Wi-Fi chip WAPI protocol implementation system and method based on static library integration

Abstract

The invention discloses a Wi-Fi chip WAPI protocol implementation system and method based on static library integration, and particularly relates to the technical field of wireless local area network security, comprising a management frame processing module, a WAI protocol frame monitoring module, a key negotiation module and a cryptographic algorithm module, the management frame processing module, the WAI protocol frame monitoring module, the key negotiation module and the cryptographic algorithm module are packaged into a static library, and are linked to an original software architecture of Wpapplicant and Hostrid. According to the Wi-Fi chip WAPI protocol implementation system and method based on static library integration, the management frame processing module, the WAI protocol frame monitoring module, the key negotiation module and the cryptographic algorithm module are packaged into the static library and are linked to the original software architecture of wpasupplicant and hostrid, so that the complexity of implementing the WAPI function facing the Wi-Fi chip is reduced, and the WAPI protocol implementation system and method based on static library integration have the advantages that the management frame processing module, the WAI protocol frame monitoring module, the key negotiation module and the cryptographic algorithm module are integrated into the static library and are linked to the original software architecture of wpasupplicant and hostrid;

Description

Technical Field

[0001] The present invention relates to the technical field of wireless local area network security, and in particular to a Wi-Fi chip WAPI protocol implementation system and method based on static library integration. Background Art

[0002] With the rapid development of wireless LAN technology, network security issues are becoming increasingly prominent. Traditional WLAN security protocols such as WEP (Wired Equivalent Privacy) and WPA (Wi-Fi Protected Access) have many security loopholes and are difficult to cope with increasingly complex network attacks. To this end, China has proposed the WAPI standard with independent intellectual property rights, aiming to provide higher security protection.

[0003] The WAPI protocol uses a two-way authentication mechanism based on digital certificates, combined with the SM4 encryption algorithm approved by the National Cryptography Administration, which can effectively prevent security threats such as man-in-the-middle attacks and data tampering. However, the implementation of the WAPI protocol is relatively complex, especially the integration in Wi-Fi chips faces the following technical challenges:

[0004] 1. Protocol stack complexity: The WAPI protocol involves multiple modules such as certificate management, key negotiation, encryption and decryption, which makes it difficult to implement.

[0005] 2. Compatibility issues: Existing Wi-Fi chips usually support international standards (such as WPA2 / WPA3), and additional hardware and software modules that support WAPI need to be developed.

[0006] 3. Performance optimization: The encryption algorithm of the WAPI protocol (such as SM4) has high requirements on computing resources and needs to be optimized to meet real-time requirements.

[0007] 4. Integration method: The traditional dynamic library integration method has runtime dependency and compatibility issues. Although static library integration can solve some problems, it is necessary to solve the problem of efficient collaboration between modules.

[0008] Currently, some Wi-Fi chips support the WAPI protocol, but their implementation methods have the following shortcomings:

[0009] 1. Low modularity: Existing implementations usually tightly couple the WAPI protocol stack with the Wi-Fi driver, resulting in poor code reusability and difficulty in adapting to different hardware platforms.

[0010] 2. Complex state machine management: The WAPI protocol involves multiple state machines (such as security association state machine and key negotiation state machine). The existing implementation lacks a unified management mechanism, which easily leads to inconsistent states. Summary of the invention

[0011] The main purpose of the present invention is to provide a Wi-Fi chip WAPI protocol implementation system and method based on static library integration, which can effectively solve the problems raised in the background technology.

[0012] To achieve the above object, the technical solution adopted by the present invention is:

[0013] The Wi-Fi chip WAPI protocol implementation system based on static library integration includes management frame processing module, WAI protocol frame monitoring module, key negotiation module and cryptographic algorithm module;

[0014] The management frame processing module is used to receive, parse, verify, generate and send to 802.11 management frames, ensure the integrity and legitimacy of the management frames, and complete the security association establishment process;

[0015] The WAI protocol frame monitoring module is used to monitor the WAI protocol frames in the key negotiation process, perform preliminary verification on the protocol frames, and hand over the verified WAI protocol frames to the key negotiation module for processing;

[0016] The key negotiation module is used to receive the WAI protocol frame reported by the WAI protocol frame monitoring module, authenticate the ASUE and AE in the WAPI system based on the WAI protocol frame, and perform unicast and multicast / inter-station key negotiation;

[0017] The cryptographic algorithm module is used to provide a cryptographic algorithm interface to the key negotiation module to complete operations such as key derivation and message authentication code calculation involved in the key negotiation process;

[0018] The management frame processing module, WAI protocol frame monitoring module, key negotiation module and cryptographic algorithm module are encapsulated as a static library and linked to the original software architecture of Wpa_supplicant and Hostapd.

