Network connection management method, device, computer readable medium and electronic device

Abstract

The embodiments of the present application provide a network connection management method, device, computer-readable medium and electronic device. The network connection management method includes: receiving a dynamic key for connecting to an access point device; if an access request containing the dynamic key is received from a site device, responding to the access request and establishing a connection with the site device; after successfully establishing a connection with the site device, associating the physical address of the site device with the dynamic key to generate an association relationship between the physical address and the dynamic key; passing the association relationship to other access point devices so that the other access point devices verify the access request initiated by the site device based on the dynamic key according to the association relationship. The technical solution of the embodiments of the present application can improve the access efficiency of the site device to the access point device.

Description

Technical Field

[0001] The present application relates to the field of computer and communication technology, and in particular to a network connection management method, device, computer-readable medium and electronic device. Background Art

[0002] With the development of WLAN (Wireless Local Area Network) technology, in some application scenarios, a large number of station devices (i.e., Station, STA) are required to access AP (Access Point), such as enterprise-level WLAN. In this application scenario, how to effectively manage the network connection of station devices is a technical problem that needs to be solved urgently. Summary of the invention

[0003] The embodiments of the present application provide a network connection management method, device, computer-readable medium and electronic device, which can improve the access efficiency of a site device to an access point device at least to a certain extent.

[0004] Other features and advantages of the present application will become apparent from the following detailed description, or may be learned in part by the practice of the present application.

[0005] According to one aspect of an embodiment of the present application, a network connection management method is provided, including: receiving a dynamic key for connecting to an access point device; if an access request including the dynamic key is received from a site device, responding to the access request and establishing a connection with the site device; after successfully establishing a connection with the site device, associating a physical address of the site device with the dynamic key to generate an association relationship between the physical address and the dynamic key; and transmitting the association relationship to other access point devices so that the other access point devices verify the access request initiated by the site device based on the dynamic key according to the association relationship.

[0006] According to one aspect of an embodiment of the present application, a network connection management method is provided, comprising: in response to a key application request, allocating a dynamic key for connecting to an access point device; sending the dynamic key to the access point device and the initiator of the key application request, so that the access point device verifies the received access request based on the dynamic key; receiving an association relationship between a physical address sent by the access point device and the dynamic key, the physical address being an address owned by a site device that successfully accesses the access point device based on the dynamic key; sending the association relationship to other access point devices, so that the other access point devices verify the access request initiated by the site device based on the dynamic key based on the association relationship.

[0007] According to one aspect of an embodiment of the present application, a network connection management method is provided, including: receiving an association relationship between a physical address and a dynamic key, wherein the association relationship is generated by other access point devices based on the dynamic key and the physical address of a site device that uses the dynamic key and successfully establishes a connection with the other access point; if an access request sent by a designated device is received, obtaining the physical address of the designated device and the access key included in the access request; and verifying the access request based on the association relationship, the physical address of the designated device, and the access key included in the access request.

[0008] According to one aspect of an embodiment of the present application, a network connection management device is provided, including: a first receiving unit, configured to receive a dynamic key for connecting to an access point device; a first processing unit, configured to respond to an access request including the dynamic key sent by a site device and establish a connection with the site device if the access request is received; a first generating unit, configured to associate a physical address of the site device with the dynamic key after successfully establishing a connection with the site device, and generate an association relationship between the physical address and the dynamic key; a transmission unit, configured to transmit the association relationship to other access point devices, so that the other access point devices verify the access request initiated by the site device based on the dynamic key according to the association relationship.

[0009] In some embodiments of the present application, based on the aforementioned solution, the first receiving unit is configured to: receive a dynamic key for connecting to the access point device sent by an access point management platform; or receive a pre-configured dynamic key for connecting to the access point device.

[0010] In some embodiments of the present application, based on the above solution, the transmission unit is configured to: send the association relationship to an access point management platform, so that the access point management platform forwards the association relationship to the other access point devices; or

[0011] The association relationship is sent to the other access point device through the communication link between the other access point device and the other access point device.

[0012] In some embodiments of the present application, based on the aforementioned scheme, the first receiving unit is further configured to: receive the validity period of the dynamic key; the first processing unit is configured to: determine whether the dynamic key included in the access request is within the validity period according to the validity period, and if it is determined that the dynamic key is within the validity period, establish a connection with the site device.

