Wireless local area network authentication method and device, electronic device, and storage medium

Abstract

The embodiment of the present application discloses a wireless local area authentication method and device, the method comprising: receiving information to be authenticated sent by a wireless access point device, the information to be authenticated containing verification information generated by a terminal to be authenticated; obtaining a verification key matching the terminal to be authenticated, and verifying the verification information according to the verification key; if the verification information passes the verification, returning the verification key to the wireless access point device, so that the wireless access point device associates and stores the verification key with the terminal identification of the terminal to be authenticated. Based on the technical solution of the embodiment of the present application, the subsequent connection scheme of wireless terminals that have been historically connected in the wireless local area network can be optimized, and the connection efficiency of the wireless local area network can also be effectively improved.

Description

Technical Field

[0001] The present application relates to the field of wireless communication technology, and in particular to a wireless local area network authentication method and device, an electronic device, and a computer-readable storage medium. Background Art

[0002] The market size of enterprise wireless LAN (Wi-Fi) is huge, and there are usually a large number of wireless LAN connection requirements in enterprise wireless LAN.

[0003] At present, in enterprise wireless LAN systems, the wireless LAN authentication process is usually handled by access controller devices or wireless access point devices. However, the performance of wireless access point devices is generally weak. When multiple wireless terminals perform wireless LAN authentication concurrently, it is easy for wireless terminals to fail in wireless LAN authentication and be unable to connect to the enterprise wireless LAN. Although the performance of access controller devices is powerful, the price is very expensive, resulting in very high costs for enterprises to deploy wireless LAN systems. Summary of the invention

[0004] The embodiments of the present application provide a wireless local area network authentication method and device, an electronic device, and a computer-readable storage medium from different aspects.

[0005] According to one aspect of an embodiment of the present application, a wireless local area network authentication method is provided, including: receiving information to be authenticated sent by a wireless access point device, the information to be authenticated containing verification information generated by a terminal to be authenticated; obtaining a verification key matching the terminal to be authenticated, and verifying the verification information according to the verification key; if the verification information passes the verification, returning the verification key to the wireless access point device, so that the wireless access point device associates the verification key with the terminal identification of the terminal to be authenticated and stores it.

[0006] According to one aspect of an embodiment of the present application, another wireless local area network authentication method is provided, including: when a wireless local area network connection request sent by a terminal to be authenticated is received, a verification key associated with the terminal identifier is searched locally according to the terminal identifier of the terminal to be authenticated, wherein the verification key associated with the terminal identifier is issued by the cloud server after receiving the information to be authenticated sent historically by the wireless access point device, by obtaining a verification key matching the terminal to be authenticated, and verifying the verification information contained in the information to be authenticated according to the obtained verification key, wherein the verification information is generated by the terminal to be authenticated; if the verification key associated with the terminal identifier is found, a wireless local area network connection is established with the terminal to be authenticated in response to the wireless local area network connection request.

[0007] According to one aspect of an embodiment of the present application, a wireless local area network authentication device is provided, including: an information receiving module for authentication, configured to receive information to be authenticated sent by a wireless access point device, wherein the information to be authenticated contains verification information generated by a terminal to be authenticated; a key acquisition and verification module, configured to obtain a verification key matching the terminal to be authenticated, and verify the verification information according to the verification key; and a key information return module, configured to return the verification key to the wireless access point device if the verification information passes the verification, so that the wireless access point device associates the verification key with the terminal identification of the terminal to be authenticated and stores it.

[0008] According to one aspect of an embodiment of the present application, another wireless local area network authentication device is provided, including: a verification key search module, configured to, when receiving verification information sent by a terminal to be authenticated, locally search for a verification key associated with the terminal identifier of the terminal to be authenticated, wherein the verification key associated with the terminal identifier is issued by the cloud server after receiving the information to be authenticated historically sent by a wireless access point device, by obtaining a verification key matching the terminal to be authenticated, and verifying the verification information contained in the historically sent information to be authenticated according to the obtained verification key; and a request response module, configured to establish a wireless local area network connection with the terminal to be authenticated in response to the wireless local area network connection request if the verification key associated with the terminal identifier is found.

[0009] According to one aspect of an embodiment of the present application, an electronic device is provided, including a processor and a memory, wherein the memory stores computer-readable instructions, and when the computer-readable instructions are executed by the processor, the wireless local area network authentication method as described above is implemented.

[0010] According to one aspect of an embodiment of the present application, a computer-readable storage medium is provided, on which computer-readable instructions are stored. When the computer-readable instructions are executed by a processor of a computer, the computer executes the wireless local area network authentication method as described above.

[0011] According to one aspect of the embodiments of the present application, a computer program product or a computer program is provided, the computer program product or the computer program includes a computer instruction, and the computer instruction is stored in a computer-readable storage medium. A processor of a computer device reads the computer instruction from the computer-readable storage medium, and the processor executes the computer instruction, so that the computer device executes the wireless local area network authentication method provided in the above various optional embodiments.

[0012] In the technical solution provided in the embodiment of the present application, a new enterprise wireless LAN authentication solution is provided. On the one hand, the wireless access point device deployed locally in the enterprise communicates with the cloud server to send the information to be authenticated in the wireless LAN authentication process to the cloud server, and the cloud server specifically handles the LAN authentication process. The enterprise does not need to purchase expensive access point control devices, and the wireless access point device deployed locally in the enterprise does not need to handle the wireless LAN authentication process. On the other hand, the wireless access point device also verifies the terminal identification of the successfully authenticated terminal to be authenticated and the verification information generated for the terminal to be authenticated, and stores them in association with the adopted paired master key, so that the next time the terminal to be authenticated requests to connect to the wireless LAN provided by the wireless access point device, the wireless access point device can quickly perform authentication according to the locally associated stored information, thereby optimizing the subsequent connection solution of the wireless terminal that has been historically connected in the wireless LAN, which can effectively improve the overall connection efficiency of the enterprise wireless LAN. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] Figure 1 is a schematic diagram of a wireless local area network connection process shown in an embodiment of the present application;

[0014] Figure 2 is a flow chart of a wireless local area network authentication method shown in one embodiment of the present application;

[0015] Figure 3 is an architecture diagram of an enterprise wireless local area network system shown in an embodiment of the present application;

[0016] Figure 4 is a flow chart of a wireless local area network authentication method shown in an exemplary embodiment of the present application;

[0017] Figure 5 yes Figure 4 An exemplary flow chart of the process of obtaining a verification key matching the terminal to be authenticated and verifying the verification information according to the verification key in the illustrated embodiment;

[0018] Figure 6 is a flow chart of a wireless local area network authentication method shown in another exemplary embodiment of the present application;

[0019] Figure 7 is another exemplary flowchart of a wireless local area network authentication method of the present application;

[0020] Figure 8 is another exemplary flowchart of a wireless local area network authentication method of the present application;

[0021] Fig. 9 is an architecture diagram of an enterprise wireless local area network system shown in another embodiment of the present application;

[0022] Fig.10 is a schematic diagram of an exemplary application scenario shown in an embodiment of the present application;

[0023] Fig.11 is a schematic diagram of an exemplary application scenario shown in another embodiment of the present application;

[0024] Fig.12 is a schematic diagram of an exemplary application scenario shown in another embodiment of the present application;

[0025] Fig.13 is a block diagram of a wireless local area network authentication device shown in an embodiment of the present application;

[0026] Fig.14 is a block diagram of a wireless local area network authentication device shown in another embodiment of the present application;

[0027] Fig.15 It is a structural diagram of a computer system of an electronic device suitable for implementing an embodiment of the present application, shown in an embodiment of the present application. DETAILED DESCRIPTION

[0028] Here, exemplary embodiments will be described in detail, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are only examples of devices and methods consistent with some aspects of the present application as detailed in the attached claims.

[0029] The block diagrams shown in the accompanying drawings are merely functional entities and do not necessarily correspond to physically independent entities. That is, these functional entities may be implemented in software form, or in one or more hardware modules or integrated circuits, or in different networks and / or processor devices and / or microcontroller devices.

[0030] The flowcharts shown in the accompanying drawings are only exemplary and do not necessarily include all the contents and operations / steps, nor must they be executed in the order described. For example, some operations / steps can be decomposed, and some operations / steps can be combined or partially combined, so the actual execution order may change according to actual conditions.