[0019] Preferably, when the management frame processing module is applied to ASUE, it is used to issue a probe request, parse the WAPI information element in the received probe response, issue a link verification request after verification, parse the received link verification response, issue an association request carrying the WAPI information element after verification, parse the received association response frame, and set the WAPI status on the ASUE side to the ASSOCOK status after verification.

[0020] Preferably, when the management frame module is applied to AE, it is used to parse the received probe request, issue a probe response carrying the WAPI information element after verification, parse the received link verification request, issue a link verification response after verification, parse the received association request carrying the WAPI information element, issue an association response after verification and set the WAPI status on the AE side to the ASSOCOK status.

[0021] Preferably, the WAPI state machine on the ASUE and AE sides is used to manage the negotiation state of the ASUE and AE in the key negotiation process, the ASSOCOK state is one of the negotiation states, and the negotiation state of the ASUE and AE will be used as one of the judgment conditions after the key negotiation module receives the WAI protocol frame.

[0022] Preferably, the cryptographic algorithm module includes an HMAC-SHA256 algorithm and an SM4-OFB algorithm, the HMAC-SHA256 algorithm is used for the key derivation and message authentication code calculation operations, and the SM4-OFB algorithm is used for encryption and decryption of the multicast key data field during the key negotiation process.

[0023] Preferably, the management frame processing module extracts management frames from the original modules of Wpa_supplicant and hostapd software for establishing security associations, and provides a management frame processing result interface for the original modules of the software to promote the operation of the original state machines of wpa_supplicant and hostapd.

[0024] Preferably, after the WAPI state machine runs to the NEGOATITIONOK state, it calls the original interface of wpa_supplicant and hostapd software, and sets the original key negotiation state of wpa_supplicant and hostapd to COMPLETED, which is used to indicate that the key negotiation process is completed, ASUE and AE have successfully established a secure connection, and can perform subsequent data communication processes based on SM4 algorithm encryption and decryption.

[0025] Preferably, the key negotiation module sets a timeout period of 10 seconds for the key negotiation process. When the WAPI state machine state is not updated within 10 seconds, the WAPI state machine state will be returned to the NOASSOC state, and the management frame processing module will be notified to send a de-authentication frame to cancel the security association state between ASUE and AE.

[0026] The present invention also discloses a method for implementing the WAPI protocol of a Wi-Fi chip based on static library integration, which includes the following steps:

[0027] S1: Start the Wpa_supplicant / Hostapd software, and the management frame processing module executes differentiated processes according to the terminal role:

[0028] a) When acting as ASUE:

[0029] Actively send a probe request frame to scan AP;

[0030] Parse the WAPIIE information in the probe response frame returned by the AP;

[0031] Verify the validity of the certificate revocation list (CRL);

[0032] Send a link verification request carrying a digital certificate;

[0033] Parse the link verification response returned by AE to complete one-way authentication;

[0034] Construct an association request frame carrying a WAPI security policy;

[0035] After receiving the association response frame, verify the validity of the AE certificate;

[0036] b) When acting as an AE:

[0037] Continuously monitor the management frame channel;

[0038] After receiving the ASUE probe request, construct a probe response containing a WAPI capability statement;

[0039] Parse the ASUE certificate chain in the link verification request;

[0040] Verify certificate signature and validity period;

[0041] Generate a link verification response including the AE certificate;

[0042] Perform two-way certificate authentication when processing association requests;

[0043] S2: Key negotiation is triggered after the security association is established:

[0044] a) The WAI monitoring module enables the BPF filter to capture WAI protocol frames of specific Ethernet types;

[0045] b) Perform integrity check on received frames:

[0046] Verify MAC address matching;

[0047] Check protocol version compatibility;

[0048] Check that the frame length complies with the protocol specification;

[0049] c) submitting the verified frame body to the key negotiation queue;

[0050] S3: Key negotiation state machine driving process:

[0051] a) Parse WAI frame type (authentication activation / certificate authentication / key negotiation);