[0013] In some embodiments of the present application, based on the aforementioned scheme, the transmission unit is further configured to: transmit the validity period of the dynamic key to the other access point devices, so that the other access point devices verify the access request initiated by the site device based on the dynamic key according to the association relationship within the validity period.

[0014] According to one aspect of an embodiment of the present application, a network connection management device is provided, including: an allocation unit, configured to allocate a dynamic key for connecting to an access point device in response to a key application request; a first sending unit, configured to send the dynamic key to the access point device and the initiator of the key application request, so that the access point device verifies the received access request based on the dynamic key; a second receiving unit, configured to receive an association relationship between a physical address sent by the access point device and the dynamic key, wherein the physical address is an address owned by a site device that successfully accesses the access point device based on the dynamic key; the second sending unit is configured to send the association relationship to other access point devices, so that the other access point devices verify the access request initiated by the site device based on the dynamic key based on the association relationship.

[0015] In some embodiments of the present application, based on the aforementioned scheme, the network connection management device also includes: a second generation unit, configured to generate a validity period of the dynamic key; the first sending unit is also configured to send the validity period to the access point device, so that the access point device verifies the received access request based on the dynamic key within the validity period.

[0016] In some embodiments of the present application, based on the aforementioned scheme, the allocation unit is also configured to: before responding to the key application request, receive a key application request sent by the application server, and the key application request is sent by the application server after the identity authentication of the application client that initiated the key application is passed.

[0017] According to one aspect of an embodiment of the present application, a network connection management device is provided, including: a third receiving unit, configured to receive an association relationship between a physical address and a dynamic key, wherein the association relationship is generated by other access point devices based on the dynamic key and the physical address of a site device that uses the dynamic key and successfully establishes a connection with the other access point; an acquisition unit, configured to, if an access request sent by a designated device is received, acquire the physical address of the designated device and the access key included in the access request; a verification unit, configured to verify the access request based on the association relationship, the physical address of the designated device, and the access key included in the access request.

[0018] In some embodiments of the present application, based on the aforementioned solution, the verification unit is configured to: if it is determined according to the association relationship that the physical address of the designated device is associated with the access key included in the access request, then determine that the access request is successfully verified;

[0019] If the physical address of the designated device does not exist in the association relationship, the access request is rejected.

[0020] In some embodiments of the present application, based on the aforementioned scheme, the third receiving unit is also configured to: receive the validity period of the dynamic key; the verification unit is configured to: within the validity period, verify the access request according to the association relationship, the physical address of the designated device, and the access key contained in the access request.

[0021] According to one aspect of an embodiment of the present application, a computer-readable medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the network connection management method as described in the above embodiment is implemented.

[0022] According to one aspect of an embodiment of the present application, an electronic device is provided, comprising: one or more processors; a storage device for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the network connection management method as described in the above embodiments.

[0023] According to one aspect of the embodiments of the present application, a computer program product or a computer program is provided, the computer program product or the computer program includes computer instructions, and the computer instructions are stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device executes the network connection management method provided in the above various optional embodiments.

[0024] In the technical solutions provided by some embodiments of the present application, the access point device receives a dynamic key for connecting to the access point device, and then upon receiving an access request including the dynamic key sent by the site device, responds to the access request to establish a connection with the site device, and after successfully establishing a connection with the site device, associates the physical address of the site device with the dynamic key, generates an association relationship between the physical address and the dynamic key, and then transmits the association relationship to other access point devices, so that the other access point devices can verify the access request initiated by the site device based on the dynamic key according to the association relationship. It can be seen that the technical solution of the embodiments of the present application enables the access point device to associate the physical address of the site device with the dynamic key after the site device accesses the access point device through the dynamic key, and then transmits it to other access point devices, so that the site device can conveniently and quickly access other access point devices, thereby improving the efficiency of the site device accessing other access point devices.

