Terminal authentication method, device, computer equipment and storage medium

Abstract

The embodiment of the present application discloses a terminal authentication method, device, computer equipment and storage medium, the method comprising: the authentication terminal receives an authentication request from a requesting terminal; the authentication terminal determines a target key-value pair from multiple groups of key-value pairs based on a first access control address, and obtains at least one first pre-shared key corresponding to the first access control address from the target key-value pair; the authentication terminal generates each second message integrity check code corresponding to each first pre-shared key; the authentication terminal authenticates the requesting terminal based on the first message integrity check code and each second message integrity check code. By adopting the embodiment of the present application, all first pre-shared keys that the requesting terminal has connected to can be quickly found based on the first access control address, thereby improving the authentication efficiency and providing a high user experience.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a terminal authentication method, apparatus, computer equipment and storage medium. Background Art

[0002] Currently, when users use wireless fidelity (WiFi) to connect to the Internet, they usually select the WiFi name to be connected and enter the password to complete the connection. Figure 1 As shown, the authenticator (also called AP device) can authenticate the user based on the four-way handshake of the extensible authentication protocol over LAN (EAPOL) of the local area network. Generally speaking, when the service set identifier (SSID) adds a pre-shared key (PSK) that has been connected, the authenticator can verify the user's PSK according to the calculated pairwise master key (PMK) to complete the authentication. After the subsequent authentication is successful, the user can access the WiFi to surf the Internet. However, when an SSID has multiple private pre-shared key (PPSK) lists (the PPSK list here can include all PSKs that the SSID has connected to), the authenticator needs to traverse all private pre-shared key lists to authenticate the user, which results in low authentication efficiency and slow speed when the number of users connected is too large, and low user experience. Summary of the invention

[0003] The embodiments of the present application provide a terminal authentication method, apparatus, computer device and storage medium, which can quickly find a first pre-shared key corresponding to a first access control address, thereby improving authentication efficiency and providing a high user experience.

[0004] On the one hand, an embodiment of the present application provides a terminal authentication method, the method comprising:

[0005] The authentication terminal receives an authentication request from the requesting terminal, where the authentication request carries a first access control address and a first message integrity check code of the requesting terminal;

[0006] The authentication terminal determines a target key-value pair from a plurality of groups of key-value pairs based on the first access control address, and obtains at least one first pre-shared key corresponding to the first access control address from the target key-value pair, wherein a group of key-value pairs includes an access control address of a terminal and at least one historical pre-shared key that the terminal has connected to, and the access control address of any terminal is a historical authentication successful address of any terminal;

[0007] The authentication terminal generates second message integrity check codes corresponding to the first pre-shared keys, and one first pre-shared key corresponds to one second message integrity check code;

[0008] The authentication terminal authenticates the requesting terminal based on the first message integrity check code and each second message integrity check code.

[0009] An embodiment of the present application provides a terminal authentication device, the device comprising:

[0010] A receiving module, configured for an authentication terminal to receive an authentication request from a requesting terminal, wherein the authentication request carries a first access control address and a first message integrity check code of the requesting terminal;

[0011] An acquisition module, configured to determine a target key-value pair from a plurality of key-value pairs based on a first access control address of the authentication terminal, and acquire at least one first pre-shared key corresponding to the first access control address from the target key-value pair, wherein a set of key-value pairs includes an access control address of a terminal and at least one historical pre-shared key to which the terminal has been connected, and the access control address of any terminal is a historical authentication successful address of any terminal;

[0012] A first generating module, configured to generate, by an authentication terminal, second message integrity check codes corresponding to first pre-shared keys, wherein one first pre-shared key corresponds to one second message integrity check code;

[0013] The first authentication module is used for authenticating the requesting terminal based on the first message integrity check code and each second message integrity check code.

[0014] The authentication request also carries a first random number generated by the requesting terminal;

[0015] The first generation module includes:

[0016] A first determining unit, configured to determine, by the authentication terminal, a target pairwise master key corresponding to any first pre-shared key based on any first pre-shared key and a service set identifier, wherein the service set identifier is an identifier of a service set to which the requesting terminal requests connection;

[0017] A second determining unit, configured for the authentication terminal to determine a target pairwise transmission key corresponding to any first pre-shared key based on the target pairwise master key, the first random number, the second random number, the first access control address, and the second access control address of the authentication terminal;

[0018] The generating unit is used for encrypting the target paired transmission key by the authentication terminal, generating a second message integrity check code corresponding to any first pre-shared key to obtain each second message integrity check code corresponding to each first pre-shared key.

[0019] Wherein, the first authentication module includes:

[0020] A query determination unit, configured to determine that the requesting terminal has passed the verification if the authentication terminal has found a target message integrity verification code that is the same as the first message integrity verification code in each second message integrity verification code;

[0021] A sending unit, configured for the authentication terminal to send a verification request to the requesting terminal, wherein the verification request carries a target message integrity verification code;

[0022] The authentication unit is used to determine that the authentication of the requesting terminal is successful when receiving the authentication confirmation information sent by the requesting terminal. The authentication confirmation information is the information sent by the requesting terminal when the target message integrity check code is the same as the first message integrity check code.

[0023] The above device further comprises:

[0024] A second generation module is used for traversing each historical pre-shared key in each group of key-value pairs and generating each third message integrity check code corresponding to each historical pre-shared key if the authentication terminal fails to query a target message integrity check code identical to the first message integrity check code in each second message integrity check code, wherein one historical pre-shared key corresponds to one third message integrity check code;

[0025] A query determination module, configured to determine that the requesting terminal has passed the verification if the authentication terminal has found a target message integrity verification code that is the same as the first message integrity verification code in each third message integrity verification code;

[0026] The second authentication module is used to determine that the requesting terminal authentication fails if the authentication terminal fails to find a target message integrity check code that is the same as the first message integrity check code in each third message integrity check code.

[0027] The above device further comprises:

[0028] A first determination module, configured to determine, by the authentication terminal, a target pre-shared key for generating a target message integrity check code from at least one first pre-shared key;

[0029] A second determination module, configured for the authentication terminal to determine an access control address list corresponding to a target pre-shared key;

[0030] The third determination module is used for the authentication terminal to determine the terminal connection number threshold, and to deny access to the requesting terminal when the number of access control addresses in the access control address list is equal to the terminal connection number threshold.

[0031] The above device further comprises:

[0032] An adding module is used to allow the authentication terminal to access the requesting terminal when the number of access control addresses is less than the terminal connection number threshold, and to add the first access control address to the access control address list when the requesting terminal is successfully authenticated and the access control address list does not contain the first access control address. The first access control address is a historical authentication successful address of the requesting terminal.

[0033] The above device further comprises:

[0034] A storage module, used for authenticating the terminal to store the connection time of each historical pre-shared key in each group of key-value pairs;

[0035] A key deletion module is used to authenticate the terminal to traverse each group of key-value pairs, determine the connection time difference of each historical pre-shared key based on the connection time of each historical pre-shared key in any group of key-value pairs and the current time, determine from each historical pre-shared key a second pre-shared key whose connection time difference is greater than a connection time threshold, and delete the second pre-shared key from any group of key-value pairs.

[0036] On one hand, the present application provides a computer device, including: a processor, a memory, and a network interface;

[0037] The processor is connected to a memory and a network interface, wherein the network interface is used to provide a data communication function, the memory is used to store a computer program, and the processor is used to call the computer program to execute the method in the above aspect of the embodiment of the present application.

[0038] According to one aspect of the present application, a computer program product or a computer program is provided, the computer program product or the computer program includes a computer instruction, the computer instruction is stored in a computer-readable storage medium. A processor of a computer device reads the computer instruction from the computer-readable storage medium, and the processor executes the computer instruction, so that the computer device executes the terminal authentication method provided in various optional modes of the above-mentioned first aspect.