[0052] b) Call the cryptographic algorithm module to execute:

[0053] The session key is derived using the HMAC-SHA256 encryption algorithm;

[0054] Encrypted multicast key container based on SM4-OFB;

[0055] Generate a message authentication code MTK;

[0056] c) Update the status flag according to the protocol timing:

[0057] Unicast key negotiation;

[0058] Multicast key distribution;

[0059] d) Start the 10-second negotiation timer:

[0060] Timeout triggers state rollback;

[0061] Sending a deauthentication frame generated by a management frame processing module;

[0062] Clearing temporary session key material;

[0063] S4: Key installation and synchronization:

[0064] a) When reaching NEGOTIATION_OK state:

[0065] Extract the USK / MSK key material generated through negotiation;

[0066] Call wpa_sm_set_key interface to inject driver key ring;

[0067] Update the supplicant's PTK / GTK status to VALID;

[0068] b) Synchronize the key version numbers of both AP and STA;

[0069] c) Activate SM4-CBC data encryption strategy;

[0070] S5: Data plane encryption and decryption processing:

[0071] a) The driver layer selects the encryption engine based on the key index:

[0072] Hardware mode: configure chip WAPI coprocessor;

[0073] Software mode: calling the kernel;

[0074] b) Implement SM4 block encryption on data frames;

[0075] c) Maintain the key update counter and trigger periodic re-negotiation:

[0076] Supplementary exception handling process:

[0077] E1: When certificate verification fails:

[0078] Generate system security event logs;

[0079] Send management frame to disassociate;

[0080] Reset the WAPI state machine to the initial state;

[0081] E2: When MAC verification fails:

[0082] Discard abnormal protocol frames;

[0083] Trigger the anti-replay attack counter;

[0084] The accumulated errors exceed the threshold and trigger temporary blocking.

[0085] Compared with the prior art, the present invention has the following beneficial effects:

[0086] 1. In the present invention, the management frame processing module, the WAI protocol frame monitoring module, the key negotiation module and the cryptographic algorithm module are encapsulated into a static library and linked to the original software architecture of wpa_supplicant and hostapd, so as to realize the support for WAPI function without affecting the original software architecture, so that the system adopting the method can support both WPA2 / 3 protocol and WAPI protocol; at the same time, the present invention has versatility, and is convenient to be transplanted to a Wi-Fi system that uses wpa_supplicant or hostapd to configure a wireless network, so that it supports WAPI function, further reduces the complexity of realizing WAPI function for Wi-Fi chip, and is conducive to the further promotion of WAPI protocol.

[0087] 2. The present invention divides the WAPI protocol stack into a management frame processing module, a WAI protocol frame monitoring module, a key negotiation module and a cryptographic algorithm module through modular design. The modules collaborate through standardized interfaces to improve code reusability and maintainability, and encapsulate the WAPI protocol stack as a static library, which is seamlessly integrated with the existing Wpa_supplicant and Hostapd software architectures to avoid runtime dependency issues. BRIEF DESCRIPTION OF THE DRAWINGS

[0088] Figure 1 It is a schematic diagram of the overall system structure of the present invention.

[0089] Figure 2 The figure is a schematic diagram of the WAPI state machine at the AP side involved in the present invention. DETAILED DESCRIPTION

[0090] It should be noted that, unless otherwise defined, the technical terms or scientific terms used in the present invention should be understood by people with ordinary skills in the field to which the present invention belongs. The "first", "second" and similar words used in the present invention do not indicate any order, quantity or importance, but are only used to distinguish different components. "Include" or "comprise" and similar words mean that the original or object appearing before the word covers the original or object listed after the word and its equivalent, without excluding other elements or objects. "Connect" or "connected" and similar words are not limited to physical or mechanical connections, but may include electrical connections, whether direct or indirect. "Up", "down", "left", "right" and the like are only used to indicate relative positional relationships. When the absolute position of the object being described changes, the relative positional relationship may also change accordingly.

[0091] In order to make the technical means, creative features, objectives and effects achieved by the present invention easy to understand, the present invention is further explained below in conjunction with specific implementation methods.

[0092] See also Figure 1 - Figure 2 , the present invention provides a technical solution:

[0093] The Wi-Fi chip WAPI protocol implementation system based on static library integration includes a management frame processing module, a WAI protocol frame monitoring module, a key negotiation module and a cryptographic algorithm module.