[0025] It should be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] The drawings herein are incorporated into the specification and constitute a part of the specification, showing embodiments consistent with the present application, and together with the specification, are used to explain the principles of the present application. Obviously, the drawings described below are only some embodiments of the present application, and for ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work. In the drawings:

[0027] Figure 1 A schematic diagram of WPA / WPA2-PSK authentication is shown;

[0028] Figure 2 A schematic diagram of WPA / WPA2-PPSK authentication is shown;

[0029] Figure 3 A flow chart showing establishment of a connection between a STA and an AP is shown;

[0030] Figure 4 A schematic diagram of a four-way handshake authentication between a STA and an AP is shown;

[0031] Figure 5 A schematic diagram of key generation during the STA and AP authentication process is shown;

[0032] Figure 6 The figure shows the configuration interface diagram of Portal authentication;

[0033] Figure 7 A flowchart of a network connection management method according to an embodiment of the present application is shown;

[0034] Figure 8 A flowchart of a network connection management method according to an embodiment of the present application is shown;

[0035] Fig. 9 A flowchart of a network connection management method according to an embodiment of the present application is shown;

[0036] Fig.10 A schematic diagram of a cloud AP scenario according to an embodiment of the present application is shown;

[0037] Fig.11 A system architecture diagram of a cloud AP scenario according to an embodiment of the present application is shown;

[0038] Fig.12 A flowchart of a network connection management method according to an embodiment of the present application is shown;

[0039] Fig.13 A schematic diagram of a one-key networking interface according to an embodiment of the present application is shown;

[0040] Fig.14 A flowchart of a network connection management method according to an embodiment of the present application is shown;

[0041] Fig.15 A schematic diagram of a function selection interface according to an embodiment of the present application is shown;

[0042] Fig.16 A block diagram of a network connection management device according to an embodiment of the present application is shown;

[0043] Fig.17 A block diagram of a network connection management device according to an embodiment of the present application is shown;

[0044] Fig.18 A block diagram of a network connection management device according to an embodiment of the present application is shown;

[0045] Fig.19 A schematic diagram of the structure of a computer system suitable for implementing an electronic device of an embodiment of the present application is shown. DETAILED DESCRIPTION

[0046] The exemplary embodiments are now described in a more comprehensive manner with reference to the accompanying drawings. However, the exemplary embodiments can be implemented in various forms and should not be understood as being limited to these examples; on the contrary, the purpose of providing these embodiments is to make this application more comprehensive and complete, and to fully convey the concept of the exemplary embodiments to those skilled in the art.

[0047] In addition, the features, structures or characteristics described in the present application may be combined in one or more embodiments in any suitable manner. In the following description, there are many specific details so that the embodiments of the present application can be fully understood. However, those skilled in the art will appreciate that when implementing the technical scheme of the present application, all the detailed features in the embodiments may not be needed, one or more specific details may be omitted, or other methods, elements, devices, steps, etc. may be adopted.

[0048] The block diagrams shown in the accompanying drawings are merely functional entities and do not necessarily correspond to physically independent entities. That is, these functional entities may be implemented in software form, or in one or more hardware modules or integrated circuits, or in different networks and / or processor devices and / or microcontroller devices.

[0049] The flowcharts shown in the accompanying drawings are only exemplary and do not necessarily include all the contents and operations / steps, nor must they be executed in the order described. For example, some operations / steps can be decomposed, and some operations / steps can be combined or partially combined, so the actual execution order may change according to actual conditions.

[0050] It should be noted that the "multiple" mentioned in this article refers to two or more. "And / or" describes the association relationship of the associated objects, indicating that there can be three relationships. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. The character " / " generally indicates that the associated objects before and after are in an "or" relationship.

[0051] WPA stands for Wi-Fi Protected Access, which has three standards: WPA, WPA2, and WPA3. It is a system for protecting wireless network security. WPA / WPA2-PSK (Pre-Shared Key) is an authentication method that pre-distributes shared keys, which is more secure in encryption and key verification. Figure 1 As shown, when WPA / WPA2-PSK authentication is adopted, the access key is the same for all station devices of the specified SSID (Service Set Identifier) ​​connected to the access point device 101, for example, the PSKs of the station devices 102 and 103 are both "12345".

