WO2018119950A1 - Procédé et appareil de contrôle d'accès - Google Patents
Procédé et appareil de contrôle d'accès Download PDFInfo
- Publication number
- WO2018119950A1 WO2018119950A1 PCT/CN2016/113259 CN2016113259W WO2018119950A1 WO 2018119950 A1 WO2018119950 A1 WO 2018119950A1 CN 2016113259 W CN2016113259 W CN 2016113259W WO 2018119950 A1 WO2018119950 A1 WO 2018119950A1
- Authority
- WO
- WIPO (PCT)
- Prior art keywords
- vector
- radio frequency
- access
- frequency fingerprint
- classification
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Ceased
Links
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
- H04W12/08—Access security
Definitions
- the present application relates to the field of wireless communications technologies, and in particular, to an access control method and apparatus.
- WIFI as a technology that allows access devices to connect to a wireless local area network
- the wireless routing device determines the performance of the WiFi network. Due to the openness of the wireless environment, any wireless terminal device in the vicinity of the wireless router can receive the wireless signal and access the WiFi network through the wireless router device, thereby affecting the security of the WiFi network.
- the most common solution is to use the WPA-PSK/WPA2-PSK method to set the 8-64-bit key to achieve access authentication for the device to connect to the wireless router. This method is less secure and easy. A situation where a key is leaked.
- a person skilled in the art proposes a method for completing authentication by using a third-party authentication server.
- the user equipment first logs in to the third-party authentication server, and simultaneously sends the wireless routing device identification information to be connected to the third-party authentication server.
- the third-party authentication server then generates an identification information to be sent to the wireless routing device and the user equipment, and the user equipment connects and logs in to the wireless routing device based on the flag information.
- the method for dynamically generating an authentication code reduces the security risk caused by the password leakage to a certain extent, but is still essentially a key-based authentication mechanism, and does not fundamentally solve the network security risk caused by the key leakage. .
- the embodiment of the present application provides an access control method and apparatus, which are used to solve the network security problem caused by the secret routing key leakage of the wireless routing device based on the key access authentication mechanism in the prior art.
- the embodiment of the present application provides an access control method, which is applied to a wireless routing device pre-equipped with a radio frequency fingerprint database, and the method includes:
- the access device is allowed to access.
- the method before the acquiring the radio frequency fingerprint feature vector of the access device, the method further includes:
- M and N are integers greater than one.
- the radio frequency fingerprint feature vector of the corresponding access device is configured according to the access request, including:
- obtaining a classification vector of the access device by using a sparse classification model includes:
- the model derives the classification vector of the access device, where For the RF fingerprint feature vector, M is the RF fingerprint library, and C is the classification vector.
- the reconstruction vector corresponding to the classification vector is:
- the original reconstructed vector is obtained, where ⁇ is the reconstructed noise, Is the original reconstructed vector, which is a column vector composed of N*K elements, and K is the number of authorized devices in the radio frequency fingerprint library M;
- Each successive N elements in the original reconstructed vector are sequentially added to obtain a reconstructed vector composed of K elements.
- An access control method provided by an embodiment of the present application is applied to a wireless routing device pre-configured with a radio frequency fingerprint database, first constructing a radio frequency fingerprint feature vector of the corresponding access device according to the access request, and then based on the radio frequency fingerprint feature Vector and RF fingerprint database, the classification vector of the access device is obtained by sparse classification algorithm, and finally the classification vector is reconstructed by the sparse reconstruction algorithm. If the maximum element value in the reconstruction vector is greater than a preset threshold, the connection is allowed. Access to the device. Compared with the current access authentication method, the present application is based on the characteristics of the access terminal device's own radio frequency circuit.
- the wireless routing device generates a unique radio frequency fingerprint feature, which is used to determine whether the access device is allowed to access according to the uniqueness of the radio frequency fingerprint feature, thereby fundamentally solving the security risk caused by the secret key leakage, and also does not need to provide other Third-party access authentication device.