[0094] Specific:

[0095] The management frame processing module, WAI protocol frame monitoring module, key negotiation module and cryptographic algorithm module are respectively linked to the original architecture of wpa_supplicant and hostapd software in the form of static libraries, and are used as upper-layer software on the wireless network card implemented based on the Wi-Fi chip as a whole with the original software architecture. When the static library is linked to wpa_supplicant, it is used to establish a connection link between the wireless network card and AE. When the static library is linked to hostapd, it is used to establish a connection link between the wireless network card and ASUE;

[0096] The management frame processing module is used to receive, parse, verify, generate and send to 802.11 management frames, ensure the integrity and legitimacy of the management frames, and complete the security association establishment process;

[0097] The WAI protocol frame monitoring module is used to monitor the WAI protocol frames in the key negotiation process, perform preliminary verification on the protocol frames, and hand over the verified WAI protocol frames to the key negotiation module for processing;

[0098] The key negotiation module is used to receive the WAI protocol frame reported by the WAI protocol frame monitoring module, authenticate the ASUE and AE in the WAPI system based on the WAI protocol frame, and perform unicast and multicast / inter-station key negotiation;

[0099] The cryptographic algorithm module is used to provide a cryptographic algorithm interface to the key negotiation module to complete operations such as key derivation and message authentication code calculation involved in the key negotiation process;

[0100] The management frame processing module, WAI protocol frame monitoring module, key negotiation module and cryptographic algorithm module are encapsulated as a static library and linked to the original software architecture of Wpa_supplicant and Hostapd.

[0101] The processing logic of the management frame is:

[0102] S1: The wireless network card receives the management frame, and the wireless network card driver reports it to wpa_supplicant or hostapd. wpa_supplicant and hostapd report the management frame to the management frame processing module through the management frame reporting interface provided by the management frame processing module.

[0103] S2: According to the management frame structure, parse the various fields contained in the management frame, such as frame control field, signal strength, network parameters, source address and destination address, etc.

[0104] S3: Check the legitimacy of the management frame, including checking the source address, destination address, frame type, check frame, etc., to ensure that the management frame has not been tampered with or damaged. If the management frame contains a WAPI information element, proceed to step S4, otherwise jump to step S5.

[0105] S4: Parse the information element, obtain the information element identifier, authentication type, key negotiation mechanism and encryption algorithm carried in the information element, and confirm the security mechanism to be adopted subsequently.

[0106] S5: Respond to the management frame. When the management frame processed this time needs to be responded to, respond to the management frame according to the security association establishment process to advance the security association establishment process.

[0107] S6: State transition, calling the state setting interface in wpa_supplicant or hostapd, and performing state transition according to the current management frame processing state.

[0108] The processing logic of the WAI protocol frame monitoring is:

[0109] S1: Create a socket. When the program is initialized, a socket for receiving data is created. The socket is detected by combining the select mechanism provided by the original software architecture of wpa_supplicant or hostapd to monitor the wai protocol frame reporting event.

[0110] S2: Register a callback function for the socket created in step S1. When the socket event occurs, this callback function will be called. The callback function is used to preliminarily process the monitored wai protocol frame.

[0111] S3: The callback function in step S2 parses the wai protocol frame subtype field, and determines whether the wai protocol frame monitored this time is expected to be received in the current state according to the current WAPI state machine state. If so, the wai protocol frame processing function contained in the corresponding different key negotiation modules is called according to the wai protocol frame subtype; if not, the wai protocol frame is discarded.

[0112] The processing logic of the key negotiation module is:

[0113] S1: The multiple key negotiation processing functions included in the key negotiation module will be called after the WAI protocol frame monitoring module monitors the management frame of the corresponding status.

[0114] S2: According to the WAPI protocol requirements, parse the BKID, challenge value and message authentication code fields in the WAI protocol frame, and call the hmac_sha256 algorithm function interface and sm4-ofb algorithm function interface provided by the cryptographic algorithm module to perform corresponding key derivation, message authentication code calculation and key data encryption operations. If the processing of the current wai protocol frame (such as a unicast key negotiation request frame) requires the issuance of a response frame, go to step S3; if the current wai protocol frame needs to issue a key after processing, but does not need to issue a response frame, jump to step S4;

[0115] S3: According to the requirements of the WAPI protocol, the challenge value obtained during the current wai protocol processing and the message authentication code calculated during this processing are used to form the wai protocol frame to be sent, and the data frame sending interface provided by the driver is called to send the wai protocol response frame.