[0052] WPA / WPA2-PPSK (Private PSK) authentication inherits the advantages of WPA / WPA2-PSK authentication, which is easy to deploy. It can also provide different pre-shared keys for different site devices, effectively improving the security of the network. When using WPA / WPA2-PPSK authentication, site devices connected to the same SSID can have different access keys, and different authorizations can be issued to different users. If a user has multiple site devices, these site devices can also connect to the network through the same PPSK account. Figure 2 As shown, the station device 202 and the station device 203 connected to the same SSID of the access point device 201 may use the same PSK, while the station device 204 may use a PSK different from that of the station device 202 and the station device 203 .

[0053] Regardless of whether it is WPA / WPA2-PSK or WPA / WPA2-PPSK, the connection process and key negotiation process between STA and AP are the same.

[0054] like Figure 3 As shown in FIG. 1 , the process of establishing a connection between a station device STA and an access point device AP mainly includes:

[0055] Step S301, scanning phase (SCAN).

[0056] Specifically, STA uses Scanning to search for APs. When STA is roaming and looking for a new AP to connect to, STA will search on each available channel. There are two search methods: active scanning and passive scanning.

[0057] Active search means that STA sends Probe Request frames on each channel (1-13) in turn to find an AP with the same SSID as the STA. If no AP with the same SSID is found, the scan will continue. The characteristic of active search is that AP can be found quickly.

[0058] Passive search is a method where STA discovers a network by listening to the Beacon frames periodically sent by the AP, which provide information about the AP and its BSS (Basic Service Set). Although the passive search method takes a long time to search for an AP, it can reduce the power consumption of the STA.

[0059] Step S302, authentication phase (Authentication).

[0060] Specifically, when a STA finds an AP with the same SSID as it, it selects an AP with the strongest signal among the APs with matching SSIDs based on the received AP signal strength, and then enters the authentication phase. Only STAs that pass the authentication can access the wireless network. The authentication methods provided by the AP include: open-system authentication, shared-key authentication, pre-authentication (WPA PSK), etc.

[0061] Among them, the process of open authentication is that STA initiates authentication request, and the authentication server responds after receiving it. The process of shared key authentication is that STA initiates authentication request, and the authentication server responds to the challenge text after receiving the request. STA uses the preset key to encrypt the plain text and send it to the authentication server. The authentication server decrypts it with the preset key and compares it with the previous plain text. If they are consistent, the authentication is passed.

[0062] Step S303, association phase (Association).

[0063] Specifically, when the AP returns authentication response information to the STA, the STA identity authentication is passed and then enters the association phase. In the association phase, the STA sends an association request to the AP, and the AP returns an association response to the STA. When the STA moves, roaming issues are involved. If roaming in the same network, there is no need to re-authenticate but only re-associate. When the AP and STA are associated, the STA's access process is completed, that is, the connection between the STA and the AP is successful.

[0064] Before data transmission, the STA and AP need to perform a four-way handshake process based on EAPOL (Extensible Authentication Protocol OVER LAN) to generate the required key. The specific process is as follows Figure 4 As shown, the STA acts as the supplicant and the AP acts as the authenticator to perform a four-way handshake process.

[0065] In the four-way handshake process, message 1 is an EAPOL-Key frame carrying an A-Nonce sent by the authenticator to the requester via unicast. The A-Nonce is a random number generated by the authenticator.

[0066] After receiving message 1, the requester has obtained A-Nonce and AA (AuthenticatorMAC address, i.e., the MAC address of the authenticator), and the requester already has PMK (Pairwise Master Key, i.e., a pairwise master key, usually a set of random numbers) and SPA (i.e., the MAC address of the requester), so the PTK (Pairwise Transient Key) can be calculated by the following function:

[0067] PTK=PRF(PMK+A-Nonce+S-Nonce+AA+SPA)

[0068] Among them, PRF stands for pseudorandom function; S-Nonce is a random number generated by the requester; PMK in the formula is set by the requester. The generated PTK contains three parts: KCK (Key Confirmation Key), KEK (Key Encryption Key) and TK (Temporal Key). KCK is used to calculate the integrity of the key generation message, KEK is used to encrypt the key generation message, and TK is actually used for data encryption.

[0069] In the four-way handshake process, message 2 is the S-Nonce, MIC (message integrity code, which is a hash value calculated for a group of data to be protected to prevent data tampering) and other information sent by the requester to the authenticator through the second EAPOL-Key frame after generating the PTK. Among them, the MIC value in message 2 will be encrypted by KCK (Key Confirmation Key).