- the embodiment of the present application provides an access control device, which is applied to a wireless routing device that is pre-equipped with a radio frequency fingerprint database, and the device includes:
- a constructing module configured to construct a radio frequency fingerprint feature vector of the corresponding access device according to the access request
- a first calculating module configured to obtain, according to the radio frequency fingerprint feature vector and the radio frequency fingerprint library, a classification vector of the access device by using a sparse classification model
- a second calculating module configured to obtain, according to the classification vector and the sparse reconstruction algorithm, a reconstruction vector corresponding to the classification vector
- the processing module is configured to allow the access device to access if the maximum element value in the reconstructed vector is greater than a preset threshold.
- processing module is further configured to:
- the device further includes:
- An acquisition module configured to collect an I/Q amplitude offset and a carrier frequency offset of the pre-authorized device under the M carrier modulated signals, as a set of radio frequency fingerprint feature vectors of the pre-authorized device;
- M and N are integers greater than one.
- constructing module is specifically configured to:
- the model derives the classification vector of the access device, where For the RF fingerprint feature vector, M is the RF fingerprint library, and C is the classification vector.
- the original reconstructed vector is obtained, where ⁇ is the reconstructed noise, Is the original reconstructed vector, which is a column vector composed of N*K elements, and K is the number of authorized devices in the radio frequency fingerprint library M;
- Each successive N elements in the original reconstructed vector are sequentially added to obtain a reconstructed vector composed of K elements.
- the access control device provided in the embodiment of the present application is applied to a wireless routing device pre-equipped with a radio frequency fingerprint database.
- the constructing module constructs a radio frequency fingerprint feature vector of the corresponding access device according to the access request, and the first computing module Based on the radio frequency fingerprint feature vector and the radio frequency fingerprint database, the classification vector of the access device is obtained by a sparse classification algorithm, and then the first calculation module reconstructs the classification vector by a sparse reconstruction algorithm.
- the processing module is When the maximum element value in the reconstructed vector is greater than the preset threshold, the access device is allowed to access.
- the present application is based on the characteristics of the radio circuit of the access terminal device and is generated by the wireless routing device.
- the unique radio frequency fingerprint feature is used to determine whether the access device is allowed to access according to the uniqueness of the radio frequency fingerprint feature, thereby fundamentally solving the security risk caused by the key leakage, and does not need to provide other third-party access. Enter the certified device.
- Embodiment 1 is a schematic flow chart of Embodiment 1 of the present application.
- FIG. 2 is a schematic flowchart of an authorization phase of the second embodiment of the present application.
- FIG. 3 is a schematic flowchart of an access phase in Embodiment 2 of the present application.
- Embodiment 4 is a schematic structural view of Embodiment 4 of the present application.
- first, second, third, etc. may be used to describe the computing modules in the embodiments of the present application, these computing modules should not be limited to these terms. These terms are only used to distinguish computing modules from one another.
- the first computing module may also be referred to as a second computing module without departing from the scope of the embodiments of the present application.
- the second computing module may also be referred to as a first computing module.
- the word “if” as used herein may be interpreted as “when” or “when” or “in response to determining” or “in response to detecting.”
- the phrase “if determined” or “if detected (conditions or events stated)” may be interpreted as “when determined” or “in response to determination” or “when detected (stated condition or event) “Time” or “in response to a test (condition or event stated)”.
- FIG. 1 it is a schematic flowchart of a method provided by an embodiment of the present application. As shown in FIG. 1 , the method includes the following steps:
- RF fingerprint feature vector of the access device able to pass Performing a representation, wherein ⁇ IQ M is an I/Q amplitude offset of the access device under the M carrier modulated signals in the current time period, and ⁇ f M is a carrier of the access device under the M carrier modulated signals in the previous time period Frequency offset.
- the wireless fingerprint device controls the wireless routing device to enter the authorization mode by the web control interface of the wireless routing device, and the wireless routing device searches for the pre-authorization device connected to itself, and then authorizes by the following steps:
- M and N are integers greater than one.