[0039] In an embodiment of the present application, after receiving the authentication request from the requesting terminal, the authentication terminal can determine the target key-value pair from the pre-stored multiple key-value pairs according to the first access control address of the requesting terminal, and obtain at least one first pre-shared key corresponding to the first access control address from the target key-value pair, so that all the first pre-shared keys that the requesting terminal has connected to can be quickly found based on the first access control address, so as to efficiently authenticate the requesting terminal. Furthermore, the authentication terminal can generate each second message integrity check code corresponding to each first pre-shared key, and authenticate the requesting terminal based on the first message integrity check code and each second message integrity check code, so that each second message integrity check code can be quickly generated to authenticate the requesting terminal, thereby improving the authentication efficiency and providing a high user experience. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0041] Figure 1 It is a flow chart of the process of an authenticator authenticating a user;

[0042] Figure 2 It is a structural diagram of a network architecture provided by an embodiment of the present application;

[0043] Figure 3 This is a schematic diagram of a scenario for requesting terminal identity authentication provided by an embodiment of the present application;

[0044] Figure 4 It is a flow chart of a terminal authentication method provided in an embodiment of the present application;

[0045] Figure 5 It is a schematic diagram of an authentication terminal performing identity authentication on a requesting terminal provided by an embodiment of the present application;

[0046] Figure 6 This is an interactive diagram of an open system authentication provided by an embodiment of the present application;

[0047] Figure 7 This is a schematic diagram of an interaction of WPAPSK / WPAPSK2 authentication provided in an embodiment of the present application;

[0048] Figure 8 This is a schematic diagram of an interface for an authentication terminal to authenticate a requesting terminal provided by an embodiment of the present application;

[0049] Fig. 9This is a schematic diagram of an interaction in which an authentication terminal performs authentication on a requesting terminal, provided in an embodiment of the present application;

[0050] Fig.10 It is a flow chart of a terminal authentication method provided in an embodiment of the present application;

[0051] Fig.11 This is a schematic diagram of an interface for determining the maximum number of terminal connections provided by an embodiment of the present application;

[0052] Fig.12 It is a schematic diagram of a hash storage container storing key-value pairs provided by an embodiment of the present application;

[0053] Fig.13 It is a structural diagram of a terminal authentication device provided in an embodiment of the present application;

[0054] Fig.14 It is a structural diagram of a computer device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0055] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0056] See also Figure 2 , Figure 2 Schematic diagram of a network architecture provided by an embodiment of the present application. Figure 2 As shown, the network architecture may include an authentication terminal 10 and a request terminal cluster, and the request terminal cluster may include multiple request terminals, such as Figure 2 As shown, it may specifically include a request terminal 100a, a request terminal 100b, a request terminal 100c, ..., a request terminal 100n.

[0057] Among them, the authentication terminal 10 can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content delivery networks (CDNs), and big data and artificial intelligence platforms. Any user terminal in the user terminal cluster may include but is not limited to cameras, attendance machines, monitoring instruments, tablet devices, desktop computers, laptops, mobile phones or any other terminal devices that can complete information interaction. Each request terminal in the request terminal cluster may include but is not limited to: smart phones, tablet computers, laptops, desktop computers, smart speakers, smart watches and other smart terminals.

[0058] It can be understood that the computer device in the embodiment of the present application may be a physical terminal having a function of authenticating the requesting terminal, and the physical terminal may be Figure 2 The authentication terminal 10 (such as a server) shown may also be a user terminal, which is not limited here.

[0059] like Figure 2 As shown, the request terminal 100a, the request terminal 100b, the request terminal 100c, ..., the request terminal 100n can respectively establish a network connection with the authentication terminal 10, so that each request terminal can exchange data with the authentication terminal 10 through the network connection. Assuming that the authentication terminal 10 is a background server of a wireless network, the authentication terminal 10 can authenticate the request terminal 100a upon receiving an authentication request from any request terminal (such as the request terminal 100a) in the request terminal cluster, and allow the request terminal 100a to access the wireless network after the authentication is successful.

[0060] The application scenario of the embodiments of the present application may be a terminal authentication scenario with multiple pre-shared keys (such as an enterprise office scenario or a user accessing a home wireless network scenario). The application scenario of the embodiments of the present application may also be other application scenarios, which are not specifically limited here.

[0061] For further understanding, please see Figure 3 , Figure 3 1 is a schematic diagram of a scenario for requesting terminal identity authentication provided by an embodiment of the present application. For the convenience of description, the following is an example of a process in which an authentication terminal (such as authentication terminal 10) stores multiple groups of key-value pairs (such as 3 groups of key-value pairs) corresponding to multiple terminals (such as terminal 1 to terminal 3). The authentication terminal 10 here can be a background server of a wireless network 30. Figure 3As shown, the authentication terminal 10 can use the historical authentication success address 1 of terminal 1 as the hash key of the key-value pair, generate a historical pre-shared key table 1 according to the historical pre-shared key that terminal 1 has connected to, and use the pre-shared key table 1 as the value of key-value pair 1 to generate key-value pair 1. Among them, the historical pre-shared key table 1 can contain one or more historical pre-shared keys, for example, it can specifically contain 3 historical pre-shared keys (such as PSK1, PSK2 and PSK3). In this embodiment of the application, the pre-shared keys that the terminals that have successfully authenticated in the past have been connected to can be collectively referred to as historical pre-shared keys. In this embodiment of the application, the access control addresses of the terminals that have successfully authenticated in the past can also be collectively referred to as historical authentication success addresses. The authentication terminal 10 can use the historical authentication success address 2 of terminal 2 as the hash key of the key-value pair, generate a historical pre-shared key table 2 according to the historical pre-shared keys that terminal 2 has connected to, and use the pre-shared key table 2 as the value of key-value pair 2 to generate key-value pair 2. The historical pre-shared key table 2 may include one or more historical pre-shared keys, for example, it may specifically include 5 historical pre-shared keys (such as PSK4, PSK5, PSK6, PSK7 and PSK8). The authentication terminal 10 may use the historical authentication success address 3 of the terminal 3 as the hash key of the key-value pair, generate the historical pre-shared key table 3 according to the historical pre-shared keys that the terminal 3 has connected to, and use the pre-shared key table 3 as the value of the key-value pair 3 to generate the key-value pair 3. The historical pre-shared key table 3 may include one or more historical pre-shared keys, for example, it may specifically include 1 historical pre-shared key (such as PSK0).

[0062] After receiving the authentication request sent by the requesting terminal 20, the authentication terminal 10 can determine the target key-value pair (such as key-value pair 1) from the above-mentioned key-value pair 1, key-value pair 2 and key-value pair 3 based on the first access control address of the requesting terminal 20 in the authentication request, and obtain at least one first pre-shared key (such as PSK1, PSK2 and PSK3) corresponding to the first access control address from key-value pair 1. Among them, the authentication request can carry the first message integrity code (message integrity code, MIC) generated by the requesting terminal 20. In the embodiment of the present application, the message integrity code generated by the requesting terminal can be collectively referred to as the first message integrity code. Further, the authentication terminal 10 can generate each second message integrity code corresponding to each first pre-shared key in PSK1, PSK2 and PSK3, for example, PSK1 corresponds to the second message integrity code 1, PSK2 corresponds to the second message integrity code 2, and PSK3 corresponds to the second message integrity code 3. In the embodiment of the present application, the message integrity code generated based on the first pre-shared key can be collectively referred to as the second message integrity code. At this time, the authentication terminal can authenticate the requesting terminal 20 based on the second message integrity check code 1, the second message integrity check code 2, the second message integrity check code 3 and the first message integrity check code. After the requesting terminal 20 succeeds, the authentication terminal 10 can allow the requesting terminal 20 to connect to the wireless network 30 for communication.

[0063] It can be seen from this that the authentication terminal can quickly find all the first pre-shared keys to which the requesting terminal has connected from multiple groups of key-value pairs based on the first access control address, so as to quickly generate each second message integrity check code to authenticate the requesting terminal, thereby improving the authentication efficiency and providing a high user experience.