[0031] It should also be noted that the "multiple" mentioned in this application refers to two or more than two. "And / or" describes the association relationship of the associated objects, indicating that there can be three relationships. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. The character " / " generally indicates that the previous and next associated objects are in an "or" relationship.

[0032] In the field of wireless communications, when a wireless terminal uses its own wireless LAN (Wi-Fi) function, it is usually necessary to perform at least scanning, authentication, and association between the wireless terminal and the wireless access point device before the wireless terminal can connect to the wireless LAN. For details, see Figure 1 The process shown is for a wireless terminal to access a wireless local area network provided by a wireless access point device.

[0033] The scanning process includes active scanning and passive scanning. Active scanning includes: the wireless terminal broadcasts a probe request (Probe Request) on each channel; then, the wireless access point device that receives the probe request responds to the wireless terminal with a probe response (Probe Response). The probe response contains the service set identifier SSID (Service Set Identifier) ​​of the wireless access point device, so that the wireless terminal can update its wireless network list. Passive scanning includes the wireless access point device periodically sending beacon packets (Beacon) to enable the wireless terminal to update its wireless network list.

[0034] After the scan is completed, the wireless terminal will select the wireless local area network it wants to join. At this time, a window for entering the user password usually pops up in the wireless device, or it may not pop up a window for entering the user password. After that, the wireless terminal and the wireless access point device corresponding to the selected wireless local area network will enter the authentication process.

[0035] The authentication process usually includes WPA / WPA2-PSK authentication or WPA / WPA2-PPSK authentication. The two authentication processes include the EAPOL (Extensible Authentication Protocol over LAN) four-way handshake process. The two authentication processes are also suitable for wireless authentication processes in scenarios such as enterprises that have high requirements for network security.

[0036] After successful authentication, the wireless terminal and the wireless access point device perform an association process. Specifically, the wireless terminal sends an association request (Association Request) data packet to the wireless access point device, and the wireless access point device sends an association response (Association Response) data packet to the wireless terminal.

[0037] After the association process is completed, the wireless terminal is successfully connected to the selected wireless local area network.

[0038] Compared with the WPA / WPA2-PSK authentication method, the WPA / WPA2-PPSK authentication method can assign a separate pre-shared key PSK (Pre-Shared Key) to each user in the wireless local area network, which greatly improves network security. As long as the wireless terminal supports the WPA-PSK (a wireless network authentication method mainly for personal or home networks) authentication method, the wireless terminal does not need to perform additional processing when connecting to the wireless network, which is very suitable for enterprise scenarios where a large number of employees connect to the wireless network. Therefore, the enterprise wireless LAN system provided in some embodiments of the present application may specifically adopt the WPA / WPA2-PPSK authentication method. Of course, in other embodiments, the enterprise wireless LAN system may also adopt the WPA / WPA2-PSK authentication method, which is not limited here.

[0039] Figure 2 FIG. 1 is a flowchart of a WPA / WPA2-PPSK authentication method according to an embodiment of the present application. WPA / WPA2-PPSK authentication includes Figure 2 The four-way handshake process shown in the figure can be described in detail as follows.

[0040] First handshake: The wireless access point device generates an access point random value ANonce and sends the generated access point random value ANonce to the wireless terminal.

[0041] Second handshake: The wireless terminal obtains the user input key and generates a terminal random value SNonce.

[0042] The wireless terminal generates a first pairwise temporary key PTK (Pairwise Temp Key) based on one or more of a user input key, a terminal random value, an access point random value, and a device identifier of the wireless access point device. The device identifier of the wireless access point device may include one or more of a MAC address, a service set identifier, an extended service set identifier, and a basic service set identifier corresponding to the wireless access point device. The device identifier of the wireless access point device is acquired by the wireless terminal during the scanning process. The first pairwise temporary key is calculated using a pseudo-random function algorithm, such as a PRF (Pseudo-random Function) pseudo-random function algorithm. The user input key is usually a personal pre-shared key of the user.

[0043] The wireless terminal will also generate a first message integrity check code MIC (Message Integrity Code) based on the first pairwise temporary key, and send the terminal random value and the first message integrity check code as verification information to the wireless access point device. The first message integrity check code is obtained by encrypting the message to be sent by the wireless terminal's own first key KCK (Key Confirmation Key) for generating the message integrity check code. The first key for generating the message integrity check code is a specific byte contained in the first pairwise temporary key, usually the first 16 bytes in the first pairwise temporary key.

[0044] Third handshake: After receiving the verification information sent by the wireless terminal, the wireless access point device generates a second pairwise temporary key in the same way as the first pairwise temporary key generated in the wireless terminal according to the parameter information obtained by itself, and generates a second message integrity check code accordingly, and uses the second message integrity check code to verify the first message integrity check code contained in the verification information. If the second message integrity check code is the same as the first message integrity check code, it means that the verification is passed.

[0045] It is worth mentioning that the parameter information obtained by the wireless access point device itself includes the pairwise master key PMK (Pairwise Master Key) corresponding to the wireless terminal. For example, the wireless access point device stores pre-shared keys allocated to a large number of users. The pairwise master keys of each user can be calculated through the pre-shared keys of each user and the service set identification code of the wireless access point device. However, since the wireless access point device cannot identify the user corresponding to the wireless terminal, it is impossible to directly search the pairwise master key corresponding to the wireless terminal from itself. Based on this, the wireless access point device needs to find the pairwise master key in itself, and then use the found pairwise master key to generate a second pairwise temporary key, and generate a second message integrity check code accordingly. If the second message integrity check code is different from the first message integrity check code, it means that the user corresponding to the pairwise master key found this time does not match the user in the wireless terminal, and the authentication cannot pass. Therefore, the next round of pairwise master key and user identity authentication needs to be executed until the authentication passes. In some embodiments, there is also the possibility that the identity authentication of the user in the wireless terminal cannot pass after all pairwise master keys are found.

[0046] After the wireless access point device verifies the verification information sent by the wireless terminal, it generates a group transient key GTK (Group Transient Key). The group transient key can be calculated based on the wireless access point random value. The wireless access point device sends the group transient key and the second message integrity check code generated by itself to the wireless terminal, and the third handshake process is completed. It should be noted that in some embodiments, the wireless access point device also encrypts the group transient key with the second key KEK (Key Encryption Key) for encrypted transmission to obtain the encrypted group transient key, and sends the encrypted group transient key to the wireless terminal during the third handshake. The second key for encrypted transmission is a specific byte contained in the second paired transient key.

[0047] The fourth handshake: After the wireless terminal receives the group temporary key and the second message integrity check code sent by the wireless access point device, it compares the second message integrity check code with its own first message integrity check code to see if they are the same. If they are the same, the first paired temporary key and the group temporary key are installed. If the wireless terminal receives the encrypted group temporary key, it uses its own first key used for encryption and transmission to decrypt the encrypted group temporary key to obtain the group temporary key. The wireless terminal compares the second message integrity check code with its own first message integrity check code to see if they are the same, which can be that the wireless terminal uses its own first key used to generate the message integrity check code to decrypt the second message integrity check code. If the decryption is successful, it is determined that the second message integrity check code is the same as the first message integrity check code.

[0048] After installing the first pairwise temporary key and the group temporary key, the wireless terminal sends key confirmation information to the wireless access point device, thereby completing the fourth handshake process, that is, completing the WPA / WPA2-PPSK authentication process.

[0049] After receiving the key confirmation information, the wireless access point device will also install the second pairwise temporary key and the group temporary key. It should be noted that through the above authentication process, it can be determined that the second pairwise temporary key is the same as the first pairwise temporary key installed by the wireless terminal.

[0050] Since the second pairwise temporary key and the first pairwise temporary key are both encryption keys for encrypting unicast data streams, and the group temporary key is an encryption key for encrypting broadcast and multicast data streams, encrypted transmission of unicast data streams, broadcast data streams, and multicast data streams can be performed between the wireless terminal and the wireless access point device, thereby ensuring the security of the wireless network.