- the RF fingerprint database M can be expressed as among them, Indicates the Nth group radio frequency fingerprint feature vector of the kth authorized device.
- the classification vector is reconstructed by a sparse reconstruction algorithm to obtain a reconstruction vector.
- the specific steps include:
- the setting range of the preset threshold ⁇ is (0.8, 1), if the reconstruction vector The maximum element value in the medium is greater than the preset threshold ⁇ , allowing the access device to be accessed; if the vector is reconstructed The maximum element value in the medium is less than or equal to the preset threshold ⁇ , and the access device is prohibited from being accessed.
- the access device is prohibited from accessing.
- An access control method provided by an embodiment of the present application is applied to a wireless routing device pre-configured with a radio frequency fingerprint database, first constructing a radio frequency fingerprint feature vector of the corresponding access device according to the access request, and then based on the radio frequency fingerprint feature Vector and RF fingerprint database, the classification vector of the access device is obtained by the sparse classification model, and finally the classification vector is reconstructed by the sparse reconstruction algorithm. If the maximum element value in the reconstruction vector is greater than the preset threshold, the connection is allowed. Access to the device.
- the present application generates a unique radio frequency fingerprint feature according to the characteristics of the radio circuit of the access terminal device, and determines whether the access device is allowed to be connected according to the uniqueness of the radio frequency fingerprint feature. Into, and thus fundamentally solve the security risks caused by the secret key leakage, and there is no need to provide other third-party access authentication devices.
- terminals involved in the embodiments of the present application may include, but are not limited to, a personal computer (PC), a personal digital assistant (PDA), a wireless handheld device, a tablet computer, and a tablet computer.
- PC personal computer
- PDA personal digital assistant
- Mobile phones MP3 players, MP4 players, etc.
- execution body of S101 to S104 may be an access control device, and the device
- the application unit may be located in the application of the local terminal, or may be a plug-in or a software development kit (SDK) in the application of the local terminal, which is not specifically limited in this embodiment of the present application.
- SDK software development kit
- the application may be an application (nativeApp) installed on the terminal, or may be a web application (webApp) of the browser on the terminal, which is not limited by the embodiment of the present application.
- the embodiment of the present application further illustrates the method of the present application by using a specific terminal device.
- a specific terminal device select 3 Huawei Mate7 mobile phones, 3 Apple iphone6 mobile phones, 3 Nexus mobile phones, 2 Thinkpad X240 computers, 2 Ipad3s as mobile terminal devices, and then use USRP supporting 802.11n as a wireless routing device.
- each test carrier uses 16QAM modulation.
- the web control interface of the wireless routing device controls the wireless routing device to enter the authorization mode, and the wireless routing device searches for the pre-authorization device connected to itself, and then performs authorization by the following steps:
- a total of 13 authorized devices constitute a radio frequency fingerprint database M, and the radio frequency fingerprint database M can be expressed as There are 130 sets of radio frequency fingerprint feature data in the RF fingerprint database M.
- the wireless routing device enters the access mode.
- determine whether to allow access by the following steps:
- the wireless router responds and measures the radio frequency fingerprint feature vector of the access device according to the access request of the access device It can be expressed as
- test results were tested using the above 13 devices. Each device was randomly connected 100 times, and the total correct access rate reached 99%. At the same time, 4 Huawei mobile phones and 3 X230 laptops were used without authorization. Attempts to access the wireless router, all identified as illegal devices and prohibited access.
- the embodiment of the present application further provides an apparatus embodiment for implementing the steps and methods in the foregoing method embodiments.
- FIG. 4 is a functional block diagram of a multi-antenna system correlation coefficient calculation apparatus according to an embodiment of the present application. As shown in Figure 4, the device comprises:
- the constructing module 410 is configured to construct a radio frequency fingerprint feature vector of the corresponding access device according to the access request;
- the first calculating module 420 is configured to pass the radio frequency fingerprint feature vector and the radio frequency fingerprint database.