[0064] The specific implementation method of the computer device to authenticate the request terminal can be found in the following Figure 4-Figure 12 The corresponding embodiment.

[0065] For further information, see Figure 4 , Figure 4 This is a flow chart of a terminal authentication method provided by an embodiment of the present application. This application can use a computer device as an authentication terminal (such as the above Figure 3 For example, the authentication terminal 10 in Figure 4 The method shown is applied to an authentication terminal and may include the following steps S101 to S104:

[0066] Step S101: an authentication terminal receives an authentication request from a requesting terminal, where the authentication request carries a first access control address and a first message integrity check code of the requesting terminal.

[0067] In some feasible implementations, the authentication terminal performs identity authentication on the requesting terminal when the requesting terminal requests to access a service set (such as a home wireless network or an enterprise office network). Figure 5 This section provides an example of the identity authentication process for the requesting terminal. Figure 5 , Figure 5 FIG. 1 is a schematic diagram of an authentication terminal performing identity authentication on a requesting terminal provided in an embodiment of the present application. Figure 5 As shown, the process of the authentication terminal 10 authenticating the request terminal 20 may include a scanning phase, an authentication phase, and an association phase. After the association phase, the authentication terminal 10 and the request terminal 20 may start communication. In the scanning phase, the request terminal 20 may search for WiFi hotspots through different scanning methods, and the scanning methods may include active scanning methods and passive scanning methods. In the active scanning method, the request terminal 20 may send a probe request frame on each channel and obtain WiFi hotspot information from the received probe response frame. In the passive scanning method, the request terminal 20 may listen to the beacon frame (here, the beacon frame may contain wireless network information) sent periodically by the authentication terminal 10, and obtain WiFi hotspot information through the wireless network information contained in the beacon frame. Among them, the non-hidden type WiFi hotspot contains a service set identifier, and the hidden type WiFi hotspot does not contain a service set identifier. When the request terminal 20 scans multiple WiFi hotspots with the same service set identifier as the above service set, a WiFi hotspot with the strongest signal strength is determined from the multiple WiFi hotspots, and the authentication phase is entered. The background server corresponding to the WiFi hotspot with the strongest signal strength here can be the authentication terminal 10 in the embodiment of the present application.

[0068] In some feasible implementations, during the authentication phase, the authentication terminal may authenticate the requesting terminal based on different authentication methods. The authentication methods here may include open-system authentication, shared-key authentication, WiFi protected access pre-shared key / WPA2-PSK authentication, and 802.1X extensible authentication protocol (EAP) authentication. Among them, the shared key authentication method refers to the authentication terminal determining whether the identity of the requesting terminal is legal by judging whether the requesting terminal has the same key. The encryption method of the key here is wired equivalent privacy (WEP), which can prevent illegal requesting terminals from eavesdropping or intruding into the wireless network (i.e., WiFi hotspot) corresponding to the authentication terminal. For the convenience of description, the following will be combined with Figure 6 For an example of open system authentication, see Figure 6 , Figure 6 Schematic diagram of an open system authentication interaction provided by an embodiment of the present application. Figure 6 As shown, since the open system authentication mode is the default authentication mode of the Institute of Electrical and Electronics Engineering (IEEE) 802.11, a direct connection can be made without a password. Therefore, after receiving the authentication request message including the identity statement sent by the request terminal 20, the authentication terminal 10 can send the authentication result to the request terminal 20. For example, when the authentication result indicates that the identity authentication response is successful, it indicates that the authentication terminal 10 and the request terminal 20 have successfully authenticated each other.

[0069] For the convenience of description, the following will be combined Figure 7 For an example of WPAPSK / WPAPSK2 authentication, see Figure 7 , Figure 7 : is a schematic diagram of the interaction of WPAPSK / WPAPSK2 authentication provided by the embodiment of the present application. Figure 7As shown, the authentication terminal 10 may periodically send a beacon frame to the requesting terminal 20 so that the requesting terminal 20 updates its WiFi hotspot list based on the wireless network information in the beacon frame. The requesting terminal 20 broadcasts a probe request frame on each channel (such as channels 1 to 13), and the authentication terminal 10 of each channel may send a probe response frame to the requesting terminal 20, where the probe response frame may include a service set identifier and robust security network (RSN) information. The requesting terminal 20 may determine the WiFi hotspot with the strongest signal strength from the probe response frame of the authentication terminal 10 of each channel, and send an authentication package to the authentication terminal 10 corresponding to the WiFi hotspot with the strongest signal strength. The authentication package here may include an authentication request message, and there are two authentication types of the authentication package, 0 for open and 1 for shared. In the WPAPSK / WPAPSK2 authentication mode, the authentication type of the authentication package is open. After receiving the authentication package, the authentication terminal 10 may send plaintext data to the requesting terminal 20 based on the authentication request message. After receiving the plaintext data, the requesting terminal 20 may encrypt the plaintext data based on the key 1 preset by the requesting terminal 20 to obtain the ciphertext data, and send the ciphertext data to the authentication terminal 10. The key 1 here may be the password set when the requesting terminal 20 accesses the above-mentioned WiFi hotspot with the strongest signal strength. After receiving the ciphertext data, the authentication terminal 10 may decrypt the ciphertext data based on the key 2 preset by the authentication terminal 10 to obtain the decrypted data. The key 2 here may be the password stored by the authentication terminal 10 when the requesting terminal 20 connects to the above-mentioned WiFi hotspot with the strongest signal strength. When the decrypted data and the plaintext data are the same, the authentication terminal 10 may send an authentication packet indicating a successful identity authentication response to the requesting terminal 20.

[0070] In some feasible implementations, during the association phase, the authentication terminal may receive an association request packet sent by the requesting terminal, and send an association response packet to the requesting terminal based on the association request packet. At this time, the authentication terminal may authenticate the requesting terminal based on the EAPOL four-way handshake. The authentication terminal may generate a second random number, send the second random number to the requesting terminal, and receive an authentication request sent by the requesting terminal for the second random number. Among them, the authentication request may carry a first access control address (media access control address, which may be referred to as MAC, or media access control address) of the requesting terminal, a first random number, and a first message integrity check code. Here, the first random number is a random number generated by the requesting terminal, the first message integrity check code is a check code obtained by encrypting a pairwise transient key (PTK) by the requesting terminal based on an encryption algorithm, and the pairwise transmission key is a pairwise master key calculated by the requesting terminal based on the service set identifier and the target pre-shared key, and the key is obtained by performing key derivation on the pairwise master key, the first random number, the second random number, the first access control address, and the second access control address of the authentication terminal through a pseudo-random algorithm (PRF). In this embodiment of the present application, the random numbers generated by the requesting terminal may be collectively referred to as first random numbers. In this embodiment of the present application, the random numbers generated by the authentication terminal may be collectively referred to as second random numbers.

[0071] Step S102: The authentication terminal determines a target key-value pair from multiple groups of key-value pairs based on the first access control address, and obtains at least one first pre-shared key corresponding to the first access control address from the target key-value pair.

[0072] In some feasible implementations, the authentication terminal may pre-store multiple groups of key-value pairs corresponding to multiple terminals that have successfully authenticated in the past, wherein a group of key-value pairs includes the access control address of a terminal and at least one historical pre-shared key that the terminal has connected to, and the access control address of any terminal is the historical authentication successful address of any terminal. Optionally, the authentication terminal may use the historical authentication successful address of any terminal as the hash key of the key-value pair, and the historical pre-shared key that any terminal has connected to as the value of the key-value pair to generate a key-value pair corresponding to any terminal, thereby obtaining multiple groups of key-value pairs corresponding to multiple terminals, and storing the multiple groups of key-value pairs (such as the above-mentioned key-value pairs 1 to key-value pairs 3) in a hash storage container (hash map, such as hash storage container 1). The hash storage container here is a key-value pair type data structure that can achieve a search with a time complexity of 0 (1), so that at least one first pre-shared key corresponding to the first access control address can be quickly found from the hash storage container to authenticate the requesting terminal, thereby improving the authentication efficiency.