[0051] Considering that the performance of wireless access point devices is generally weak, the above wireless authentication execution process puts a lot of performance pressure on wireless access point devices. Taking a wireless access point device using a 560MHz (megahertz) single-core MIPS (Million Instructions PerSecond, the average execution speed of single-word fixed-point instructions, which is an indicator of CPU speed) CPU as an example, it takes 226ms (milliseconds) to find 1,000 pairwise master keys to generate the second pairwise temporary key and verify the message integrity check code. In the case of concurrent authentication of multiple wireless terminals, it takes a long time for the wireless access point device to respond to the authentication. The wireless terminal is prone to re-initiating a connection request due to the long time. The wireless terminal is always unable to complete the WPA / WPA2-PPSK authentication, resulting in serious network deterioration in the enterprise wireless LAN system.

[0052] The existing solution is to set up an access controller connected to the wireless access point device. The access controller can be, for example, a Radius server that supports 802.11X authentication (a wireless LAN protocol originated from the 802.11 protocol, used to solve the access authentication problem of wireless LAN users). During the authentication process, the processing operations originally performed by the wireless access point device will be transferred to the access controller for processing, thereby ensuring the stability of the enterprise wireless LAN system. However, the price of the access controller is very expensive, which is still a large cost burden for general enterprises, and the cost problem caused by purchasing access controllers is particularly obvious in large enterprises.

[0053] In order to solve the above problems, an embodiment of the present application proposes the following Figure 3 The enterprise wireless LAN system shown in Figure 1 is as follows. Figure 3As shown, the exemplary enterprise wireless LAN system includes a wireless terminal 10 , a wireless access point device 20 , a cloud server 30 , a firewall device 40 and a switch 50 .

[0054] It should be noted that Figure 3 The enterprise wireless LAN system shown is only an example adapted to the present application and cannot be considered to provide any limitation on the scope of use of the present application. The enterprise wireless LAN system cannot be interpreted as having Figure 3 One or more components in the exemplary enterprise wireless local area network system shown in FIG.

[0055] exist Figure 3 In the enterprise wireless LAN system shown, the wireless terminal 10 is usually a smart terminal held by enterprise employees, such as a smart phone, a tablet, a laptop computer, etc. The same employee can hold at least one wireless terminal 10.

[0056] The wireless access point device 20 is generally a device for providing a wireless local area network access point (AP), also known as a wireless switch or wireless router for a wireless local area network. After the wireless terminal 10 establishes a wireless communication connection with the wireless access point device 20, the employee can access the Internet through the wireless local area network provided by the wireless access point device 20. To facilitate network management for the enterprise, each wireless access point device 20 can be configured with the same service set identifier.

[0057] A wired or wireless communication connection is established between the wireless access point device 20 and the cloud server 30, such as Figure 3 As shown, the wireless access point device 20 can establish a wireless communication connection with the cloud server 30, and can also establish a wired communication connection with the cloud server 30 through the switch 50 and the firewall device 40 in sequence.

[0058] Based on the communication connection between the wireless access point device 20 and the cloud server 30, the cloud server 30 can provide network services to the wireless access point device 20. For example, since the performance of the wireless access device 20 is generally weak, when the wireless terminal 10 requests to access the wireless local area network provided by the wireless access point device 20, the cloud server 30 specifically performs the wireless local area network authentication process to avoid the problem that the wireless terminal 10 cannot connect to the wireless local area network due to the authentication failure caused by the weak performance of the wireless access point device 20. The enterprise does not need to purchase expensive access controllers, which greatly saves enterprise costs.

[0059] After the authentication is passed, the cloud server 30 also sends information related to the wireless terminal 10 to the wireless access point device 20, and the wireless access point device 20 associates and stores the information sent by the cloud server 30 with the terminal identification of the wireless terminal 10. The terminal identification of the wireless terminal 10 may include the MAC address (i.e., Media Access Control Address, also known as a local area network address, physical address, etc.) of the wireless terminal 10.

[0060] When the wireless terminal 10 requests to connect to the wireless local area network provided by the wireless access point device 20 again, the wireless access point device 20 can locally find information that the cloud server 30 has previously performed wireless local area network authentication on the wireless access point device 20 according to the terminal identification of the wireless terminal 10, and the authentication is passed, so the wireless access point device 20 directly connects to the wireless local area network with the wireless terminal 10, so that the wireless access point device 20 can quickly respond to the request of the wireless terminal 10 to connect to the wireless local area network.

[0061] It should be noted that the cloud server 30 can specifically be a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN (Content Delivery Network) and big data and artificial intelligence platforms, and is not restricted here.

[0062] Figure 4 is a flowchart of a wireless local area network authentication method shown in an exemplary embodiment of the present application. The wireless local area network authentication method can be applied to Figure 3 The enterprise wireless LAN system shown, for example, is composed of Figure 3 The cloud server 30 shown is specifically implemented. In other application scenarios, the wireless local area network authentication method can also be specifically implemented by other server devices, and this embodiment does not limit this.

[0063] like Figure 4 As shown, in an exemplary embodiment, the wireless local area network authentication method at least includes steps S110 to S150, which are described in detail as follows:

[0064] Step S110: receiving information to be authenticated sent by a wireless access point device, wherein the information to be authenticated includes verification information generated by a terminal to be authenticated.

[0065] First of all, it should be noted that the method provided in this embodiment can be used for Figure 2 In the wireless local area network authentication process shown, the terminal to be authenticated mentioned in this embodiment refers to a wireless terminal to be connected to the wireless local area network provided by the wireless access point device.

[0066] During the wireless LAN authentication process, due to the poor performance of the wireless access point device, after receiving the verification information transmitted by the terminal to be authenticated during the second handshake, the wireless access point device sends the authentication information to the cloud server.

[0067] The verification information is generated by the terminal to be authenticated, and may include, for example, a terminal random value and a message integrity check code generated by the terminal to be authenticated. In addition to the verification information, the information to be authenticated also includes parameter information required by the cloud server when verifying the verification information, such as the terminal identifier of the terminal to be authenticated, the access point random value generated by the wireless access point device itself, and the device identifier of the wireless access point device. The terminal identifier of the terminal to be authenticated may be the MAC address of the terminal to be authenticated, and the device identifier of the wireless access point device may be the MAC address of the wireless access point device.

[0068] As a result, the cloud server will receive the information to be authenticated sent by the access point device.

[0069] Step S130, obtaining a verification key that matches the terminal to be authenticated, and verifying the verification information according to the verification key.

[0070] The cloud server verifies the verification information, which is actually the verification of the message integrity check code contained in the verification information. The verification key is the key used to verify the message integrity check code contained in the verification information. The verification information can only be verified if the verification key matches the terminal to be authenticated.

[0071] The message integrity check code contained in the verification information is generated by the terminal to be authenticated according to the user input key, which may be a key pre-assigned to the user, such as a pre-shared key assigned to the user. It should be noted that the key assigned to each user is unique.

[0072] The process of the cloud server verifying the message integrity check code contained in the verification message is to generate a message integrity check code in the cloud server according to the process of generating the message integrity check code in the terminal to be authenticated. If the message integrity check code generated in the cloud server is consistent with the message integrity check code contained in the verification information, it means that the verification information has passed the verification. Therefore, the verification key matched with the terminal to be authenticated should be consistent with or associated with the user input key, so that the message integrity check code generated by the cloud server can be consistent with the message integrity check code contained in the verification information, and the verification information can also be verified in the cloud server.

[0073] Step S150: If the verification information passes the verification, the verification key is returned to the wireless access point device, so that the wireless access point device associates and stores the verification key with the terminal identification of the terminal to be authenticated.

[0074] If the cloud server successfully verifies the verification information, it returns the verification key to the wireless access point device, so that the wireless access point device knows that the cloud server has completed the verification of the verification information and can continue the subsequent authentication process with the terminal to be authenticated.

[0075] It should be noted that during the third handshake, the wireless access point device needs to send the group temporary key and the message integrity check code generated when the cloud server performs verification of the verification information to the terminal to be authenticated. Therefore, after the verification information passes the verification, the cloud server can also send the two pieces of information to the wireless access point device. Or in some embodiments, after the wireless access point device receives the verification key returned by the cloud server, it can also generate the information required to be sent to the terminal to be authenticated during the third handshake based on the received verification key itself.