- the classification vector of the access device is obtained by the sparse classification model;
- a second calculating module 430 configured to obtain, according to the classification vector and the sparse reconstruction algorithm, a reconstruction vector corresponding to the classification vector;
- the processing module 440 is configured to allow the access device to access if the maximum element value in the reconstructed vector is greater than a preset threshold.
- the processing module is further configured to:
- the device further includes:
- An acquisition module configured to collect an I/Q amplitude offset and a carrier frequency offset of the pre-authorized device under the M carrier modulated signals, as a set of radio frequency fingerprint feature vectors of the pre-authorized device;
- M and N are integers greater than one.
- the constructing module is specifically configured to:
- the first computing module is specifically configured to:
- the model derives the classification vector of the access device, where For the RF fingerprint feature vector, M is the RF fingerprint library, and C is the classification vector.
- the second computing module is specifically configured to:
- the original reconstructed vector is obtained, where ⁇ is the reconstructed noise, Is the original reconstructed vector, which is a column vector composed of N*K elements, and K is the number of authorized devices in the radio frequency fingerprint library M;
- Each successive N elements in the original reconstructed vector are sequentially added to obtain a reconstructed vector composed of K elements.
- the access control device provided in the embodiment of the present application is applied to a wireless routing device pre-equipped with a radio frequency fingerprint database.
- the constructing module constructs a radio frequency fingerprint feature vector of the corresponding access device according to the access request, and the first computing module Based on the radio frequency fingerprint feature vector and the radio frequency fingerprint database, the classification vector of the access device is obtained by a sparse classification algorithm, and then the first calculation module reconstructs the classification vector by a sparse reconstruction algorithm.
- the processing module is When the maximum element value in the reconstructed vector is greater than the preset threshold, the access device is allowed to access.
- the present application Compared with the current access authentication device, the present application generates a unique radio frequency fingerprint feature through the wireless routing device according to the characteristics of the radio circuit of the access terminal device, and determines whether the access device is allowed to be connected according to the uniqueness of the radio frequency fingerprint feature. Into, and thus fundamentally solve the security risks caused by the secret key leakage, and there is no need to provide other third-party access authentication devices.
- the disclosed system, apparatus, and method may be implemented in other manners.
- the device embodiments described above are merely illustrative.
- the division of the unit is only a logical function division.
- multiple units or components may be combined.
- the mutual coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interface, device or unit, and may be in an electrical, mechanical or other form.
- the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of the embodiment.
- each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.
- the above integrated unit can be implemented in the form of hardware or in the form of hardware plus software functional units.
- the above-described integrated unit implemented in the form of a software functional unit can be stored in a computer readable storage medium.
- the software functional unit is stored in a storage medium and includes instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) or a processor to perform the methods of the various embodiments of the present application. Part of the steps.
- the foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, and the like, which can store program codes. .