[0073] In some feasible implementations, the authentication terminal may determine a target key-value pair from a plurality of key-value pairs pre-stored in a hash storage container based on the first access control address, and obtain at least one first pre-shared key corresponding to the first access control address from the target key-value pair. In the embodiment of the present application, the key-value pair queried based on the first access control address may be referred to as a target key-value pair, and in the embodiment of the present application, the historical pre-shared keys to which the requesting terminal has connected may be collectively referred to as first pre-shared keys. Assuming that the hash storage container is the above-mentioned hash storage container 1, and the first access control address is the same as the above-mentioned historical authentication success address 1, the authentication terminal may determine a target key-value pair (such as key-value pair 1) from key-value pairs 1, key-value pairs 2, and key-value pairs 3 pre-stored in the hash storage container 1 based on the first access control address, and use PSK1, PSK2, and PSK3 in key-value pair 1 as at least one first pre-shared key corresponding to the first access control address.

[0074] Step S103: The authentication terminal generates second message integrity check codes corresponding to the first pre-shared keys.

[0075] In some feasible implementations, the authentication terminal may determine the target pairwise master key corresponding to any first pre-shared key based on any first pre-shared key and the service set identifier. Wherein, the service set identifier is the identifier of the service set to which the requesting terminal requests to connect. At this time, the authentication terminal may determine the target pairwise transmission key corresponding to any first pre-shared key based on the target pairwise master key, the first random number, the second random number, the first access control address, and the second access control address of the authentication terminal. Further, the authentication terminal may encrypt the target pairwise transmission key, generate a second message integrity check code corresponding to any first pre-shared key to obtain each second message integrity check code corresponding to each first pre-shared key. It should be understood that the authentication terminal may determine a key confirmation key (KCK) from the above-mentioned target pairwise transmission key, encrypt the target pairwise transmission key based on the key confirmation key through the advanced encryption standard (AES) algorithm, and generate a second message integrity check code corresponding to any first pre-shared key. Wherein, one first pre-shared key corresponds to one second message integrity check code. For example, the authentication terminal may use the first 128 bits of the target pairwise transmission key as the key confirmation key.

[0076] Step S104: The authentication terminal authenticates the requesting terminal based on the first message integrity check code and each second message integrity check code.

[0077] In some feasible implementations, if the authentication terminal finds a target message integrity check code that is the same as the first message integrity check code in each second message integrity check code, it is determined that the requesting terminal has passed the verification. In the embodiment of the present application, each second message integrity check code or the message integrity check code that is the same as the first message integrity check code in each of the following third message integrity check codes may be collectively referred to as a target message integrity check code. After the requesting terminal passes the verification, the authentication terminal may send a verification request to the requesting terminal, and the verification request may carry the target message integrity check code. Upon receiving the authentication confirmation information sent by the requesting terminal, the authentication terminal may determine that the requesting terminal has been successfully authenticated, and at this time, the authentication terminal may communicate with the requesting terminal. Among them, the authentication confirmation information may be information sent by the requesting terminal when the target message integrity check code is the same as the first message integrity check code.

[0078] In some feasible implementations, if the authentication terminal does not query the target message integrity verification code that is the same as the first message integrity verification code in each second message integrity verification code, it can traverse each historical pre-shared key in each group of key-value pairs, and generate each third message integrity verification code corresponding to each historical pre-shared key. Among them, one historical pre-shared key corresponds to one third message integrity verification code. In the embodiment of the present application, the message integrity verification code generated based on the historical pre-shared key can be collectively referred to as the third message integrity verification code. If the authentication terminal can query the target message integrity verification code that is the same as the first message integrity verification code in each third message integrity verification code, it is determined that the request terminal has passed the verification. After the request terminal passes the verification, the authentication terminal can send a verification request carrying the target message integrity verification code to the request terminal. When receiving the authentication confirmation information sent by the request terminal, the authentication terminal can determine that the request terminal has been successfully authenticated, and add the target pre-shared key to the target key-value pair to update the target key-value pair. On the contrary, if the authentication terminal does not query the target message integrity verification code that is the same as the first message integrity verification code in each third message integrity verification code, it can be determined that the request terminal has failed to authenticate. At this time, the authentication terminal can send authentication failure information to the requesting terminal for display on the user interface, thereby prompting the user to re-authenticate, and the user experience is high.

[0079] For the convenience of description, the following will be combined Figures 8 to 9 This section describes the interactive authentication process between the authenticating terminal and the requesting terminal in the EAPOL four-way handshake. Figure 8 , Figure 8 Schematic diagram of an interface for an authentication terminal to authenticate a requesting terminal provided by an embodiment of the present application. Figure 8As shown in 8a in FIG. 8 , the authentication terminal can obtain four-way handshake information (such as handshake information 1 to handshake information 4), where the data format of handshake information 1 to handshake information 4 is the EAPOL key frame (EAPOL-keyframe) data format. Fig. 9 , Fig. 9 FIG. 1 is a schematic diagram of an interaction between an authentication terminal and a requesting terminal provided in an embodiment of the present application. Fig. 9 As shown, the authentication terminal can generate a second random number (ANonce) and send handshake information 1 to the requesting terminal. Figure 8 As shown in 8b, the handshake information 1 may carry a second random number, and the second random number is a unicast data frame (Unicast). After receiving the handshake information 1, the requesting terminal may calculate the pairwise master key based on the service set identifier and the pre-shared key to which the requesting terminal is connected, generate a first random number (SNonce), and perform key derivation on the pairwise master key, the first random number, the second random number, the first access control address, and the second access control address of the authentication terminal through a pseudo-random algorithm to obtain the pairwise transmission key PTK. At this time, the requesting terminal may determine the key confirmation key from the pairwise transmission key PTK, and encrypt the pairwise transmission key PTK based on the key confirmation key through the advanced encryption standard (AES) algorithm to obtain the first message integrity check code (such as MIC1). For example, the requesting terminal may use the first 128 bits of the pairwise transmission key PTK as the key confirmation key for KCK encryption. After determining the first message integrity check code MIC1, the requesting terminal may send an authentication request (such as handshake information 2) to the authentication terminal. As mentioned above Figure 8 As shown in 8c, the handshake information 2 may carry a first random number and a first message integrity check code (such as MIC1), and the first random number and the first message integrity check code are unicast data frames.

[0080] After receiving the handshake information 2, the authentication terminal can query the target key-value pair (such as key-value pair 1) from the multiple groups of key-value pairs stored in the hash storage container (hash map, such as the above-mentioned hash storage container 1) according to the first access control address, and obtain at least one first pre-shared key (such as PSK1, PSK2 and PSK3) corresponding to the first access control address from the target key-value pair. At this time, the authentication terminal can determine the target pairwise master key (such as target pairwise master key 1, target pairwise master key 2 or target pairwise master key 3) corresponding to any first pre-shared key based on any first pre-shared key (such as PSK1, PSK2 or PSK3) and the service set identifier, and determine the target pairwise transmission key (such as target pairwise transmission key 1, target pairwise transmission key 2 or target pairwise transmission key 3) corresponding to any first pre-shared key based on the target pairwise master key, the first random number, the second random number, the first access control address and the second access control address of the authentication terminal. Among them, PSK1 corresponds to the target pairwise master key 1, PSK2 corresponds to the target pairwise master key 2, PSK3 corresponds to the target pairwise master key 3, PSK1 corresponds to the target pairwise transmission key 1, PSK2 corresponds to the target pairwise transmission key 2, and PSK3 corresponds to the target pairwise transmission key 3. Further, the authentication terminal can encrypt the target pairwise transmission key, generate a second message integrity check code corresponding to any first pre-shared key to obtain each second message integrity check code corresponding to each first pre-shared key (such as second message integrity check code 1, second message integrity check code 2, and second message integrity check code 3). Among them, PSK1 corresponds to the second message integrity check code 1, PSK2 corresponds to the second message integrity check code 2, and PSK3 corresponds to the second message integrity check code 3.