[0076] After the wireless access point device receives the verification key returned by the cloud server, it will also associate the verification key with the terminal identification of the terminal to be authenticated and store it. When the same terminal to be authenticated connects to the wireless access point device again, the wireless access point device can find the associated stored verification key locally according to the terminal identification of the terminal to be authenticated, and the wireless access point device can determine that the terminal to be authenticated has completed the wireless LAN authentication process in advance, so the wireless access point device can directly transmit secure data streams with the terminal to be authenticated. Alternatively, the wireless access point device verifies the verification information sent by the terminal to be authenticated based on the verification key found in the associated storage. At this time, the wireless access point device only verifies the verification information sent by the terminal to be authenticated once, which also greatly reduces the performance pressure of the wireless access point.

[0077] It can be concluded that based on the method provided in this embodiment, the wireless access point device deployed in the enterprise wireless LAN system does not need to perform specific verification on the verification information received in the second handshake during the wireless LAN authentication process, and only needs to process a small amount of data in the wireless LAN authentication process. When a large number of wireless devices perform wireless LAN authentication concurrently, the wireless access point device can process data in a timely manner, and the wireless terminal will not resend the wireless LAN connection request to the access point device due to authentication timeout, thereby achieving the stability of the enterprise wireless LAN system.

[0078] At the same time, enterprises do not need to purchase expensive access controllers. Although it costs a certain amount of money for enterprises to obtain authentication services provided by cloud servers, compared with purchasing access controllers in bulk, the cost of obtaining software services is usually much less than the cost of purchasing hardware equipment. Therefore, the method provided in this embodiment also greatly reduces the deployment cost of the enterprise wireless LAN system.

[0079] In addition, the method of associating and storing the terminal identification of the terminal to be authenticated and the verification key matching the terminal to be authenticated in the wireless access point device also greatly improves the response of the wireless access point device to the wireless terminal's request to connect to the wireless local area network. According to the principle of locality, this embodiment can also effectively improve the connection efficiency of the entire enterprise wireless local area network system by optimizing the subsequent connection of wireless terminals that have been connected in the enterprise wireless local area network system.

[0080] exist Figure 5 In the exemplary embodiment shown, the verification key matching the terminal to be authenticated includes a pairwise master key, which is calculated by the cloud server based on the pre-shared key assigned to the user in the terminal to be authenticated and the service set identification code of the wireless access point.

[0081] Exemplarily, the HMAC (Hash-based Message Authentication Code, key-related hash operation message authentication code) algorithm can be used to derive the pre-shared key assigned by the cloud server to the user in the terminal to be authenticated and the service set identification code of the wireless access point device into a pair of master keys that match the terminal to be authenticated. For example, the pre-shared key assigned by the cloud server to the user in the terminal to be authenticated can be used as the user password (Password) parameter, and the service set identification code of the wireless access point device can be used as the salt (Salt) parameter. The key is derived according to the negotiated HMAC algorithm, and the cycle is repeated 4096 times. The key with a length of 32 bytes finally obtained is used as the pair of master keys that match the terminal to be authenticated.

[0082] The cloud server can configure the initialization information of the enterprise wireless LAN system based on the information of the enterprise employees and the information of the enterprise branches. The cloud server regards each employee as a user in the wireless LAN and generates a unique pre-shared key for each user. The cloud server also allocates a service set identification code to the enterprise and synchronizes the service set identification code to the wireless access point devices deployed in each branch structure of the enterprise, so that all wireless access point devices deployed in the enterprise have the same service set identification code, which facilitates the enterprise to manage the network.

[0083] The cloud server can calculate the pairwise master key of each user based on the pre-shared key corresponding to each user and the service set identification code corresponding to the enterprise. Therefore, in some embodiments, after completing the configuration of the initialization information, the cloud server can calculate the pairwise master key of each user, and the calculated pairwise master key can be associated and stored with the corresponding user information, which may include the user's mobile phone number, user WeChat ID, etc. When performing wireless LAN authentication processing, the cloud server can directly obtain the locally stored pairwise master key without the need to perform real-time calculation of the pairwise master key based on the pre-shared key and the service set identification code, thereby reducing the performance pressure of the cloud server in the process of performing wireless LAN authentication, and can also improve the connection efficiency of the entire enterprise wireless LAN system to a certain extent.

[0084] Since the cloud server cannot determine the user information of the user in the terminal to be authenticated, it is impossible to directly find the pairwise master key or pre-shared key that matches the user in the terminal to be authenticated locally, and therefore cannot directly verify the verification information. Figure 5 The embodiment shown proposes a scheme for verifying verification information based on a large number of pairwise master keys corresponding to users stored locally on the cloud server. It should be noted that if the cloud server does not pre-calculate and store the pairwise master keys corresponding to each user, when verifying the verification information, it is only necessary to add a step of calculating the pairwise master key based on the pre-shared key and the service set identification code.

[0085] like Figure 5 As shown, in an exemplary embodiment, obtaining a verification key matching the terminal to be authenticated, and verifying the verification information according to the verification key may include steps S210 to S250, which are described in detail as follows:

[0086] Step S210: Search the stored pairwise master key locally, and verify the verification information according to the pairwise master key obtained by the search.

[0087] First of all, it should be noted that the search process involved in this embodiment refers to searching for a pair of master keys stored locally in each round, and then verifying the verification information based on the found pair of master keys. If the verification fails, continue to search for the next pair of master keys to verify the verification information.

[0088] The verification information is generated by the terminal to be authenticated based on the key input by the user. Specifically, the message integrity check code contained in the verification information is generated by the terminal to be authenticated based on the key input by the user. The process of generating the message integrity check code in the terminal to be authenticated is usually as follows:

[0089] Generate a pairwise master key according to the key input by the user and the service set identification code of the wireless access point device, then generate a pairwise temporary key according to one or more of the generated pairwise master key, the terminal random value and terminal identification of the terminal to be authenticated, and the access point random value and device identification of the wireless access point device, then obtain a key for generating a message integrity check code from the pairwise temporary key, and encrypt the information to be sent by using the key for generating the message integrity check code to obtain the message integrity check code. The information to be sent includes at least the terminal random value generated by the terminal to be authenticated.

[0090] The process of generating a message integrity check code in the cloud server is similar to the process of generating a message integrity check code in the terminal to be authenticated, but there are also some differences, as follows:

[0091] The pairwise temporary key is calculated based on the pairwise group key found. The cloud server obtains at least one of the information related to the user input key from the terminal random value generated by the terminal to be authenticated, the terminal identification of the terminal to be authenticated, the access point random value generated by the wireless access point device, and the device identification of the wireless access point device from the information to be authenticated sent by the wireless access point device, and then performs a pseudo-random function operation based on the pairwise master key found and the information related to the user input key to obtain the pairwise temporary key.

[0092] Generate a message integrity check code based on the calculated pairwise temporary key. The cloud server obtains the key used to generate the message integrity check code based on the pairwise temporary key, and performs encryption operation on the message sent by the terminal to be authenticated based on the key used to generate the message integrity check code to obtain the message integrity check code. Among them, the key used to generate the message integrity check code is the specified sequence contained in the pairwise temporary key, and the message sent by the terminal to be authenticated includes the terminal random value generated by the terminal to be authenticated.

[0093] If the message integrity check code generated by the cloud server is consistent with the message integrity check code contained in the verification information, it means that the key input by the user is a legitimate key pre-assigned to the user by the cloud server, so the cloud server verifies the verification information successfully.

[0094] Step S230, if the verification information fails to be verified, the next round of pairwise master key search is performed, and the verification information is verified according to the pairwise master key found, until the verification information is successfully verified, and the pairwise master key that successfully verifies the verification information is used as the verification key that matches the terminal to be authenticated.

[0095] If the user input key is the pre-shared key assigned by the cloud server to the legitimate user, then the cloud server must be able to find the pairwise master key that can verify the verification information locally, and this pairwise master key is used as the verification key that matches the terminal to be authenticated. Among them, the user input key is usually the key entered by the user when using the Wi-Fi function of the terminal to be authenticated.

[0096] Step S250: If all the pairwise master keys cannot be successfully verified for the verification information, a message indicating that the authentication has failed is returned to the wireless access point device.

[0097] If all paired master keys cannot be successfully verified, it means that the key entered by the user is not the pre-shared key assigned by the cloud server to the legitimate user, that is, the user using the terminal to be authenticated is not a legitimate user, and the cloud server needs to return a message of authentication failure to the wireless access point. If the terminal to be authenticated cannot complete the wireless LAN authentication, it cannot establish a connection with the wireless LAN, thereby achieving the security of the enterprise wireless LAN.