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Mobile Radio Communication Systems (AREA)
Abstract
La présente invention concerne un procédé et un appareil de contrôle d'accès, appartenant au domaine technique des communications sans fil. Le procédé décrit dans les modes de réalisation de la présente invention consiste à : construire, d'après une demande d'accès, un vecteur caractéristique d'empreinte digitale radiofréquence correspondant à un dispositif d'accès ; d'après le vecteur caractéristique d'empreinte digitale radiofréquence et d'une bibliothèque d'empreintes digitales radiofréquence, obtenir un vecteur de classification du dispositif d'accès au moyen d'un modèle de classification épars ; obtenir, d'après le vecteur de classification et un algorithme de reconstruction éparse, un vecteur de reconstruction correspondant au vecteur de classification ; et, si la valeur d'élément maximale dans le vecteur de reconstruction est supérieure à une valeur de seuil prédéfinie, autoriser l'accès au dispositif d'accès. De cette manière, les informations d'empreinte digitale radiofréquence générées par un dispositif de routage sans fil font office de caractéristique unique, et l'opportunité d'autoriser l'accès du dispositif d'accès est déterminée sur la base de l'unicité de la caractéristique d'empreinte digitale radiofréquence. La solution technique fournie par les modes de réalisation de la présente invention peut ainsi résoudre fondamentalement les risques de sécurité provoqués par une fuite de clé, sans devoir recourir à d'autres dispositifs d'authentification d'accès tiers.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| PCT/CN2016/113259 WO2018119950A1 (fr) | 2016-12-29 | 2016-12-29 | Procédé et appareil de contrôle d'accès |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| PCT/CN2016/113259 WO2018119950A1 (fr) | 2016-12-29 | 2016-12-29 | Procédé et appareil de contrôle d'accès |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| WO2018119950A1 true WO2018119950A1 (fr) | 2018-07-05 |
Family
ID=62706575
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| PCT/CN2016/113259 Ceased WO2018119950A1 (fr) | 2016-12-29 | 2016-12-29 | Procédé et appareil de contrôle d'accès |
Country Status (1)
| Country | Link |
|---|---|
| WO (1) | WO2018119950A1 (fr) |
Cited By (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN113612751A (zh) * | 2021-07-28 | 2021-11-05 | 深圳供电局有限公司 | 一种配电网电力线载波通信系统接入安全性检测方法 |
| EP4009207A1 (fr) * | 2020-12-07 | 2022-06-08 | Siemens Aktiengesellschaft | Contrôle d'accès à un appareil basé sur une caractéristique discriminante |
| CN115085960A (zh) * | 2021-03-16 | 2022-09-20 | 中国移动通信有限公司研究院 | 网络安全接入认证方法、装置、电子设备及可读存储介质 |
| CN118764862A (zh) * | 2024-08-01 | 2024-10-11 | 中国电信股份有限公司技术创新中心 | 基于随机接入前导序列信号的设备接入认证方法 |
Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2013028198A1 (fr) * | 2011-08-25 | 2013-02-28 | Empire Technology Development Llc | Localisation au moyen d'informations de radiofréquence |
| CN104053129A (zh) * | 2014-06-19 | 2014-09-17 | 北京芯同汇科技有限公司 | 一种基于稀疏射频指纹插值的无线传感器网络室内定位方法和装置 |
| CN105372628A (zh) * | 2015-11-19 | 2016-03-02 | 上海雅丰信息科技有限公司 | 一种基于Wi-Fi的室内定位导航方法 |
| CN106250823A (zh) * | 2016-07-21 | 2016-12-21 | 同济大学 | 一种掌纹掌脉识别方法及掌纹掌脉图像采集仪 |
-
2016
- 2016-12-29 WO PCT/CN2016/113259 patent/WO2018119950A1/fr not_active Ceased
Patent Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2013028198A1 (fr) * | 2011-08-25 | 2013-02-28 | Empire Technology Development Llc | Localisation au moyen d'informations de radiofréquence |
| CN104053129A (zh) * | 2014-06-19 | 2014-09-17 | 北京芯同汇科技有限公司 | 一种基于稀疏射频指纹插值的无线传感器网络室内定位方法和装置 |
| CN105372628A (zh) * | 2015-11-19 | 2016-03-02 | 上海雅丰信息科技有限公司 | 一种基于Wi-Fi的室内定位导航方法 |