[0081] If the authentication terminal finds the target message integrity check code (such as the second message integrity check code 2, which can be referred to as MIC2) that is the same as MIC1 in the second message integrity check code 1, the second message integrity check code 2, and the second message integrity check code 3, it is determined that the requesting terminal has passed the verification (that is, the pairwise master key of the requesting terminal is correct). At this time, the authentication terminal can generate a master group key (group master key, GMK), and derive a key from the master group key, the second random number, and the second access control address of the authentication terminal through a pseudo-random algorithm to obtain a group transient key (group transient key, GTK), determine the key encryption key (key encryption key, KEK) from the target pairwise transmission key 2 used to generate MIC2, and encrypt the group transient key GTK based on the key encryption key through the AES algorithm to obtain an encrypted group transient key (Encrypted GTK). For example, the authentication terminal can use the middle 128 bits in the target pairwise transmission key 2 as the key encryption key for KEK encryption. Further, the authentication terminal can send a verification request (such as handshake information 3) to the requesting terminal. As mentioned above Figure 8 As shown in 8d, the handshake information 3 may carry the target message integrity check code (such as the above-mentioned MIC2). The handshake information 3 here may also carry the instruction for installing the paired transmission key PTK and the encryption group temporary key, where the instruction, the target message integrity check code and the encryption group temporary key are unicast data frames.

[0082] After receiving the handshake message 3, the requesting terminal can determine that the target pairwise master key 2 of the authentication terminal is correct when MIC2 is the same as MIC1, and send authentication confirmation information (such as handshake message 4) to the authentication terminal. Figure 8As shown in 8e in FIG. 4 , the handshake information 4 may carry the target message integrity check code, and the target message integrity check code is a unicast data frame. After receiving the handshake information 4, if the MIC2 in the handshake information 4 of the authentication terminal is the same as the MIC2 before sending the handshake information 3, it can be determined that the requesting terminal is successfully authenticated. On the contrary, if the MIC2 in the handshake information 4 of the authentication terminal is different from the MIC2 before sending the handshake information 3, the authentication terminal can determine that the MIC2 has been tampered with or individual data has been lost during the sending process, thereby determining that the requesting terminal has failed to authenticate. Optionally, if the authentication terminal fails to query the target message integrity verification code identical to MIC1 in the second message integrity verification code 1, the second message integrity verification code 2, and the second message integrity verification code 3, it can traverse each historical pre-shared key in the above-mentioned key-value pairs 1 to 3, and generate each third message integrity verification code corresponding to each historical pre-shared key. If the authentication terminal can query the target message integrity verification code identical to MIC1 in each third message integrity verification code, it is determined that the requesting terminal has passed the verification, and when the requesting terminal is successfully authenticated, the pre-shared key connected to the requesting terminal is added to the key-value pair 1 in the above-mentioned hash storage container 1, so as to update the hash storage container 1 in real time.

[0083] After the requesting terminal successfully authenticates, the requesting terminal can use the middle 128 bits of the pairwise transmission key PTK as the key decryption key for KEK decryption, and decrypt the encrypted group temporary key based on the key decryption key to obtain the group temporary key GTK, and then install the group temporary key GTK and the pairwise transmission key PTK. At the same time, the authentication terminal can also install the above-mentioned target pairwise transmission key 2, where the target pairwise transmission key 2 is the same as the above-mentioned pairwise transmission key PTK. After the requesting terminal and the authentication terminal complete the authentication, the authentication terminal can open its control port, and the requesting terminal can communicate with the authentication terminal through the control port so that the 802.11 data frame (such as a unicast data frame, a multicast data frame, or a broadcast data frame) in the communication process can pass normally. It can be understood that the pairwise transmission key PTK can be used to protect the unicast data frame in the communication process so that it can pass normally, and the group temporary key GTK is used to protect the multicast data frame and the broadcast data frame in the communication process so that it can pass normally, thereby protecting the user's key and information from being stolen by illegal users, thereby improving security.

[0084] In an embodiment of the present application, after receiving the authentication request from the requesting terminal, the authentication terminal can determine the target key-value pair from the pre-stored multiple key-value pairs according to the first access control address of the requesting terminal, and obtain at least one first pre-shared key corresponding to the first access control address from the target key-value pair, so that all the first pre-shared keys that the requesting terminal has connected to can be quickly found based on the first access control address, so as to efficiently authenticate the requesting terminal. Furthermore, the authentication terminal can generate each second message integrity check code corresponding to each first pre-shared key, and authenticate the requesting terminal based on the first message integrity check code and each second message integrity check code, so that each second message integrity check code can be quickly generated to authenticate the requesting terminal, thereby improving the authentication efficiency and providing a high user experience.

[0085] For further information, see Fig.10 , Fig.10 This is a flow chart of a terminal authentication method provided by an embodiment of the present application. This application can use a computer device as an authentication terminal (such as the above Figure 3 For example, the authentication terminal 10 in Fig.10 The method shown is applied to an authentication terminal and may include the following steps S201 to S208:

[0086] Step S201: the authentication terminal receives an authentication request from a requesting terminal.

[0087] Step S202: The authentication terminal determines a target key-value pair from multiple groups of key-value pairs based on the first access control address, and obtains at least one first pre-shared key corresponding to the first access control address from the target key-value pair.

[0088] Step S203: The authentication terminal generates second message integrity check codes corresponding to the first pre-shared keys.

[0089] Step S204: The authentication terminal authenticates the requesting terminal based on the first message integrity check code and each second message integrity check code.

[0090] The specific implementation of steps S201 to S204 can be found in the above Figure 4 The description of step S101 to step S104 in the corresponding embodiment will not be repeated here.

[0091] Step S205: The authentication terminal determines a target pre-shared key for generating a target message integrity check code from the at least one first pre-shared key.

[0092] In some feasible implementations, assuming that at least one first pre-shared key includes the above-mentioned PSK1, PSK2 and PSK3, the authentication terminal can determine the target pre-shared key (such as PSK2) used to generate the target message integrity check code (such as the above-mentioned MIC2) from PSK1, PSK2 and PSK3 after determining that the requesting terminal has passed the verification.

[0093] Step S206: The authentication terminal determines an access control address list corresponding to the target pre-shared key.

[0094] In some feasible implementations, the authentication terminal may store the access control addresses of all terminals that have been connected to a pre-shared key that has been successfully authenticated in the past (such as the above-mentioned historical pre-shared key or the target pre-shared key). Optionally, the authentication terminal may store in the memory a list of access control addresses that have been connected to a pre-shared key that has been successfully authenticated in the past, where the access control address list may include the access control addresses of all the above-mentioned terminals, and one pre-shared key that has been successfully authenticated in the past corresponds to one access control address list. Furthermore, the authentication terminal may determine the access control address list corresponding to the target pre-shared key from the access control address list corresponding to the pre-shared key that has been successfully authenticated in the past, and further determine the number of access control addresses in the access control address list.

[0095] Step S207: the authentication terminal determines a terminal connection number threshold, and denies access to the requesting terminal when the number of access control addresses in the access control address list is equal to the terminal connection number threshold.