[0098] It should be noted that, considering that there may be new or deleted personnel in the enterprise at any time, the cloud server supports the change of initialization information after completing the configuration of initialization information, usually including the change of the user's personal pre-shared key, thereby adapting to the actual needs of the enterprise for the wireless LAN.

[0099] exist Figure 6 In the exemplary embodiment shown, after the cloud server verifies the verification information, it also associates and stores the verification key that matches the terminal to be authenticated and the terminal identification of the terminal to be authenticated, so as to form information storage of the verification key and the terminal identification for the wireless terminal that has been connected to the enterprise wireless LAN in the cloud server. The verification key that matches the terminal to be authenticated is, for example, a pair master key that verifies the verification information.

[0100] Before obtaining the verification key that matches the terminal to be authenticated and verifying the verification information according to the verification key, the cloud server also executes Figure 6 Steps S310 to S350 are described in detail as follows:

[0101] Step S310: searching locally for a verification key stored in association with a terminal identifier of the terminal to be authenticated.

[0102] In this embodiment, if a verification key associated with the terminal identification of the terminal to be authenticated is found locally, it can be determined that the terminal to be authenticated has been connected to the enterprise wireless LAN, and the security of the enterprise wireless LAN can be guaranteed without wireless LAN authentication, so the content of step S350 is executed.

[0103] If the verification key associated with the terminal identification of the terminal to be authenticated is not found locally, it means that the terminal to be authenticated is requesting to connect to the enterprise wireless LAN for the first time, and wireless LAN authentication must be performed to ensure the security of the enterprise wireless LAN, so the content of step S330 is executed.

[0104] Step S330: If the verification key is not found, a step of obtaining a verification key that matches the terminal to be authenticated and verifying the verification information according to the verification key is executed.

[0105] The cloud server obtains the verification key that matches the terminal to be authenticated, and the detailed process of verifying the verification information according to the verification key can be found in detail. Figure 5 Step S210 in the illustrated embodiment will not be described in detail here.

[0106] Step S350: If the verification key is found, it is determined that the verification information has passed the verification.

[0107] If the cloud server finds the verification key, it returns the verification key to the wireless access point device, so that the wireless access point device verification key is associated and stored with the terminal identification of the terminal to be authenticated. For detailed process, please refer to Figure 4 Step S150 in the illustrated embodiment will not be described in detail here.

[0108] Therefore, in the method provided in this embodiment, the cloud server obtains the verification key that matches the terminal to be authenticated and verifies the verification information according to the verification key. It pre-searches and finds the verification key stored in local memory that is associated with the terminal identification of the terminal to be authenticated. When it is determined that the terminal to be authenticated has been connected to the enterprise wireless LAN, there is no need to repeat the wireless LAN authentication process for the terminal to be authenticated, which greatly reduces the performance pressure of the cloud server and can also greatly improve the connection efficiency of the entire enterprise wireless LAN system.

[0109] Figure 7 is another exemplary flowchart of the wireless local area network authentication method of the present application. The wireless local area network authentication method can also be applied to Figure 3 The enterprise wireless LAN system shown, for example, is composed of Figure 3 The wireless access server 20 shown in the figure specifically performs the above operations. In other application scenarios, the wireless local area network authentication method may also be specifically performed by other wireless access point devices, and this embodiment does not limit this.

[0110] like Figure 7 As shown, in an exemplary embodiment, the wireless local area network authentication method at least includes steps S410 to S470, which are described in detail as follows:

[0111] Step S410, when a wireless LAN connection request is received from the terminal to be authenticated, a verification key associated with the terminal identifier is searched locally according to the terminal identifier of the terminal to be authenticated, wherein the verification key associated with the terminal identifier is issued by the cloud server after receiving the information to be authenticated sent historically by the wireless access point device, by obtaining the verification key matching the terminal to be authenticated, and verifying the verification information contained in the information to be authenticated according to the obtained verification key, and the verification information is generated by the terminal to be authenticated.

[0112] The terminal to be authenticated sends a wireless local area network connection request to the wireless access point device, which may be the case when the terminal to be authenticated executes Figure 1 After the scanning process shown, after selecting the wireless local area network to be joined in the wireless network list updated by itself, the wireless access point device corresponding to the selected wireless local area network is initiated.

[0113] The terminal identification of the terminal to be authenticated can be carried in the wireless local area network connection request sent by the terminal to be authenticated, or in the execution Figure 1 In the scanning process shown, the wireless access point device can also obtain the terminal identification of the terminal to be authenticated. The terminal identification of the terminal to be authenticated can be the MAC address of the terminal to be authenticated.

[0114] like Figure 4 In the illustrated embodiment, due to the poor performance of the wireless access point device, after the wireless access point obtains the verification information sent by the terminal to be authenticated during the second handshake, it will send the information to be authenticated to the cloud server, and carry the verification information sent by the terminal to be authenticated in the information to be authenticated, so that the cloud server can verify the verification information. Among them, the verification information is generated by the terminal to be authenticated, and the message integrity check code contained in the verification information is generated by the terminal to be authenticated based on the user input key. After the cloud server searches for the verification key stored in itself and verifies the verification information, it will return the verification key to the wireless access point device, so that the wireless access point device associates the verification key with the terminal identifier of the terminal to be authenticated and stores it.

[0115] Therefore, the wireless access point device stores information related to the terminal to be authenticated that has been connected to the enterprise wireless local area network. When the wireless access point device receives the wireless local area network connection request sent by the terminal to be authenticated, it first searches for the verification key associated with the terminal identifier locally according to the terminal identifier of the terminal to be authenticated. If this verification key is found, it means that the terminal to be authenticated that initiated the wireless local area network connection request has been connected to the enterprise wireless local area network, so the content described in step S430 can be executed.

[0116] If the verification key is not found, it means that the terminal to be authenticated that initiates the wireless LAN connection request is requesting to establish a wireless LAN connection with the wireless access point device for the first time, and the wireless LAN authentication process needs to be performed, so the contents described in steps S450 to S470 are executed.

[0117] Step S430: If the verification key associated with the terminal identification is found, a wireless local area network connection is established with the terminal to be authenticated in response to the wireless local area network connection request.

[0118] Since the terminal to be authenticated and the wireless access point device are both installed with a pair of temporary keys for encrypting unicast data streams and a group temporary key for encrypting broadcast and leased data streams when performing wireless LAN authentication for the first time, the wireless access point device responds to the wireless LAN connection request, establishes a wireless LAN connection with the terminal to be authenticated, and can then transmit encrypted data streams with the terminal to be authenticated.

[0119] Step S450: If the verification key associated with the terminal identifier is not found, the information to be authenticated is sent to the cloud service end, and the information to be authenticated contains the verification information generated by the terminal to be authenticated.

[0120] Step S470, receiving the pairwise master key matching the terminal to be authenticated returned by the cloud server after the authentication information is authenticated, taking the pairwise master key returned by the cloud server as the authentication key, and storing it in association with the terminal identification of the terminal to be authenticated.

[0121] It should be noted that the detailed process of step S450 and step S470 can be found in Figure 4 The contents described in the illustrated embodiment will not be repeated here.

[0122] It can be seen from the above that, through the method provided in this embodiment, any wireless access point device deployed in the enterprise wireless LAN system does not need to verify the verification information generated by the terminal to be authenticated. Instead, the process of verifying the verification information generated by the terminal to be authenticated is transferred to the cloud for execution. The enterprise does not need to purchase expensive access controllers, and can effectively solve the problems existing in the prior art.

[0123] The present application also provides that information related to the terminal to be authenticated that has been connected to the enterprise wireless local area network is stored in the wireless access point device, and when a wireless LAN connection request sent by the terminal to be authenticated is received, the wireless access point device preferentially determines whether the terminal to be authenticated that initiates the request is a terminal to be authenticated that has been connected to the enterprise wireless local area network. If so, a wireless LAN connection is directly established with the terminal to be authenticated. This technical means greatly reduces the performance pressure of the cloud server, realizes a fast connection between the wireless terminal and the wireless access point device, and greatly improves the connection efficiency of the entire enterprise wireless LAN system.