[0070] After receiving message 2, the authenticator takes out the S-Nonce in message 2 and performs similar calculations as the requester to verify whether the message returned by the requester is correct. Specifically, it performs integrity check on the received MIC and the MIC generated by itself. If they are incorrect, that is, the integrity check of the MIC fails, it means that the PMK of the requester is wrong, and the whole handshake stops.

[0071] If the authenticator verifies that the message returned by the requester is correct, the authenticator generates PTK and GTK (Group Temporal Key). GTK is an encryption key used to encrypt multicast and broadcast data streams.

[0072] In the four-way handshake process, message 3 is the third EAPOL-Key frame sent by the authenticator to the requester after generating PTK and GTK, which carries GTK and MIC. Among them, GTK is encrypted by KEK, and MIC is encrypted by KCK.

[0073] After receiving message 3, the supplicant will also do some calculations to determine whether the PMK of the authenticator is correct. If it is confirmed to be correct, the supplicant will send the EAPOL-Key frame to the authenticator for confirmation for the last time through message 4. If the authentication is successful, both the supplicant and the authenticator will install the key. Installing means using the key to encrypt data. Specifically, the supplicant installs the PTK and GTK, and the authenticator installs the PTK.

[0074] After the supplicant and the authenticator complete the authentication, the control port of the authenticator will be opened, so that the 802.11 data frames can be transmitted normally, and all unicast data frames will be protected by PTK encryption, and all multicast data and broadcast data will be protected by GTK encryption.

[0075] The key generation process during the authentication process is as follows Figure 5 As shown, PMK is generated by ESSID (Extended Service SetIdentifier) ​​and PSK, for example, PMK is generated by SHA-1 (Secure Hash Algorithm 1). PTK is generated based on the requester MAC (i.e. STA MAC), authenticator MAC (which can be represented by BSSID), PMK, A-Nonce and S-Nonce obtained in the four-way handshake. The ciphertext and MIC can then be encrypted by PTK. AES (Advanced Encryption Standard) or TKIP (Temporal Key Integrity protocol) can be used for encryption.

[0076] In enterprise WLAN, WPA / WPA2-PPSK authentication is widely used, which allows each user to have a different key and is easy to configure and deploy. However, this method requires that each user's key be stored on the access authentication device, that is, the access authentication device needs to store a separate key list. If there are many keys in the key list, the verification time will be greatly increased when verifying the key entered by the user. At the same time, if there are many keys, when a malicious device deliberately enters the wrong key to attack, the access authentication device will not work, and this method is also difficult to avoid the phenomenon of key mixing.

[0077] In addition, in related technologies, there is also a Portal authentication method. Portal is a WEB site that serves the Internet as a gateway. The Wi-Fi provider needs to configure Portal authentication first. The specific configuration interface is as follows: Figure 6 As shown in the figure, you need to set the Portal URL (Uniform Resource Locator), authentication key, authentication secret, authentication URL, whitelist, Check URL, network type, etc. After the configuration is completed, the user can connect to the password-free Wi-Fi, and then the portal authentication interface pops up through the browser. After filling in the authentication user name and password, you can actually access the Internet through the Wi-Fi network. This authentication scheme is not only cumbersome to operate, but also has compatibility issues with Portal authentication. After some terminals (such as mobile phones of some manufacturers) are connected to Wi-Fi, it may not be possible to pop up the portal authentication page, which leads to the inability to perform authentication.

[0078] Based on the above problems, an embodiment of the present application provides a new network connection management solution, which can associate the access key of the device to be accessed with the physical address, so that when the access point device verifies the access request, on the one hand, it can verify whether the physical address of the device to be accessed exists in the association relationship, thereby avoiding malicious devices from frequently initiating access requests and affecting the performance of the access point device. On the other hand, when the physical address of the device to be accessed exists in the association relationship, the access key contained in the access request can be quickly verified according to the access key corresponding to the physical address, thereby improving the efficiency of network access verification and avoiding the problem of mixed use of access keys.