[0096] In some feasible implementations, the authentication terminal can directly determine the terminal connection number threshold. Optionally, the authentication terminal can also determine or call the terminal connection number threshold from a memory or a database. The terminal connection number threshold can be understood as the maximum number of terminal connections that can be connected by a pre-shared key (i.e., the maximum number of terminals that can be connected by the pre-shared key). The maximum terminal connection number here can be a value set by the user or a default value set by the authentication terminal. For the convenience of description, the process of determining the maximum terminal connection number will be described below in conjunction with the enterprise office WiFi application scenario. See Fig.11 , Fig.11 Schematic diagram of an interface for determining the maximum number of terminal connections provided by an embodiment of the present application. Fig.11As shown, the authentication terminal (such as the terminal corresponding to the enterprise administrator) can configure the maximum terminal connection number (such as n, n can be a positive integer, such as 10 or other values) corresponding to the pre-shared key (such as the target pre-shared key PSK2) with successful historical authentication in the enterprise network (such as wireless network 1) through a small program or application (application, App) and save it. After determining the maximum terminal connection number n, the authentication terminal can refuse access to the requesting terminal when the number of access control addresses in the access control address list is equal to the maximum terminal connection number n, and determine that the authentication of the requesting terminal has failed. Since the hash storage container is stored in the memory of the authentication terminal, when the number of terminals connected to the authentication terminal is too large, it will cause too many hash keys in the hash storage container, thereby increasing the probability of hash collisions. Therefore, the authentication terminal can refuse access to the requesting terminal when the number of access control addresses is equal to the maximum number of terminal connections, thereby optimizing the hash storage container and reducing the probability of hash collisions.

[0097] Step S208: the authentication terminal allows access to the requesting terminal when the number of access control addresses is less than the terminal connection number threshold, and adds the first access control address to the access control address list when the requesting terminal is successfully authenticated and the access control address list does not contain the first access control address.

[0098] In some feasible implementations, after allowing access to the requesting terminal, the authentication terminal may determine that the first access control address is a historical authentication success address of the requesting terminal when the requesting terminal is successfully authenticated, and when the access control address list does not contain the first access control address, add the first access control address to the access control address list to update the access control address list in real time.

[0099] In some feasible implementations, the authentication terminal may store the connection time of each historical pre-shared key in each key-value pair. Optionally, the authentication terminal may store the connection time of each historical pre-shared key in each key-value pair in a hash storage container. The connection time here can be understood as the time when the terminal last connected to each historical pre-shared key, or it can be understood as the time when the terminal last connected to each historical pre-shared key from the current time. Fig.12 , Fig.12 Schematic diagram of a hash storage container storing key-value pairs provided by an embodiment of the present application. Fig.12As shown, a plurality of key-value pairs (such as key-value pairs 10 to 30) may be stored in a hash storage container (such as hash storage container 2), and the authentication terminal may store the connection time (such as connection time 1 to connection time 3) corresponding to each historical pre-shared key (such as PSK1 to PSK3) in key-value pair 10. The authentication terminal may store the connection time (such as connection time 4 to connection time 8) corresponding to each historical pre-shared key (such as PSK4 to PSK8) in key-value pair 20. The authentication terminal may store the connection time (such as connection time 9) corresponding to each historical pre-shared key (such as PSK0) in key-value pair 30. Further, the authentication terminal may traverse each group of key-value pairs, determine the connection time difference of each historical pre-shared key based on the connection time of each historical pre-shared key in any group of key-value pairs and the current time, and determine the second pre-shared key whose connection time difference is greater than the connection time threshold from each historical pre-shared key, and delete the second pre-shared key from any group of key-value pairs. The connection time threshold here may be a value set by the user or a default value configured by the authentication terminal. In the embodiment of the present application, the historical pre-shared keys in the key-value pair whose connection time difference is greater than the connection time threshold may be collectively referred to as the second pre-shared key. Optionally, the authentication terminal may determine the connection time threshold, start an additional timer in the hash storage container, periodically traverse multiple groups of key-value pairs in the hash storage container based on the timer, and periodically delete the second pre-shared key from the multiple groups of key-value pairs, thereby reducing the memory occupied by the hash storage container and making it more applicable.

[0100] In an embodiment of the present application, after receiving the authentication request from the requesting terminal, the authentication terminal can determine the target key-value pair from the pre-stored multiple key-value pairs according to the first access control address of the requesting terminal, and obtain at least one first pre-shared key corresponding to the first access control address from the target key-value pair, so that all the first pre-shared keys that the requesting terminal has connected to can be quickly found based on the first access control address, so as to efficiently authenticate the requesting terminal. Furthermore, the authentication terminal can generate each second message integrity check code corresponding to each first pre-shared key, and authenticate the requesting terminal based on the first message integrity check code and each second message integrity check code, so that each second message integrity check code can be quickly generated to authenticate the requesting terminal, thereby improving the authentication efficiency and providing a high user experience.

[0101] For further information, see Fig.13 , Fig.13 : is a schematic diagram of the structure of a terminal authentication device provided in an embodiment of the present application. The terminal authentication device may be a computer program (including program code) running in a computer device, for example, the terminal authentication device is an application software; the terminal authentication device may be used to execute the corresponding steps in the method provided in an embodiment of the present application. Fig.13As shown, the terminal authentication device 1 can be run on the authentication terminal, and the authentication terminal can be the above-mentioned Figure 3 The authentication terminal 10 in the corresponding embodiment. The terminal authentication device 1 may include: a receiving module 10, an acquisition module 11, a first generation module 12, a first authentication module 13, a second generation module 14, a query determination module 15, a second authentication module 16, a first determination module 17, a second determination module 18, a third determination module 19, an adding module 20, a storage module 21 and a key deletion module 22.

[0102] The receiving module 10 is used for the authentication terminal to receive the authentication request of the requesting terminal, where the authentication request carries the first access control address and the first message integrity check code of the requesting terminal.

[0103] The acquisition module 11 is used to determine the target key-value pair from multiple groups of key-value pairs based on the first access control address of the authentication terminal, and obtain at least one first pre-shared key corresponding to the first access control address from the target key-value pair, wherein a group of key-value pairs includes the access control address of a terminal and at least one historical pre-shared key to which the terminal has been connected, and the access control address of any terminal is the historical authentication success address of any terminal.

[0104] The first generating module 12 is used for the authentication terminal to generate second message integrity check codes corresponding to first pre-shared keys, and one first pre-shared key corresponds to one second message integrity check code.

[0105] The authentication request also carries a first random number generated by the requesting terminal;

[0106] The first generating module 12 includes: a first determining unit 121 , a second determining unit 122 and a generating unit 123 .

[0107] A first determining unit 121 is configured to determine, by the authentication terminal, a target pairwise master key corresponding to any first pre-shared key based on any first pre-shared key and a service set identifier, wherein the service set identifier is an identifier of a service set to which the requesting terminal requests connection;

[0108] A second determining unit 122 is configured to determine, by the authentication terminal, a target pairwise transmission key corresponding to any first pre-shared key based on the target pairwise master key, the first random number, the second random number, the first access control address, and the second access control address of the authentication terminal;

[0109] The generating unit 123 is configured to authenticate the terminal to encrypt the target pairwise transmission key, generate a second message integrity check code corresponding to any first pre-shared key, and obtain each second message integrity check code corresponding to each first pre-shared key.

[0110] The specific implementation of the first determining unit 121, the second determining unit 122 and the generating unit 123 can refer to the above Figure 4 The description of step S103 in the corresponding embodiment will not be repeated here.

[0111] The first authentication module 13 is used for authenticating the requesting terminal based on the first message integrity check code and each second message integrity check code.

[0112] The first authentication module 13 includes: a query determination unit 131 , a sending unit 132 and an authentication unit 133 .

[0113] A query determination unit 131, configured to determine that the requesting terminal has passed the verification if the authentication terminal has found a target message integrity verification code that is the same as the first message integrity verification code in each second message integrity verification code;

[0114] A sending unit 132, configured for the authentication terminal to send a verification request to the requesting terminal, wherein the verification request carries a target message integrity verification code;

[0115] The authentication unit 133 is used to determine that the authentication of the requesting terminal is successful when receiving the authentication confirmation information sent by the requesting terminal. The authentication confirmation information is the information sent by the requesting terminal when the target message integrity check code is the same as the first message integrity check code.

[0116] The specific implementation of the query determination unit 131, the sending unit 132 and the authentication unit 133 can be found in the above Figure 4 The description of step S104 in the corresponding embodiment will not be repeated here.