[0116] S4: According to the current WAPI state machine state, decide to call the key delivery interface provided by the driver to deliver the unicast session key or the multicast / inter-station session key.

[0117] S5: Adjust the WAPI state machine state according to the current WAI protocol frame processing result to advance the WAPI state machine process.

[0118] When applied to ASUE, the management frame processing module is used to issue a probe request, parse the WAPI information element in the received probe response, issue a link verification request after verification, parse the received link verification response, issue an association request carrying the WAPI information element after verification, parse the received association response frame, and set the WAPI status on the ASUE side to the ASSOCOK status after verification.

[0119] ASUE actively scans for access points (AP / AE) that support WAPI by sending a probe request; parses the WAPI information element (IE) in the probe response returned by the AP to verify the AP's WAPI capability statement;

[0120] After verification, a link verification request is initiated, carrying the ASUE digital certificate;

[0121] Parse the link authentication response from the AP, verify the validity of the AE certificate, and then construct an association request containing the WAPI security policy.

[0122] After receiving the association response, the AE certificate is verified. If passed, the WAPI state machine on the ASUE side is updated to the ASSOCOK state, indicating that the security association is established.

[0123] Through the standardized management frame interaction process, the two-way authentication and association legitimacy of ASUE and AE are ensured, laying the foundation for subsequent key negotiation.

[0124] When applied to the AE, the management frame module is used to parse the received probe request, issue a probe response carrying the WAPI information element after verification, parse the received link verification request, issue a link verification response after verification, parse the received association request carrying the WAPI information element, issue an association response after verification and set the WAPI state on the AE side to the ASSOCOK state;

[0125] Continuously monitor the management frame channel, and after receiving the probe request from the ASUE, construct a probe response containing the WAPI capability statement;

[0126] Parse the certificate chain in the link verification request of ASUE and verify its signature, validity period and revocation status (CRL);

[0127] Generate a link verification response containing the AE certificate to complete the one-way authentication of the ASUE to the AE;

[0128] When processing the association request of ASUE, two-way certificate authentication is performed (ASUE and AE mutually verify the certificate). After passing, an association response is returned and the state machine on the AE side is updated to ASSOCOK.

[0129] Through strict certificate verification and two-way authentication mechanism, illegal devices are prevented from accessing and the authenticity of network entity identities is ensured.

[0130] The WAPI state machine on the ASUE and AE side is used to manage the negotiation state between the ASUE and AE in the key negotiation process, the ASSOCOK state is one of the negotiation states, and the negotiation state between the ASUE and AE will be used as one of the judgment conditions after the key negotiation module receives the WAI protocol frame;

[0131] The WAPI state machines on both the ASUE and AE sides are used to synchronize the progress of the key negotiation process. The ASSOCOK state indicates that the security association has been established and the key negotiation phase is allowed to begin.

[0132] When processing WAI protocol frames, the key negotiation module needs to check whether the current state is ASSOCOK to avoid triggering key exchange when the association is not completed.

[0133] The timing logic of the negotiation process is managed by the state machine to ensure the order and consistency of protocol execution and avoid security vulnerabilities caused by state confusion.

[0134] The cryptographic algorithm module includes an HMAC-SHA256 algorithm and an SM4-OFB algorithm. The HMAC-SHA256 algorithm is used for the key derivation and message authentication code calculation operations, and the SM4-OFB algorithm is used for encryption and decryption of the multicast key data field during the key negotiation process.

[0135] HMAC-SHA256 algorithm: used for key derivation (such as generating session keys from master keys) and message authentication code (MAC) calculation to ensure data integrity and source authenticity;

[0136] SM4-OFB algorithm: It uses the output feedback (OFB) mode of the national secret SM4 algorithm to encrypt the multicast key container and realize the secure distribution of multicast keys.

[0137] The national encryption algorithm is used to meet the security requirements of the WAPI standard, and the algorithm implementation is optimized (such as OFB mode to reduce padding overhead) to improve encryption and decryption efficiency.

[0138] The management frame processing module extracts management frames from the original modules of Wpa_supplicant and hostapd software for establishing security associations, and provides a management frame processing result interface for the original modules of the software to promote the operation of the original state machines of wpa_supplicant and hostapd.