[0079] In addition, in some scenarios, the same user may have multiple site devices, but some devices may not be able to present a convenient, feature-rich visual interface to access the network, such as printer devices, scanner devices, etc. For this situation, how to ensure that these devices can access the network conveniently is an urgent need. In view of this scenario, the embodiment of the present application proposes that dynamic keys can be assigned to such site devices. After such site devices access the network based on dynamic keys, the access point device can associate the physical address of such site with the dynamic key and send it to other access point devices. Then, when such site devices move to the location of other access point devices, efficient network access can be achieved. The specific implementation details are described in detail as follows:

[0080] Figure 7 A flowchart of a network connection management method according to an embodiment of the present application is shown, and the network connection management method can be executed by an access point device. Figure 7 As shown, the network connection management method at least includes steps S710 to S740, which are described in detail as follows:

[0081] In step S710, a dynamic key for connecting to an access point device is received.

[0082] In one embodiment of the present application, the access point device may receive a dynamic key for connecting to the access point device sent by the access point management platform. In this case, the access point management platform may allocate a dynamic key in response to a key application request initiated by a user, and after allocating the dynamic key, the dynamic key may be returned to the user on the one hand and to the access point device on the other hand.

[0083] Optionally, the user can initiate a key application request on the application client, and then the application client can send the key application request to the application server, which is then forwarded to the access point management platform. In this case, after the access point management platform generates a dynamic key, it can send the dynamic key to the application server, which is then fed back to the application client by the application server.

[0084] In one embodiment of the present application, the access point device may also receive a pre-configured dynamic key for connecting to the access point device. In this case, the user also needs to obtain the pre-configured dynamic key in order to initiate a connection to the access point device.

[0085] In one embodiment of the present application, the dynamic key may also have an expiration date, in which case the access point device also needs to receive the expiration date of the dynamic key to perform access management based on the expiration date. The technical solution of this embodiment also enables dynamic keys to be managed by expiration date, avoiding the problem of chaotic access management caused by indefinite use of dynamic keys.

[0086] In step S720, if an access request including a dynamic key is received from the site device, the access request is responded to and a connection is established with the site device.

[0087] In one embodiment of the present application, after obtaining the dynamic key, the user provides the dynamic key to the site device, and then the site device initiates an access request. For example, the user can establish a Bluetooth connection with the site device (such as a printer device, a scanner device, etc.) through a smart phone, and then input the dynamic key into the interface provided by the smart phone, and then the smart phone transmits the dynamic key to the site device. Alternatively, the user can input the dynamic key in the interface provided by the site device, and then the site device initiates an access request based on the dynamic key.

[0088] Optionally, if the dynamic key has a validity period, the access point device needs to determine whether the dynamic key included in the access request is within the validity period based on the validity period. If it is within the validity period, and the dynamic key included in the access request matches the dynamic key previously received by the access point device, the access point device will establish a connection with the site device.

[0089] In step S730, after successfully establishing a connection with the site device, the physical address of the site device is associated with the dynamic key to generate an association relationship between the physical address and the dynamic key.

[0090] In one embodiment of the present application, the physical address of the site device may be a MAC (Media Access Control) address. Optionally, in order to improve the query efficiency of the dynamic key, a hash table may be generated according to the association between the dynamic key and the physical address, that is, the association between the physical address and the dynamic key may be reflected in the form of a hash table.

[0091] In step S740, the association relationship between the physical address and the dynamic key is transmitted to other access point devices, so that the other access point devices verify the access request initiated by the station device based on the dynamic key according to the association relationship.

[0092] In one embodiment of the present application, the access point device may send the association relationship to the access point management platform, so that the access point management platform forwards the association relationship to other access point devices.

[0093] In one embodiment of the present application, the access point device may also send the association relationship to other access point devices via the communication link between the access point devices. The technical solution of this embodiment is applicable to application scenarios where communication links are established between access point devices.

[0094] Optionally, if the dynamic key has a validity period, the access point device needs to transmit the validity period of the dynamic key to other access point devices, so that other access point devices can verify the access request initiated by the station device based on the dynamic key according to the association relationship within the validity period.