[0117] The terminal authentication device 1 further comprises:

[0118] The second generating module 14 is used for traversing each historical pre-shared key in each group of key-value pairs and generating each third message integrity check code corresponding to each historical pre-shared key if the authentication terminal fails to find a target message integrity check code identical to the first message integrity check code in each second message integrity check code, wherein one historical pre-shared key corresponds to one third message integrity check code;

[0119] A query determination module 15, configured to determine that the requesting terminal has passed the verification if the authentication terminal has found a target message integrity verification code that is the same as the first message integrity verification code in each third message integrity verification code;

[0120] The second authentication module 16 is configured to determine that the requesting terminal authentication fails if the authentication terminal fails to find a target message integrity check code that is the same as the first message integrity check code in each third message integrity check code.

[0121] The terminal authentication device 1 further comprises:

[0122] A first determination module 17, configured to determine, by the authentication terminal, a target pre-shared key for generating a target message integrity check code from at least one first pre-shared key;

[0123] A second determination module 18, configured for the authentication terminal to determine an access control address list corresponding to a target pre-shared key;

[0124] The third determination module 19 is used to determine the terminal connection number threshold by the authentication terminal, and to deny access to the requesting terminal when the number of access control addresses in the access control address list is equal to the terminal connection number threshold.

[0125] The terminal authentication device 1 further comprises:

[0126] An adding module 20 is used to allow the authentication terminal to access the requesting terminal when the number of access control addresses is less than the terminal connection number threshold, and to add the first access control address to the access control address list when the requesting terminal is successfully authenticated and the access control address list does not contain the first access control address. The first access control address is a historical authentication successful address of the requesting terminal.

[0127] The terminal authentication device 1 further comprises:

[0128] The storage module 21 is used for the authentication terminal to store the connection time of each historical pre-shared key in each group of key-value pairs;

[0129] The key deletion module 22 is used for the authentication terminal to traverse each group of key-value pairs, determine the connection time difference of each historical pre-shared key based on the connection time of each historical pre-shared key in any group of key-value pairs and the current time, determine the second pre-shared key whose connection time difference is greater than the connection time threshold from each historical pre-shared key, and delete the second pre-shared key from any group of key-value pairs.

[0130] The specific implementation of the receiving module 10, the acquiring module 11, the first generating module 12, the first authentication module 13, the second generating module 14, the query determining module 15, the second authentication module 16, the first determining module 17, the second determining module 18, the third determining module 19, the adding module 20, the storage module 21 and the key deleting module 22 can be referred to above. Figure 4 The description of steps S101 to S104 in the corresponding embodiment, and / or the above Fig.10The description of steps S201 to S208 in the corresponding embodiment will not be repeated here. In addition, the description of the beneficial effects of the same method will not be repeated here either.

[0131] For further information, see Fig.14 , Fig.14 Schematic diagram of the structure of a computer device provided in an embodiment of the present application. Fig.14 As shown, the computer device 1000 may be the above Figure 3 Corresponding to the authentication terminal 10 in the embodiment, the computer device 1000 may include: at least one processor 1001, such as a CPU, at least one network interface 1004, a user interface 1003, a memory 1005, and at least one communication bus 1002. The communication bus 1002 is used to realize the connection and communication between these components. The user interface 1003 may include a display screen (Display) and a keyboard (Keyboard), and the network interface 1004 may optionally include a standard wired interface and a wireless interface (such as a WI-FI interface). The memory 1005 may be a high-speed RAM memory, or a non-volatile memory (non-volatile memory), such as at least one disk storage. The memory 1005 may optionally also be at least one storage device located away from the aforementioned processor 1001. Fig.14 As shown, the memory 1005 as a computer storage medium may include an operating system, a network communication module, a user interface module, and a device control application program.

[0132] exist Fig.14 In the computer device 1000 shown, the network interface 1004 is mainly used to communicate with the request terminal through the network; the user interface 1003 is mainly used to provide an input interface for the user; and the processor 1001 can be used to call the device control application stored in the memory 1005 to achieve:

[0133] The authentication terminal receives an authentication request from the requesting terminal, where the authentication request carries a first access control address and a first message integrity check code of the requesting terminal;

[0134] The authentication terminal determines a target key-value pair from a plurality of groups of key-value pairs based on the first access control address, and obtains at least one first pre-shared key corresponding to the first access control address from the target key-value pair, wherein a group of key-value pairs includes an access control address of a terminal and at least one historical pre-shared key that the terminal has connected to, and the access control address of any terminal is a historical authentication successful address of any terminal;

[0135] The authentication terminal generates second message integrity check codes corresponding to the first pre-shared keys, and one first pre-shared key corresponds to one second message integrity check code;

[0136] The authentication terminal authenticates the requesting terminal based on the first message integrity check code and each second message integrity check code.

[0137] It should be understood that the computer device 1000 described in the embodiment of the present application can execute the above Figure 4 and Fig.10 The description of the terminal authentication method in the corresponding embodiment can also be performed as described above. Fig.13 The description of the terminal authentication device 1 in the corresponding embodiment will not be repeated here. In addition, the description of the beneficial effects of adopting the same method will not be repeated here either.

[0138] In addition, it should be pointed out here that: the embodiment of the present application also provides a computer-readable storage medium, and the computer-readable storage medium stores a computer program executed by the terminal authentication device 1 mentioned above, and the computer program includes program instructions. When the processor executes the program instructions, it can execute the above Figure 4 or Fig.10 The description of the terminal authentication method in the corresponding embodiment will therefore not be repeated here. In addition, the description of the beneficial effects of the same method will not be repeated. For technical details not disclosed in the computer-readable storage medium embodiment involved in this application, please refer to the description of the method embodiment of this application. As an example, program instructions may be deployed to be executed on one computing device, or on multiple computing devices located at one location, or on multiple computing devices distributed at multiple locations and interconnected by a communication network. Multiple computing devices distributed at multiple locations and interconnected by a communication network can constitute a blockchain system.

[0139] In one aspect of the present application, a computer program product or a computer program is provided, the computer program product or the computer program includes computer instructions, the computer instructions are stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device executes the terminal authentication method provided in the embodiment of the present application.

[0140] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through a computer program, and the above-mentioned program can be stored in a computer-readable storage medium, and when the program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, the above-mentioned storage medium can be a disk, an optical disk, a read-only memory (ROM) or a random access memory (RAM), etc.

[0141] The computer-readable storage medium may be the terminal authentication device provided in any of the aforementioned embodiments or the internal storage unit of the above-mentioned device, such as a hard disk or memory of an electronic device. The computer-readable storage medium may also be an external storage device of the electronic device, such as a plug-in hard disk, a smart memory card (smart media card, SMC), a secure digital (secure digital, SD) card, a flash card (flash card), etc. equipped on the electronic device. The computer-readable storage medium may also include a disk, an optical disk, a read-only memory (read-only memory, ROM) or a random access memory (random access memory, RAM), etc. Further, the computer-readable storage medium may also include both an internal storage unit of the electronic device and an external storage device. The computer-readable storage medium is used to store the computer program and other programs and data required by the electronic device. The computer-readable storage medium may also be used to temporarily store data that has been output or is to be output.

[0142] The terms "first", "second", etc. in the claims, specification and drawings of the present invention are used to distinguish different objects, rather than to describe a specific order. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not limited to the listed steps or units, but optionally includes steps or units that are not listed, or optionally includes other steps or units inherent to these processes, methods, products or devices. Mentioning "embodiment" in this article means that the specific features, structures or characteristics described in conjunction with the embodiment may be included in at least one embodiment of the present invention. Displaying the phrase at various locations in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein can be combined with other embodiments. The term "and / or" used in the specification and the appended claims of the present invention refers to any combination of one or more of the items listed in association and all possible combinations, and includes these combinations.

