'accès sans fil et sur une plate-forme de gestion. Le procédé consiste à : générer, au moyen d'un point d'accès sans fil, un premier mot de défi aléatoire ; utiliser, au moyen du point d'accès sans fil, une clé stockée par le point d'accès sans fil pour crypter un numéro d'identifiant du point d'accès sans fil et le premier mot de défi aléatoire de sorte à obtenir des premières informations de clé ; envoyer, au moyen du point d'accès sans fil, à une plate-forme de gestion des premières informations d'authentification comprenant le numéro d'identifiant du point d'accès sans fil, le premier mot de défi aléatoire et les premières informations de clé ; utiliser, au moyen de la plate-forme de gestion, une clé correspondant au point d'accès sans fil pour vérifier les premières informations d'authentification de sorte à obtenir des secondes informations de clé ; et si la plate-forme de gestion détermine que les premières informations de clé correspondent aux secondes informations de clé, déterminer alors que le point d'accès sans fil est légitime. La présente invention peut garantir la légitimité d'un point d'accès sans fil et, donc, fournir un accès plus sûr et plus fiable pour un dispositif dans un réseau.
PCT/CN2016/080767 2015-07-13 2016-04-29 Procédé et dispositif d'authentification de point d'accès sans fil et plate-forme de gestion Ceased WO2017008556A1 (fr)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201510410310.5 2015-07-13
CN201510410310.5A CN106714156A (zh) 2015-07-13 2015-07-13 一种无线接入点和管理平台鉴权的方法和装置

Publications (1)

Publication Number Publication Date
WO2017008556A1 true WO2017008556A1 (fr) 2017-01-19

Family

ID=57756810

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/080767 Ceased WO2017008556A1 (fr) 2015-07-13 2016-04-29 Procédé et dispositif d'authentification de point d'accès sans fil et plate-forme de gestion

Country Status (2)

Country Link
CN (1) CN106714156A (fr)
WO (1) WO2017008556A1 (fr)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111107551A (zh) * 2018-10-29 2020-05-05 杭州海康威视数字技术股份有限公司 无线网桥连网方法及装置

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2019153118A1 (fr) * 2018-02-06 2019-08-15 福建联迪商用设备有限公司 Procédé de transmission de clé, terminal de réception et terminal de distribution
CN110493272B (zh) * 2019-09-25 2020-10-02 北京风信科技有限公司 使用多重密钥的通信方法和通信系统

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102685745A (zh) * 2012-04-23 2012-09-19 深圳市江波龙电子有限公司 无线ap设备的认证方法和系统
WO2013012878A1 (fr) * 2011-07-18 2013-01-24 Microsoft Corporation Distribution d'identificateurs de réseau à l'aide de fonction de hachage
CN103096301A (zh) * 2011-10-31 2013-05-08 华为技术有限公司 无线局域网接入点验证的方法及站点
CN104125568A (zh) * 2014-08-11 2014-10-29 醴陵恒茂电子科技有限公司 无线接入点安全认证方法和系统
US20140337633A1 (en) * 2013-05-07 2014-11-13 Futurewei Technologies, Inc. System and Method for Indicating a Service Set Identifier
CN104581727A (zh) * 2015-02-03 2015-04-29 福州瑞芯微电子有限公司 设备连接方法、装置及ap端电子设备

Family Cites Families (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
ITRM20030100A1 (it) * 2003-03-06 2004-09-07 Telecom Italia Mobile Spa Tecnica di accesso multiplo alla rete, da parte di terminale di utente interconnesso ad una lan e relativa architettura di riferimento.
CN1753361A (zh) * 2004-09-20 2006-03-29 华为技术有限公司 一种鉴权方法
US20080134306A1 (en) * 2006-12-04 2008-06-05 Telefonaktiebolaget Lm Ericsson (Publ) Method for fast handover and authentication in a packet data network
CN101640886B (zh) * 2008-07-29 2012-04-25 上海华为技术有限公司 鉴权方法、重认证方法和通信装置
CN101764693B (zh) * 2009-12-24 2013-01-30 福建星网锐捷网络有限公司 认证方法、系统、客户端和网络设备
CN102625307B (zh) * 2011-01-31 2014-07-09 电信科学技术研究院 一种无线网络接入系统
CN103634170B (zh) * 2012-08-21 2018-12-18 中兴通讯股份有限公司 一种家庭网络互联方法及装置

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2013012878A1 (fr) * 2011-07-18 2013-01-24 Microsoft Corporation Distribution d'identificateurs de réseau à l'aide de fonction de hachage
CN103096301A (zh) * 2011-10-31 2013-05-08 华为技术有限公司 无线局域网接入点验证的方法及站点
CN102685745A (zh) * 2012-04-23 2012-09-19 深圳市江波龙电子有限公司 无线ap设备的认证方法和系统
US20140337633A1 (en) * 2013-05-07 2014-11-13 Futurewei Technologies, Inc. System and Method for Indicating a Service Set Identifier
CN104125568A (zh) * 2014-08-11 2014-10-29 醴陵恒茂电子科技有限公司 无线接入点安全认证方法和系统
CN104581727A (zh) * 2015-02-03 2015-04-29 福州瑞芯微电子有限公司 设备连接方法、装置及ap端电子设备

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111107551A (zh) * 2018-10-29 2020-05-05 杭州海康威视数字技术股份有限公司 无线网桥连网方法及装置

Also Published As

Publication number Publication date
CN106714156A (zh) 2017-05-24

Similar Documents

Publication Publication Date Title
CN106603485B (zh) 密钥协商方法及装置
US7392393B2 (en) Content distribution system
CN107810617B (zh) 机密认证和供应
TWI487359B (zh) 用於安全金鑰產生的設備、利用終端用戶設備來進行安全金鑰產生的方法及在裝置製造者伺服器中進行安全金鑰產生的方法
US8327143B2 (en) Techniques to provide access point authentication for wireless network
JP4599852B2 (ja) データ通信装置および方法、並びにプログラム
US20190089527A1 (en) System and method of enforcing a computer policy
US8601267B2 (en) Establishing a secured communication session
CN103532713B (zh) 传感器认证和共享密钥产生方法和系统以及传感器
WO2018076365A1 (fr) Procédé et dispositif de négociation de clés
CA2551113A1 (fr) Systeme d'authentification pour applications informatiques en reseau
CN106790261B (zh) 分布式文件系统及用于其中节点间认证通信的方法
US20160352702A1 (en) System and Method for Resetting Passwords on Electronic Devices
US20130019093A1 (en) Certificate authority
CN112351037B (zh) 用于安全通信的信息处理方法及装置
JP5380583B1 (ja) デバイス認証方法及びシステム
CN110912685B (zh) 建立受保护通信信道
US7243368B2 (en) Access control system and method for a networked computer system
CN101019368B (zh) 使用分发cd将直接证明私钥传递给设备的方法
CN101296083A (zh) 一种加密数据传输方法和系统
CN111314269B (zh) 一种地址自动分配协议安全认证方法及设备
US12418406B2 (en) Authentication using a decentralized and/or hybrid decentralized secure cryptographic key storage method
CN113886781B (zh) 基于区块链的多重认证加密方法、系统、电子设备及介质
US10764065B2 (en) Admissions control of a device
CN110572257B (zh) 基于身份的数据来源鉴别方法和系统

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16823703

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 16823703

Country of ref document: EP

Kind code of ref document: A1