[0139] The management frame processing module extracts WAPI-related frames from the original management frame processing flow of wpa_supplicant (client) and hostapd (AP), and independently completes parsing, verification and response generation;

[0140] Provides a processing result interface (such as association success / failure status) for the original software, and drives the original state machine (such as wpa_sm or hostapd state machine) to continue executing subsequent processes.

[0141] Through modular design, seamless compatibility with existing Wi-Fi protocol stacks is achieved, reducing invasive modifications to the original code and reducing integration complexity.

[0142] After the WAPI state machine runs to the NEGOATITIONOK state, the original interface of wpa_supplicant and hostapd software is called to set the original key negotiation state of wpa_supplicant and hostapd to COMPLETED, which is used to indicate that the key negotiation process is completed, ASUE and AE have successfully established a secure connection, and the subsequent data communication process based on SM4 algorithm encryption and decryption can be carried out.

[0143] When the WAPI state machine enters the NEGOTIATIONOK state (key negotiation completed), the original interface such as wpa_sm_set_key is called to mark the key negotiation state of wpa_supplicant or hostapd as COMPLETED;

[0144] The driver layer is triggered to load the unicast / multicast key generated by negotiation, and the encryption / decryption function of the data frame using the SM4 algorithm is activated.

[0145] Through state synchronization, the key management consistency of the WAPI protocol stack and the original Wi-Fi protocol stack is ensured to achieve seamless connection of the secure communication process.

[0146] The key negotiation module sets a timeout of 10 seconds for the key negotiation process. When the WAPI state machine state is not updated within 10 seconds, the WAPI state machine state will be returned to the NOASSOC state, and the management frame processing module will be notified to send a de-authentication frame to cancel the security association state between ASUE and AE.

[0147] Timeout setting: Set a 10-second timeout threshold for the key negotiation process. If the state machine is not updated within 10 seconds (for example, no legal WAI protocol frame is received), the negotiation is considered to have failed.

[0148] State rollback: reset the state machine to NOASSOC (unassociated state) and notify the management frame processing module to send a de-authentication frame to forcibly terminate the current security association.

[0149] Prevent negotiation deadlocks caused by network anomalies or attacks and avoid long-term occupation of resources.

[0150] The present invention also discloses a method for implementing the Wi-Fi chip WAPI protocol based on static library integration, comprising the following steps:

[0151] It includes management frame processing module, WAI protocol frame monitoring module, key negotiation module and cryptographic algorithm module;

[0152] S1: Start the Wpa_supplicant / Hostapd software, and the management frame processing module executes differentiated processes according to the terminal role:

[0153] a) When acting as ASUE:

[0154] Actively send a probe request frame to scan AP;

[0155] Parse the WAPI IE information in the probe response frame returned by the AP;

[0156] Verify the validity of the certificate revocation list (CRL);

[0157] Send a link verification request carrying a digital certificate;

[0158] Parse the link verification response returned by AE to complete one-way authentication;

[0159] Construct an association request frame carrying a WAPI security policy;

[0160] After receiving the association response frame, verify the validity of the AE certificate;

[0161] b) When acting as an AE:

[0162] Continuously monitor the management frame channel;

[0163] After receiving the ASUE probe request, construct a probe response containing a WAPI capability statement;

[0164] Parse the ASUE certificate chain in the link verification request;

[0165] Verify certificate signature and validity period;

[0166] Generate a link verification response including the AE certificate;

[0167] Perform two-way certificate authentication when processing association requests;

[0168] S2: Key negotiation is triggered after the security association is established:

[0169] a) The WAI monitoring module enables the BPF filter to capture WAI protocol frames of specific Ethernet types;

[0170] b) Perform integrity check on received frames:

[0171] Verify MAC address matching;

[0172] Check protocol version compatibility;

[0173] Check that the frame length complies with the protocol specification;

[0174] c) submitting the verified frame body to the key negotiation queue;

[0175] S3: Key negotiation state machine driving process:

[0176] a) Parse WAI frame type (authentication activation / certificate authentication / key negotiation);

[0177] b) Call the cryptographic algorithm module to execute:

[0178] The session key is derived using the HMAC-SHA256 encryption algorithm;

[0179] Encrypted multicast key container based on SM4-OFB;

[0180] Generate a message authentication code MTK;