[0143] Those skilled in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented by electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in terms of function in the above description. Professional and technical personnel may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0144] The above disclosure is only the preferred embodiment of the present application, which certainly cannot be used to limit the scope of rights of the present application. Therefore, equivalent changes made according to the claims of the present application are still within the scope covered by the present application.

Claims

1. A terminal authentication method, characterized in that: include: The authentication terminal receives an authentication request from a requesting terminal, wherein the authentication request carries a first access control address and a first message integrity check code of the requesting terminal; The authentication terminal is a backend server corresponding to the WiFi hotspot with the strongest signal strength scanned by the requesting terminal, the first message integrity check code is generated based on the target pre-shared key and service set identifier connected to the requesting terminal, the first access control address, the second access control address of the authentication terminal, a first random number generated by the requesting terminal, and a second random number generated by the authentication terminal, and the service set identifier is an identifier of the service set corresponding to the strongest WiFi hotspot; The authentication terminal determines a target key-value pair from a plurality of key-value pairs based on the first access control address, and obtains at least one first pre-shared key corresponding to the first access control address from the target key-value pair, wherein a set of key-value pairs includes an access control address of a terminal and at least one historical pre-shared key to which the terminal has been connected, and the access control address of any terminal is a historical authentication success address of any terminal; The authentication terminal generates each second message integrity check code corresponding to each first pre-shared key, and one first pre-shared key corresponds to one second message integrity check code; The authentication terminal authenticates the requesting terminal based on the first message integrity check code and the second message integrity check codes; If the authentication terminal does not find the target message integrity verification code that is the same as the first message integrity verification code in the second message integrity verification codes, it traverses the historical pre-shared keys in each group of key-value pairs, and generates third message integrity verification codes corresponding to the historical pre-shared keys, and one historical pre-shared key corresponds to one third message integrity verification code; if the authentication terminal finds the target message integrity verification code that is the same as the first message integrity verification code in the third message integrity verification codes, it is determined that the requesting terminal has passed the verification; a verification request carrying the target message integrity verification code is sent to the requesting terminal, and when the authentication confirmation information sent by the requesting terminal is received, it is determined that the requesting terminal has been successfully authenticated, and the target pre-shared key is added to the target key-value pair to update the target key-value pair; the target pre-shared key is the historical pre-shared key corresponding to the target message integrity verification code in the multiple groups of key-value pairs, and after the authentication is successful, the requesting terminal accesses the Internet based on the strongest WiFi hotspot.

2. The method according to claim 1, characterized in that The authentication request also carries a first random number generated by the requesting terminal; The authentication terminal generates each second message integrity check code corresponding to each first pre-shared key, including: The authentication terminal determines a target pairwise master key corresponding to any first pre-shared key based on any first pre-shared key and a service set identifier, wherein the service set identifier is an identifier of a service set to which the requesting terminal requests to connect; The authentication terminal determines, based on the target pairwise master key, the first random number, the second random number, the first access control address, and the second access control address of the authentication terminal, a target pairwise transmission key corresponding to any one of the first pre-shared keys; The authentication terminal encrypts the target paired transmission key, generates a second message integrity check code corresponding to any of the first pre-shared keys, and obtains each second message integrity check code corresponding to each first pre-shared key.

3. The method according to claim 2, characterized in that The authentication terminal authenticates the requesting terminal based on the first message integrity check code and the second message integrity check codes, including: If the authentication terminal finds a target message integrity check code that is the same as the first message integrity check code in each of the second message integrity check codes, it is determined that the requesting terminal has passed the verification; The authentication terminal sends a verification request to the requesting terminal, wherein the verification request carries the target message integrity verification code; Upon receiving the authentication confirmation information sent by the requesting terminal, the authentication terminal determines that the requesting terminal is successfully authenticated, wherein the authentication confirmation information is information sent by the requesting terminal when the target message integrity check code is the same as the first message integrity check code.

4. The method according to claim 3, characterized in that The method further comprises: If the authentication terminal fails to find the target message integrity check code that is the same as the first message integrity check code in the third message integrity check codes, it is determined that the authentication of the requesting terminal has failed.

5. The method according to claim 3, characterized in that: After the authentication terminal determines that the requesting terminal has passed the verification, the method further includes: The authentication terminal determines a target pre-shared key for generating the target message integrity check code from the at least one first pre-shared key; The authentication terminal determines an access control address list corresponding to the target pre-shared key; The authentication terminal determines a terminal connection number threshold, and denies access to the requesting terminal when the number of access control addresses in the access control address list is equal to the terminal connection number threshold.

6. The method according to claim 5, characterized in that The method further comprises: The authentication terminal allows access to the requesting terminal when the number of the access control addresses is less than the terminal connection number threshold, and adds the first access control address to the access control address list when the requesting terminal is successfully authenticated and the access control address list does not contain the first access control address, wherein the first access control address is a historical authentication successful address of the requesting terminal.

7. The method according to claim 1, characterized in that The method further comprises: The authentication terminal stores, in each group of key-value pairs, the connection time of each historical pre-shared key in the group of key-value pairs; The authentication terminal traverses the groups of key-value pairs, determines the connection time difference of each historical pre-shared key based on the connection time of each historical pre-shared key in any group of key-value pairs and the current time, determines a second pre-shared key whose connection time difference is greater than a connection time threshold from the historical pre-shared keys, and deletes the second pre-shared key from any group of key-value pairs.

8. A terminal authentication device, characterized in that: include: A receiving module, configured to receive, by an authentication terminal, an authentication request from a requesting terminal, wherein the authentication request carries a first access control address and a first message integrity check code of the requesting terminal; The authentication terminal is a backend server corresponding to the WiFi hotspot with the strongest signal strength scanned by the requesting terminal, the first message integrity check code is generated based on the target pre-shared key and service set identifier connected to the requesting terminal, the first access control address, the second access control address of the authentication terminal, a first random number generated by the requesting terminal, and a second random number generated by the authentication terminal, and the service set identifier is an identifier of the service set corresponding to the strongest WiFi hotspot; an acquisition module, configured for the authentication terminal to determine a target key-value pair from a plurality of groups of key-value pairs based on the first access control address, and to acquire at least one first pre-shared key corresponding to the first access control address from the target key-value pair, wherein a group of key-value pairs includes an access control address of a terminal and at least one historical pre-shared key to which the terminal has been connected, and the access control address of any terminal is a historical authentication success address of any terminal; A first generating module, used for the authentication terminal to generate each second message integrity check code corresponding to each first pre-shared key, one first pre-shared key corresponding to one second message integrity check code; A first authentication module, configured for the authentication terminal to authenticate the requesting terminal based on the first message integrity check code and the second message integrity check codes; A second generating module is used for traversing each historical pre-shared key in each group of key-value pairs and generating each third message integrity check code corresponding to each historical pre-shared key if the authentication terminal fails to query a target message integrity check code identical to the first message integrity check code in each second message integrity check code, wherein one historical pre-shared key corresponds to one third message integrity check code; A query and determination module is used to determine that the requesting terminal has passed the verification if the authentication terminal has found the target message integrity verification code that is the same as the first message integrity verification code in the third message integrity verification codes; send a verification request carrying the target message integrity verification code to the requesting terminal, and when receiving the authentication confirmation information sent by the requesting terminal, determine that the requesting terminal has been successfully authenticated, and add the target pre-shared key to the target key-value pair to update the target key-value pair; the target pre-shared key is a historical pre-shared key corresponding to the target message integrity verification code in the multiple groups of key-value pairs, and after the authentication is successful, the requesting terminal accesses the Internet based on the strongest WiFi hotspot.

9. A computer device, characterized in that: include: Processor, memory, and network interface; The processor is connected to a memory and a network interface, wherein the network interface is used to provide a data communication function, the memory is used to store program codes, and the processor is used to call the program codes to execute the method described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, wherein the computer program includes program instructions. When the program instructions are executed by a processor, the method according to any one of claims 1 to 7 is executed.

Images