[0095] Figure 7 The technical solution of the embodiment of the present application is described from the perspective of the access point device. The technical solution of the embodiment of the present application is described from the perspective of the access point management platform as follows:

[0096] Figure 8 A flowchart of a network connection management method according to an embodiment of the present application is shown. The network connection management method may be executed by an access point management platform, which may be a platform for access management. Figure 8 As shown, the network connection management method at least includes steps S810 to S840, which are described in detail as follows:

[0097] In step S810, in response to the key application request, a dynamic key for connecting to the access point device is allocated.

[0098] In one embodiment of the present application, the key application request can be initiated by the user's terminal device. For example, the user has multiple terminal devices, but some terminal devices cannot easily access the network, such as printer devices, scanner devices, etc. In this case, the user can use a smart phone to initiate a key application request to the access point management platform to enable other terminal devices to access the network based on the dynamic key fed back by the access point management platform.

[0099] Optionally, the user's terminal device can directly establish a connection with the access point management platform to initiate a key application request. Alternatively, the user's terminal device can also initiate a key application request to the access point management platform through a specified application. For example, the user can initiate a key application request on the application client, and then the application client can send the key application request to the application server, which is then forwarded to the access point management platform by the application server. In this case, after the access point management platform generates a dynamic key, it can send the dynamic key to the application server, which is then fed back to the application client by the application server.

[0100] Optionally, the access point management platform may also generate a validity period of the dynamic key, and then send the validity period of the dynamic key to the access point device, so that the access point device verifies the received access request based on the dynamic key within the validity period.

[0101] In step S820, the dynamic key is sent to the access point device and the initiator of the key application request, so that the access point device verifies the received access request based on the dynamic key.

[0102] Optionally, after receiving the dynamic key sent by the access point management platform, if the access point device receives an access request, it can verify whether the dynamic key in the access request matches the dynamic key obtained by the access point device from the access point management platform. If they match, it can be determined that the access request is verified. If the dynamic key has a validity period, the access point device also needs to determine whether the dynamic key is within the validity period. If it is not within the validity period, the access request using the dynamic key will not be verified.

[0103] In step S830, an association relationship between a physical address and a dynamic key sent by the access point device is received, where the physical address is an address owned by a station device that successfully accesses the access point device based on the dynamic key.

[0104] Optionally, the process of the access point device generating the association relationship between the dynamic key and the physical address may refer to the technical solution of the aforementioned embodiment, which will not be described in detail.

[0105] In step S840, the association relationship between the physical address and the dynamic key is sent to other access point devices, so that the other access point devices verify the access request initiated by the station device based on the dynamic key based on the association relationship.

[0106] In an embodiment of the present application, by sending the association relationship between the physical address and the dynamic key to other access point devices, when the site device moves into the coverage area of ​​the other access point devices, the other access point devices can quickly implement access verification for the site device based on the association relationship between the physical address and the dynamic key, thereby effectively improving the efficiency of accessing the network.

[0107] The technical solution of the embodiment of the present application is described below from the perspective of an access point device that receives the association relationship between the physical address and the dynamic key:

[0108] Fig. 9 A flowchart of a network connection management method according to an embodiment of the present application is shown, and the network connection management method can be executed by an access point device. Fig. 9 As shown, the network connection management method at least includes steps S910 to S930, which are described in detail as follows:

[0109] In step S910, an association relationship between a physical address and a dynamic key is received, where the association relationship is generated by other access point devices according to the dynamic key and the physical address of a station device that uses the dynamic key and successfully establishes a connection with other access points.

[0110] Optionally, the process of the access point device generating the association relationship between the physical address and the dynamic key may refer to the above embodiment and will not be described in detail.

[0111] In an embodiment of the present application, the access point device may directly receive the association relationship between the physical address and the dynamic key sent by other access point devices, or may receive the association relationship between the physical address and the dynamic key forwarded by the access point management platform.

[0112] In step S920, if an access request sent by a designated device is received, the physical address of the designated device and the access key included in the access request are obtained.

[0113] In the embodiment of the present application, the designated device is a site device that needs to access the access point device. Since the designated device has communicated with the access point device before sending the access request to the access point device, the physical address of the designated device may be obtained before the designated device sends the access request. Of course, the designated device may also carry its physical address again in the access request.