[0124] In addition, in the present embodiment, the wireless access point device will only store the information of the wireless terminal that has been connected to the wireless local area network, and will not synchronously store all the wireless terminals that have been connected in the enterprise, which can reduce the data redundancy in the wireless access point and the time consumed by the wireless access point device to find the verification key associated with the terminal identification of the wireless terminal, thereby alleviating the performance pressure of the wireless access point device itself and improving the connection rate between the wireless terminal and the wireless access point device.

[0125] It should also be noted that in some other embodiments, for example, when the performance of the wireless access point device itself is good, the wireless access point device can also store all connected wireless terminals in the enterprise, and this is not limited here.

[0126] exist Figure 8 In the exemplary embodiment shown, the wireless access point device further performs steps S510 to S550, which are described in detail as follows:

[0127] Step S510: after finding the verification key associated with the terminal identification of the terminal to be authenticated, a pairwise temporary key is calculated according to the verification key associated with the terminal identification.

[0128] In this embodiment, the wireless local area network authentication process still needs to be performed between the terminal to be authenticated and the wireless access point device. After the wireless access point device finds the verification key associated with the terminal identifier of the terminal to be authenticated, it locally verifies the verification information sent by the terminal to be authenticated according to the found verification key.

[0129] Therefore, the wireless access point device needs to calculate the pairwise temporary key according to the verification key found. For the detailed calculation process, please refer to the process of generating the pairwise temporary key by the cloud server recorded in the above embodiment, which will not be described in detail here.

[0130] Step S530: Obtain a message integrity check code based on the calculated pairwise temporary key.

[0131] After calculating the pairwise temporary key, the wireless access point device also needs to generate a message integrity check code to verify the message integrity check code contained in the verification information according to the message integrity check code generated by itself, so as to realize the verification of the verification information. The detailed calculation process still refers to the process of generating the message integrity check code by the cloud server recorded in the above embodiment, and will not be repeated here.

[0132] Step S550, verifying the user input key according to the message integrity check code, and if the verification is successful, executing the step of establishing a wireless local area network connection with the terminal to be authenticated in response to the wireless local area network connection request.

[0133] Since the message integrity check code contained in the verification information is generated by the terminal to be authenticated based on the user input key, the wireless access point device compares the message integrity check code generated by itself with the message integrity check code contained in the verification information after generating the message integrity check code. If the two are consistent, it means that the user input key is the pre-shared key entered by the legitimate user, and the verification information passes the verification.

[0134] After the verification information is verified, the wireless access point device can perform a subsequent wireless LAN connection process with the terminal to be authenticated, and establish a wireless LAN connection with the terminal to be authenticated.

[0135] It can be seen that in the method provided in this embodiment, a complete wireless local area network authentication process will be performed between the wireless access point device and the wireless terminal, that is, Figure 2 The four-way handshake process shown. The wireless access point device verifies the verification information sent by the terminal to be authenticated according to the verification key stored in the associated storage. At this time, the wireless access point device only verifies the verification information sent by the terminal to be authenticated once. Compared with the existing technical implementation scheme in which the wireless access point device needs to search for and execute the verification information verification process multiple times, the scheme of this embodiment also greatly reduces the performance pressure of the wireless access point, and can ensure the stability and security of the enterprise wireless local area network.

[0136] Based on the above embodiments, we can get Fig. 9 The enterprise wireless LAN system architecture is shown in Figure 1.

[0137] like Fig. 9 As shown, the architecture of the enterprise wireless LAN system can be divided into the edge and the cloud. The edge includes multiple wireless access point devices for providing entry points for the enterprise core network, and the cloud provides wireless access point services to the wireless access point devices at the edge through cloud servers.

[0138] The cloud server includes one or more functional modules including access service, key management, device management, application service, address book and enterprise configuration. The access service module is used to connect to the wireless access point device and maintain the relevant heartbeat. The device management module is used to manage the relevant information of the connected wireless access point device, such as the enterprise to which the wireless access point device belongs. The enterprise configuration module is used to manage the wireless access point configuration information related to each enterprise, for example, the service set identification codes of different enterprises are different. The address book module is used to record the information of enterprise employees, such as mobile phone numbers or WeChat accounts. The application service module is used to provide relevant information of API (Application Programming Interface) to the outside world.

[0139] It is worth mentioning that the key management module is used to generate, delete and update key information. For example, when a new employee is added to the enterprise, a unique pre-shared key must be assigned to the new employee. When an employee leaves the enterprise, the information related to the employee is deleted accordingly. The key management module is also used to cache the paired master keys (i.e. Fig. 9 PMK cache shown) and the associated cache of the terminal identification and the pairwise master key of the wireless terminal (ie Fig. 9 MAC-PMK cache as shown). PMK cache means that the cloud server will generate a pair of master keys for each employee in the enterprise based on the pre-shared key of each employee and the service set identification code corresponding to the enterprise, and store the pair of master keys of each employee locally. MAC-PMK cache means that the pair of master keys generated for the verification information generated for the wireless terminal are stored locally in association with the terminal identification of this wireless terminal.

[0140] The wireless access point device at the edge is connected to the cloud server and receives the access point information configured by the cloud server, such as the service set identification code. Each wireless access point device belonging to the same enterprise can have the same service set identification code, receive key distribution and management from the cloud server, receive connection information of wireless terminals, etc. The wireless access point device also performs MAC-PMK cache locally.

[0141] exist Fig. 9 In the enterprise wireless LAN system architecture shown, a multi-level key caching mechanism is provided, as follows:

[0142] 1. The wireless access point device performs MAC-PMK caching, so that the wireless access point device can quickly authenticate the wireless LAN locally;

[0143] 2. MAC-PMK caching in the cloud enables fast wireless LAN authentication in the cloud;

[0144] 3. PMK caching is performed in the cloud, so that the cloud can achieve fast authentication of wireless LAN.

[0145] It should be noted that the detailed implementation process of the above multi-level key caching mechanism can be found in Figures 4 to 8 The contents described in the illustrated embodiment will not be repeated here. By setting the above multi-level key caching mechanism, the enterprise wireless local area network can easily cope with the wireless local area network connection needs of a large number of employees, and can be applied to enterprises with more than 1,000 employees. In actual applications, at least one key caching mechanism can also be selected according to actual conditions, and this is not limited here.

[0146] Figures 10 to 12It is a schematic diagram of three exemplary application scenarios shown in the embodiments of the present application, so as to facilitate the understanding of the application of the wireless local area network authentication method provided by the present application in the enterprise wireless local area network system, and further facilitate the understanding of the technical solution of the present application.

[0147] exist Fig.10 In the exemplary application scenario shown, employee B uses a wireless terminal to connect to the AP device (i.e., wireless access point device) of enterprise branch 2 for the first time. The AP device of branch 2 sends the authentication information to the cloud server, so that the cloud server verifies the verification information in the authentication information. The verification information is generated by employee B's wireless terminal according to the key input by the user. The cloud server needs to return the verification result to the AP device of branch 2. If the verification is successful, the cloud server returns the pairwise master key PMK for the verification information. If the verification fails, it returns a message of verification failure. The AP device of branch 2 caches the MAC-PMK information locally based on the pairwise master key issued by the cloud server and the MAC address of employee B's wireless terminal, and returns the connection result to employee B's wireless terminal based on the verification result returned by the cloud server.

[0148] In addition, employee A uses a wireless terminal to connect to the AP device of enterprise branch 1 for the first time, and employee C uses a wireless terminal to connect to the AP device of enterprise branch 3 for the first time. The detailed connection process is the same as the above-mentioned employee B uses a wireless terminal to connect to the AP device of enterprise branch 2 for the first time.

[0149] exist Fig.11 In the exemplary application scenario shown, employee B uses a wireless terminal to connect to the AP device of enterprise branch 2 again. Since the AP device of branch 2 stores the MAC-PMK information corresponding to employee B's wireless terminal, the AP device of branch 2 can directly establish a connection with employee B's wireless terminal, or use this paired master key PMK to verify the verification information sent by employee B's wireless terminal. After the verification is passed, a connection is established with employee B's wireless terminal.

[0150] exist Fig.12 In the exemplary application scenario shown, employee A uses a wireless terminal to connect to the AP device of enterprise branch 2 for the first time. Since the AP device of branch 2 does not store the MAC-PMK information corresponding to this wireless terminal, the verification information sent by employee A's wireless terminal needs to be verified through the cloud server.