[0181] c) Update the status flag according to the protocol timing:

[0182] Unicast key negotiation;

[0183] Multicast key distribution;

[0184] d) Start the 10-second negotiation timer:

[0185] Timeout triggers state rollback;

[0186] Sending a deauthentication frame generated by a management frame processing module;

[0187] Clearing temporary session key material;

[0188] S4: Key installation and synchronization:

[0189] a) When reaching NEGOTIATION_OK state:

[0190] Extract the USK / MSK key material generated through negotiation;

[0191] Call wpa_sm_set_key interface to inject driver key ring; update supplicant PTK / GTK status to VALID; b) synchronize key version numbers on both ends of AP / STA;

[0192] c) Activate SM4-CBC data encryption strategy;

[0193] S5: Data plane encryption and decryption processing:

[0194] a) The driver layer selects the encryption engine based on the key index: Hardware mode: configure the chip WAPI coprocessor;

[0195] Software mode: call kernel CryptoAPI;

[0196] b) Implement SM4 block encryption on data frames;

[0197] c) Maintain the key update counter and trigger periodic re-negotiation: Supplement the exception handling process:

[0198] E1: When certificate verification fails:

[0199] Generate system security event logs;

[0200] Send management frame to disassociate;

[0201] Reset the WAPI state machine to the initial state;

[0202] E2: When MAC verification fails:

[0203] Discard abnormal protocol frames;

[0204] Trigger the anti-replay attack counter;

[0205] The accumulated errors exceed the threshold and trigger temporary blocking.

[0206] The above embodiments may be implemented in whole or in part by software, hardware, firmware or any other combination thereof. When implemented using software, the above embodiments may be implemented in whole or in part in the form of a computer program product. A person of ordinary skill in the art may appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein may be implemented in electronic hardware, or in a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution.

Claims

1. A Wi-Fi chip WAPI protocol implementation system based on static library integration, including a management frame processing module, a WAI protocol frame monitoring module, a key negotiation module and a cryptographic algorithm module, characterized in that: The management frame processing module is used to receive, parse, verify, generate and send to 802.11 management frames, ensure the integrity and legitimacy of the management frames, and complete the security association establishment process; The WAI protocol frame monitoring module is used to monitor the WAI protocol frames in the key negotiation process, perform preliminary verification on the protocol frames, and hand over the verified WAI protocol frames to the key negotiation module for processing; The key negotiation module is used to receive the WAI protocol frame reported by the WAI protocol frame monitoring module, authenticate the ASUE and AE in the WAPI system based on the WAI protocol frame, and perform unicast and multicast / inter-station key negotiation; The cryptographic algorithm module is used to provide a cryptographic algorithm interface to the key negotiation module to complete operations such as key derivation and message authentication code calculation involved in the key negotiation process; The management frame processing module, WAI protocol frame monitoring module, key negotiation module and cryptographic algorithm module are encapsulated as a static library and linked to the original software architecture of Wpa_suppl icant and Hostapd.

2. The Wi-Fi chip WAPI protocol implementation system based on static library integration according to claim 1, characterized in that: When applied to ASUE, the management frame processing module is used to issue a probe request, parse the WAPI information element in the received probe response, issue a link verification request after verification, parse the received link verification response, issue an association request carrying the WAPI information element after verification, parse the received association response frame, and set the WAPI status on the ASUE side to the ASSOCOK status after verification.

3. The Wi-Fi chip WAPI protocol implementation system based on static library integration according to claim 2, characterized in that: When applied to AE, the management frame module is used to parse the received probe request, issue a probe response carrying the WAPI information element after verification, parse the received link verification request, issue a link verification response after verification, parse the received association request carrying the WAPI information element, issue an association response after verification and set the WAPI state on the AE side to the ASSOCOK state.

4. The Wi-Fi chip WAPI protocol implementation system based on static library integration according to claim 2, characterized in that: The WAPI state machine on the ASUE and AE side is used to manage the negotiation state of the ASUE and AE in the key negotiation process. The ASSOCOK state is one of the negotiation states. The negotiation state of the ASUE and AE will be used as one of the judgment conditions after the key negotiation module receives the WAI protocol frame.