| CN106250823A (zh) * | 2016-07-21 | 2016-12-21 | 同济大学 | 一种掌纹掌脉识别方法及掌纹掌脉图像采集仪 |
Non-Patent Citations (2)
| Title |
|---|
| TANG, XIN ET AL.: "Reviews of Sparse Representation and Its Applications in Face Recognition", MATHEMATICAL MODELING AND ITS APPLICATIONS, 15 June 2014 (2014-06-15), ISSN: 2095-3070 * |
| YU , JIABAO ET AL.: "RF Fingerprinting Extraction and Identification of Wireless Communication Devices", JOURNAL OF CRYPTOLOGIC RESEARCH, vol. 3, no. 5, 15 October 2016 (2016-10-15), pages 433 - 446, XP055509585, ISSN: 2095-7025 * |
Cited By (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| EP4009207A1 (fr) * | 2020-12-07 | 2022-06-08 | Siemens Aktiengesellschaft | Contrôle d'accès à un appareil basé sur une caractéristique discriminante |
| WO2022122286A1 (fr) | 2020-12-07 | 2022-06-16 | Siemens Aktiengesellschaft | Contrôle d'accès à un dispositif à l'aide d'un élément de dispositif individuel |
| CN115085960A (zh) * | 2021-03-16 | 2022-09-20 | 中国移动通信有限公司研究院 | 网络安全接入认证方法、装置、电子设备及可读存储介质 |
| CN113612751A (zh) * | 2021-07-28 | 2021-11-05 | 深圳供电局有限公司 | 一种配电网电力线载波通信系统接入安全性检测方法 |
| CN118764862A (zh) * | 2024-08-01 | 2024-10-11 | 中国电信股份有限公司技术创新中心 | 基于随机接入前导序列信号的设备接入认证方法 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US11184350B2 (en) | System, apparatus and method for privacy preserving contextual authentication | |
| Truong et al. | Comparing and fusing different sensor modalities for relay attack resistance in zero-interaction authentication | |
| KR101977845B1 (ko) | 계속적 및 개별적 사용자 인증을 제공하기 위한 모바일 디바이스 | |
| US7730219B2 (en) | System and method for detecting free and open wireless networks | |
| US9607140B2 (en) | Authenticating a user of a system via an authentication image mechanism | |
| CN110011954B (zh) | 基于同态加密的生物识别方法、装置、终端及业务服务器 | |
| US10057289B2 (en) | Adjusting multi-factor authentication using context and pre-registration of objects | |
| US20140282868A1 (en) | Method And Apparatus To Effect Re-Authentication | |
| WO2019095911A1 (fr) | Procédé et dispositif permettant de résister à une attaque par déni de service | |
| US7941379B1 (en) | Systems and methods for using geo-location information in sensitive internet transactions | |
| US11038684B2 (en) | User authentication using a companion device | |
| CN105281906A (zh) | 安全验证方法及装置 | |
| WO2015047992A2 (fr) | Notation d'identification de dispositifs | |
| CN105027131A (zh) | 用于安全登录的系统、方法及其设备 | |
| US20120117633A1 (en) | Enhanced Security For Pervasive Devices Using A Weighting System | |
| CN107211024A (zh) | 多粒度验证技术 | |
| WO2018119950A1 (fr) | Procédé et appareil de contrôle d'accès | |
| WO2015189733A1 (fr) | Procédés et systèmes d'authentification d'un dispositif de communication | |
| WO2018149138A1 (fr) | Procédé de connexion de technologie sans fil (wi-fi) et produit associé | |
| CN105306202B (zh) | 身份验证方法、装置及服务器 | |
| WO2016201770A1 (fr) | Procédé de gestion d'entrée à accès contrôlé et terminal mobile | |
| US20130326591A1 (en) | Wireless communication device and wireless communication method | |
| Karakaya et al. | How Secure is Your Smart Watch? | |
| JP6218226B2 (ja) | 端末装置、認証方法、及びプログラム | |
| CN108199991B (zh) | 基于置信传递的时变衰落信道的物理层盲认证方法和系统 |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| 121 | Ep: the epo has been informed by wipo that ep was designated in this application |
Ref document number: 16925865 Country of ref document: EP Kind code of ref document: A1 |
|
| NENP | Non-entry into the national phase |
Ref country code: DE |
|
| 122 | Ep: pct application non-entry in european phase |
Ref document number: 16925865 Country of ref document: EP Kind code of ref document: A1 |