[0151] From this, it can be seen that the technical solution provided in this application realizes efficient connection and management of enterprise wireless LANs by coordinating enterprise edge AP devices with cloud AP services and setting up a multi-level key caching mechanism. It can greatly meet the large number of wireless LAN connection needs in the enterprise, and also meet the wireless LAN connection needs of the branch structure in the enterprise.

[0152] Fig.13 FIG. 1 is a block diagram of a wireless local area network authentication device shown in an exemplary embodiment of the present application. Fig.13 As shown, the device comprises:

[0153] The authentication information receiving module 610 is configured to receive the authentication information sent by the wireless access point device, wherein the authentication information includes the verification information generated by the terminal to be authenticated; the key acquisition and verification module 630 is configured to obtain the verification key matching the terminal to be authenticated, and verify the verification information according to the verification key; the key information returning module 650 is configured to return the verification key to the wireless access point device if the verification information passes the verification, so that the wireless access point device associates the verification key with the terminal identification of the terminal to be authenticated and stores it.

[0154] In another exemplary embodiment, the device also includes:

[0155] The first local search unit is configured to locally search for a verification key stored in association with a terminal identifier of the terminal to be authenticated; the first response unit is configured to, if the verification key is not found, execute the steps of obtaining a verification key that matches the terminal to be authenticated and verifying the verification information according to the verification key; the second response unit is configured to, if the verification key is found, determine that the verification information has passed the verification.

[0156] In another exemplary embodiment, the verification key includes a pairwise master key; the key acquisition and verification module 630 includes:

[0157] The second local search unit is configured to search for the stored pairwise master key locally and verify the verification information based on the pairwise master key obtained by the search; the third response unit is configured to perform the next round of pairwise master key search if the verification information verification fails, and verify the verification information based on the pairwise master key obtained by the search until the verification information verification succeeds; the fourth search unit is configured to use the pairwise master key that has successfully verified the verification information as the verification key that matches the terminal to be authenticated.

[0158] In another exemplary embodiment, the verification information is generated by the terminal to be authenticated based on a key input by a user; and the second local search unit includes:

[0159] The pairwise temporary key calculation subunit is configured to calculate the pairwise temporary key based on the pairwise master key obtained by the search; the message integrity check code calculation subunit is configured to obtain the message integrity check code based on the calculated pairwise temporary key; the message integrity check code verification subunit is configured to verify the user input key based on the message integrity check code, and if the verification passes, it is determined that the verification information passes the verification.

[0160] In another exemplary embodiment, the pairwise temporary key calculation subunit includes:

[0161] The relevant information acquisition subunit is configured to obtain at least one of the terminal random value generated by the terminal to be authenticated, the terminal identification of the terminal to be authenticated, the access point random value generated by the wireless access point device, and the device identification of the wireless access point device, which is related to the user input key from the information to be authenticated; the pseudo-random function operation subunit is configured to perform a pseudo-random function operation based on the found pairwise master key and the information related to the user input key to obtain a pairwise temporary key.

[0162] In another exemplary embodiment, the message integrity check code calculation subunit includes:

[0163] The key acquisition subunit is configured to obtain a key for generating a message integrity check code based on a paired temporary key; the encryption operation subunit is configured to perform an encryption operation on a message sent by the terminal to be authenticated based on the key for generating the message integrity check code to obtain a message integrity check code, wherein the message sent by the terminal to be authenticated includes a terminal random value generated by the terminal to be authenticated.

[0164] In another exemplary embodiment, the apparatus further comprises:

[0165] The associated storage module is configured to associate and store the verification key matching the authentication terminal with the terminal identification of the terminal to be authenticated.

[0166] In another exemplary embodiment, the apparatus further comprises:

[0167] An initialization configuration module is configured to configure initialization information, wherein the initialization information includes a unique pre-shared key for each user in the enterprise and a service set identification code corresponding to the enterprise, wherein all wireless access point devices deployed in the enterprise have the same service set identification code; a key calculation and storage module is configured to calculate the verification key of each user according to the unique pre-shared key for each user in the enterprise and the service set identification code corresponding to the enterprise, and locally store the verification key of each user.

[0168] Fig.14 FIG. 1 is a block diagram of a wireless local area network authentication device shown in another exemplary embodiment of the present application. Fig.14 As shown, the device comprises:

[0169] The verification key search module 710 is configured to search for a verification key associated with the terminal identifier locally according to the terminal identifier of the terminal to be authenticated when verification information sent by the terminal to be authenticated is received, wherein the verification key associated with the terminal identifier is issued by the cloud server after receiving the information to be authenticated historically sent by the wireless access point device, by obtaining a verification key matching the terminal to be authenticated, and verifying the verification information contained in the historically sent information to be authenticated according to the obtained verification key; the request response module 730 is configured to establish a wireless LAN connection with the terminal to be authenticated in response to the wireless LAN connection request if the verification key associated with the terminal identifier is found.

[0170] In another exemplary embodiment, the apparatus further comprises:

[0171] The module for sending information to be authenticated is configured to send the information to be authenticated to the cloud server if the verification key associated with the terminal identification is not found, and the information to be authenticated contains the verification information generated by the terminal to be authenticated; the module for receiving paired master keys is configured to receive the paired master key matching the terminal to be authenticated returned by the cloud server after the verification information is successfully verified; the module for associating and storing paired master keys is configured to use the paired master key returned by the cloud server as the verification key, and associate it with the terminal identification of the terminal to be authenticated and store it.

[0172] In another exemplary embodiment, the verification information is generated by the terminal to be authenticated based on a key input by a user; the device further includes:

[0173] The pairwise temporary key acquisition module is configured to calculate the pairwise temporary key based on the verification key associated with the terminal identification; the message integrity check code acquisition module is configured to obtain the message integrity check code based on the calculated pairwise temporary key; the verification pass response module is configured to verify the user input key based on the message integrity check code, and if the verification passes, execute the step of establishing a wireless local area network connection with the terminal to be authenticated in response to the wireless local area network connection request.

[0174] It should be noted that the device provided in the above embodiment and the method provided in the above embodiment belong to the same concept, wherein the specific manner in which each module and unit performs the operation has been described in detail in the method embodiment and will not be repeated here.

[0175] It should also be noted that when the device provided in the above embodiment is deployed to an enterprise wireless LAN system, the wireless terminal will not resend the wireless LAN connection request to the access point device due to authentication timeout, and the enterprise does not need to purchase expensive access controllers. The stability of the enterprise wireless LAN system can be achieved, and the enterprise wireless LAN system can also obtain very high connection efficiency.

[0176] An embodiment of the present application further provides an electronic device, including a processor and a memory, wherein the memory stores computer-readable instructions, and when the computer-readable instructions are executed by the processor, the wireless local area network authentication method as described above is implemented.

[0177] Fig.15 A schematic diagram of the structure of a computer system suitable for implementing an electronic device of an embodiment of the present application is shown.

[0178] It should be noted that Fig.15 The computer system 1600 of the electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0179] like Fig.15 As shown, the computer system 1600 includes a central processing unit (CPU) 1601, which can perform various appropriate actions and processes according to the program stored in the read-only memory (ROM) 1602 or the program loaded from the storage part 1608 to the random access memory (RAM) 1603, such as executing the method described in the above embodiment. In RAM 1603, various programs and data required for system operation are also stored. CPU 1601, ROM 1602 and RAM 1603 are connected to each other through bus 1604. Input / output (I / O) interface 1605 is also connected to bus 1604.

[0180] The following components are connected to the I / O interface 1605: an input section 1606 including a keyboard, a mouse, etc.; an output section 1607 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 1608 including a hard disk, etc.; and a communication section 1609 including a network interface card such as a LAN (Local Area Network) card, a modem, etc. The communication section 1609 performs communication processing via a network such as the Internet. A drive 1610 is also connected to the I / O interface 1605 as needed. A removable medium 1611, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 1610 as needed so that a computer program read therefrom is installed into the storage section 1608 as needed.

[0181] In particular, according to an embodiment of the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present application includes a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a computer program for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication section 1609, and / or installed from a removable medium 1611. When the computer program is executed by a central processing unit (CPU) 1601, various functions defined in the system of the present application are executed.