5. The Wi-Fi chip WAPI protocol implementation system based on static library integration according to claim 1, characterized in that: The cryptographic algorithm module includes an HMAC-SHA256 algorithm and an SM4-OFB algorithm. The HMAC-SHA256 algorithm is used for the key derivation and message authentication code calculation operations, and the SM4-OFB algorithm is used for encryption and decryption of the multicast key data field during the key negotiation process.

6. The Wi-Fi chip WAPI protocol implementation system based on static library integration according to claim 1, characterized in that: The management frame processing module extracts management frames from the original modules of Wpa_suppl icant and hostapd software for establishing security associations, and provides a management frame processing result interface for the original modules of the software to promote the operation of the original state machines of wpa_suppl icant and hostapd.

7. The Wi-Fi chip WAPI protocol implementation system based on static library integration according to claim 1, characterized in that: After the WAPI state machine runs to the NEGOATITIONOK state, it calls the original interface of wpa_suppl icant and hostapd software, and sets the original key negotiation state of wpa_suppl icant and hostapd to COMPLETED, which is used to indicate that the key negotiation process is completed, ASUE and AE have successfully established a secure connection, and can carry out the subsequent data communication process based on SM4 algorithm encryption and decryption.

8. The Wi-Fi chip WAPI protocol implementation system based on static library integration according to claim 2, characterized in that: The key negotiation module sets a timeout of 10 seconds for the key negotiation process. When the WAPI state machine state is not updated within 10 seconds, the WAPI state machine state will be returned to the NOASSOC state, and the management frame processing module will be notified to send an authentication frame to cancel the security association state between ASUE and AE.

9. A method for implementing the WAPI protocol of a Wi-Fi chip based on static library integration, using the WAPI protocol implementation system of a Wi-Fi chip based on static library integration according to any one of claims 1 to 8, characterized in that: The following steps are involved: S1: Start the Wpa_suppl icant / Hostapd software, and the management frame processing module executes differentiated processes according to the terminal role: a) When acting as ASUE: Actively send a probe request frame to scan AP; Parse the WAPI IE information in the probe response frame returned by the AP; Verify the validity of the certificate revocation list (CRL); Send a link verification request carrying a digital certificate; Parse the link verification response returned by AE to complete one-way authentication; Construct an association request frame carrying the WAPI security policy; After receiving the association response frame, verify the validity of the AE certificate; b) When acting as an AE: Continuously monitor the management frame channel; After receiving the ASUE probe request, construct a probe response containing a WAPI capability statement; Parse the ASUE certificate chain in the link verification request; Verify certificate signature and validity period; Generate a link verification response including the AE certificate; Perform two-way certificate authentication when processing association requests; S2: Key negotiation is triggered after the security association is established: a) The WAI monitoring module enables the BPF filter to capture WAI protocol frames of specific Ethernet types; b) Perform integrity check on received frames: Verify MAC address matching; Check protocol version compatibility; Check that the frame length complies with the protocol specification; c) submitting the verified frame body to the key negotiation queue; S3: Key negotiation state machine driving process: a) Parse WAI frame type (authentication activation / certificate authentication / key negotiation); b) Call the cryptographic algorithm module to execute: The session key is derived using the HMAC-SHA256 encryption algorithm; Encrypted multicast key container based on SM4-OFB; Generate a message authentication code MTK; c) Update the status flag according to the protocol timing: Unicast key negotiation; Multicast key distribution; d) Start the 10-second negotiation timer: Timeout triggers state rollback; Sending a deauthentication frame generated by a management frame processing module; Clearing temporary session key material; S4: Key installation and synchronization: a) When reaching NEGOTIATION_OK state: Extract the USK / MSK key material generated through negotiation; Call wpa_sm_set_key interface to inject driver key ring; update supplicant's PTK / GTK status to VALID; b) Synchronize the key version numbers of both AP and STA; c) Activate SM4-CBC data encryption strategy; S5: Data plane encryption and decryption processing: a) The driver layer selects the encryption engine based on the key index: Hardware mode: configure the chip WAPI coprocessor; Software mode: calling the kernel; b) Implement SM4 block encryption on data frames; c) Maintain the key update counter and trigger periodic re-negotiation: supplement the exception handling process; E1: When certificate verification fails: Generate system security event logs; Send management frame to disassociate; Reset the WAPI state machine to the initial state; E2: When MAC verification fails: Discard abnormal protocol frames; Trigger the anti-replay attack counter; The accumulated errors exceed the threshold and trigger temporary blocking.

Images