[0182] It should be noted that the computer-readable medium shown in the embodiment of the present application can be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium can be, for example, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media can include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM), a flash memory, an optical fiber, a portable compact disk read-only memory (Compact Disc Read-Only Memory, CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0183] The units involved in the embodiments described in this application may be implemented by software or hardware, and the units described may also be set in a processor. The names of these units do not constitute limitations on the units themselves in some cases.

[0184] Another aspect of the present application also provides a computer-readable storage medium on which a computer program is stored, and when the computer program is executed by a processor, the wireless local area network authentication method as described above is implemented. The computer-readable storage medium can be included in the electronic device described in the above embodiment, or it can exist independently without being assembled into the electronic device.

[0185] Another aspect of the present application also provides a computer program product or a computer program, which includes a computer instruction stored in a computer-readable storage medium. A processor of a computer device reads the computer instruction from the computer-readable storage medium, and the processor executes the computer instruction, so that the computer device executes the wireless local area network authentication method provided in each of the above embodiments.

[0186] The above content is only a preferred exemplary embodiment of the present application and is not intended to limit the implementation scheme of the present application. A person skilled in the art can easily make corresponding changes or modifications based on the main concept and spirit of the present application. Therefore, the scope of protection of the present application shall be based on the scope of protection required by the claims.

Claims

1. A wireless local area network authentication method, characterized in that: The method comprises: Receiving information to be authenticated sent by a wireless access point device, wherein the information to be authenticated includes verification information generated by a terminal to be authenticated and a terminal identifier of the terminal to be authenticated; Searching locally for a verification key stored in association with the terminal identification of the terminal to be authenticated; If the verification key associated with the terminal identification of the terminal to be authenticated is found, it is determined that the verification information passes the verification; If the verification key associated with the terminal identification of the terminal to be authenticated is not found, searching for the stored pairwise master key locally, and verifying the verification information according to the found pairwise master key; If the verification of the verification information fails, the next round of pairwise master key search is performed, and the verification information is verified according to the pairwise master key found, until the verification of the verification information succeeds, the pairwise master key successfully verified for the verification information is used as the verification key matching the terminal to be authenticated, and the verification key matching the terminal to be authenticated is associated with the terminal identification of the terminal to be authenticated and stored; If the verification information cannot be successfully verified by searching all the pairwise master keys, a message of authentication failure is returned to the wireless access point device; If the verification information passes the verification, the verification key is returned to the wireless access point device, so that the wireless access point device associates and stores the verification key with the terminal identification of the terminal to be authenticated.

2. The method according to claim 1, characterized in that The verification information is generated by the terminal to be authenticated based on a key input by a user; The locally searching for the stored pairwise master key and verifying the verification information according to the pairwise master key obtained by searching includes: Calculate the pairwise temporary key based on the pairwise master key found; Obtain a message integrity check code based on the calculated pairwise temporary key; The user input key is verified according to the message integrity check code, and if the verification passes, it is determined that the verification information passes the verification.

3. The method according to claim 2, characterized in that The step of calculating the pairwise temporary key according to the pairwise master key obtained by searching includes: Acquire at least one of the following information related to the user input key: a terminal random value generated by the terminal to be authenticated, a terminal identifier of the terminal to be authenticated, an access point random value generated by the wireless access point device, and a device identifier of the wireless access point device from the information to be authenticated; A pseudo-random function operation is performed according to the pairwise master key obtained by the search and information related to the user input key to obtain the pairwise temporary key.

4. The method according to claim 2, characterized in that: The message integrity check code is obtained based on the calculated pairwise temporary key, including: Obtaining a key for generating a message integrity check code according to the pairwise temporary key; According to the key for generating a message integrity check code, an encryption operation is performed on the message sent by the terminal to be authenticated to obtain the message integrity check code, wherein the message sent by the terminal to be authenticated includes a terminal random value generated by the terminal to be authenticated.

5. The method according to claim 1, characterized in that Before receiving the information to be authenticated forwarded by the wireless access point device, the method further includes: Configure initialization information, the initialization information including a unique pre-shared key for each user in the enterprise and a service set identifier corresponding to the enterprise, wherein all wireless access point devices deployed in the enterprise have the same service set identifier; According to the unique pre-shared key of each user in the enterprise and the service set identification code corresponding to the enterprise, the verification key of each user is calculated respectively, and the verification key of each user is stored locally.

6. A wireless local area network authentication method, characterized in that: The method comprises: When receiving a wireless local area network connection request sent by a terminal to be authenticated, searching locally for a verification key associated with the terminal identifier of the terminal to be authenticated, wherein the verification key associated with the terminal identifier is issued by the cloud server after verifying the verification information contained in the information to be authenticated historically sent by the wireless access point device by executing the steps in the method described in any one of claims 1 to 5, and the verification information is generated by the terminal to be authenticated; If the verification key associated with the terminal identification is found, a wireless local area network connection is established with the terminal to be authenticated in response to the wireless local area network connection request.

7. The method according to claim 6, characterized in that The method further comprises: If the verification key associated with the terminal identifier is not found, sending the information to be authenticated to the cloud service end, wherein the information to be authenticated contains the verification information generated by the terminal to be authenticated; Receiving a pairwise master key matching the terminal to be authenticated, which is returned by the cloud service end after the authentication information is successfully authenticated; The paired master key returned by the cloud service end is used as a verification key and stored in association with the terminal identification of the terminal to be authenticated.

8. The method according to claim 6, characterized in that The verification information is generated by the terminal to be authenticated based on a key input by a user; After finding the verification key associated with the terminal identification, the method further includes: Calculating a pairwise temporary key based on a verification key associated with the terminal identification; Obtain a message integrity check code based on the calculated pairwise temporary key; The user input key is verified according to the message integrity check code, and if the verification is successful, the step of establishing a wireless local area network connection with the terminal to be authenticated in response to the wireless local area network connection request is executed.

9. A wireless local area network authentication device, characterized in that: The device comprises: The authentication information receiving module is configured to receive the authentication information sent by the wireless access point device, wherein the authentication information includes the verification information generated by the authentication terminal and the terminal identification of the authentication terminal; A key acquisition and verification module, configured to search locally for a verification key stored in association with a terminal identification of the terminal to be authenticated; if a verification key associated with the terminal identification of the terminal to be authenticated is found, it is determined that the verification information has passed the verification; if the verification key associated with the terminal identification of the terminal to be authenticated is not found, the stored pairwise master key is searched locally, and the verification information is verified according to the pairwise master key found; if the verification information verification fails, the next round of pairwise master key search is performed, and the verification information is verified according to the pairwise master key found, until the verification information verification succeeds, the pairwise master key successfully verified for the verification information is used as the verification key matching the terminal to be authenticated, and the verification key matching the terminal to be authenticated is stored in association with the terminal identification of the terminal to be authenticated; if the verification information cannot be successfully verified by searching all the pairwise master keys, a message of authentication failure is returned to the wireless access point device; The key information returning module is configured to return the verification key to the wireless access point device if the verification information passes the verification, so that the wireless access point device associates and stores the verification key with the terminal identification of the terminal to be authenticated.

10. A wireless local area network authentication device, characterized in that: The device comprises: A verification key search module, configured to search for a verification key associated with the terminal identifier locally according to the terminal identifier of the terminal to be authenticated when receiving the verification information sent by the terminal to be authenticated, wherein the verification key associated with the terminal identifier is issued by the cloud server after verifying the verification information contained in the information to be authenticated historically sent by the wireless access point device by executing the steps in any one of the methods of claims 1 to 5; The request response module is configured to establish a wireless local area network connection with the terminal to be authenticated in response to the wireless local area network connection request if a verification key associated with the terminal identification is found.

11. An electronic device, characterized in that: include: a memory storing computer-readable instructions; A processor reads the computer-readable instructions stored in the memory to execute the method according to any one of claims 1 to 8.

12. A computer-readable storage medium, characterized in that: Computer-readable instructions are stored thereon, and when the computer-readable instructions are executed by a processor of a computer, the computer is caused to execute the method according to any one of claims 1 to 8.

13. A computer program product, characterized in that comprising computer instructions stored in a computer-readable storage medium; A processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device executes the method according to any one of claims 1 to 8.

Images