[0114] In step S930, the access request is verified according to the association between the physical address and the dynamic key, the physical address of the designated device, and the access key included in the access request.

[0115] In one embodiment of the present application, if it is determined that the physical address of the designated device is associated with the access key included in the access request according to the association relationship between the physical address and the dynamic key, then it is determined that the access request is successfully verified. Specifically, the verification process may be: the access point device finds the corresponding dynamic key in the above association relationship according to the physical address of the designated device, and then compares the found dynamic key with the access key actively included in the access request. If they are consistent, it is determined that the access request is successfully verified.

[0116] In one embodiment of the present application, if the physical address of the designated device does not exist in the above association relationship, the access request is rejected. The technical solution of this embodiment can prevent the access point device from failing to work properly due to frequent connection requests initiated by malicious devices.

[0117] Optionally, the access point device may also receive a validity period of the dynamic key, and may then verify the access request within the validity period according to the association relationship, the physical address of the designated device, and the access key included in the access request.

[0118] In the foregoing embodiments, the technical solutions of the embodiments of the present application are described from the perspectives of the access point management platform and the access point device, respectively. The following describes in detail the implementation details of the embodiments of the present application from the perspective of interaction between various devices.

[0119] In an application scenario of the present application, the access point device may be a cloud AP, which extends the management capability of a local AP to the cloud, and manages multiple cloud APs in a unified manner through the cloud (cloud AP management platform, i.e., the access point management platform in the aforementioned embodiment), such as configuring the LAN, WAN (Wide Area Network), and blacklist and whitelist of the cloud AP. Fig.10 As shown, the cloud AP management platform communicates directly with the cloud AP via the Internet or WLAN, or the cloud AP management platform communicates with the cloud AP via the Internet or WLAN through a firewall and a switch, and the cloud AP is used to communicate and interact with the wireless terminal.

[0120] The system architecture of the cloud AP scenario is as follows: Fig.11 As shown in the figure, it mainly includes three parts: cloud AP hardware, cloud AP management platform and application.

[0121] The cloud AP hardware mainly includes one or more cloud APs. The cloud AP needs to be connected to the cloud AP management platform (specifically, it can be connected through a multi-port repeater HUB) and receive the AP configuration information sent by the cloud AP management platform. At the same time, it receives the PPSK key distribution and management, and receives and manages the connection information of the terminal (i.e., site equipment).

[0122] The cloud AP management platform includes the operation platform, HUB, device management, enterprise configuration, address book, key management, database and other parts.

[0123] Among them, the operation platform is used to manage cloud task scheduling, monitor abnormal situations, etc.; the HUB is responsible for connecting to the cloud AP hardware and maintaining related heartbeats; device management is mainly used to manage the information of connected cloud APs; enterprise configuration is mainly used to manage the cloud AP configuration related to each enterprise; the address book is mainly used to record the information of enterprise employees, including mobile phone numbers or instant messaging software account information, etc.; key management is used to generate, destroy and update keys, and is also used to allocate MAC-PSK hash tables to enterprises; application services are used to provide corresponding API (Application Programming Interface) interface information to applications, etc.; the database is used as a basic component for persistent storage of data.

[0124] The application mainly refers to the application corresponding to the cloud AP, including the front-end management page and application information, the back-end platform and service capabilities, etc. Optionally, the application can be a host program, which is a program that depends on the host environment, such as a mini program, a quick application, etc.

[0125] based on Fig.11 The system architecture shown in the embodiment of the present application can be realized by Fig.12 The process shown in the figure implements network access management, which specifically includes the following steps:

[0126] Step S1201, the enterprise application APP pushes the terminal MAC address and current enterprise information to the enterprise application cloud platform.

[0127] It should be noted that the enterprise application APP can be an APP developed for a specific enterprise, or it can be a public platform for all enterprises. If the enterprise application APP is a public platform for all enterprises, then the enterprise user needs to create enterprise information on the public platform, bind the enterprise's cloud AP with the enterprise information, and configure it on the cloud AP, such as configuring SSID, etc.

[0128] When an enterprise employee installs an enterprise application APP on his / her terminal and enters the enterprise to which he / she belongs, the enterprise application APP can collect the MAC address of the terminal and then push this information to the enterprise application cloud platform.

[0129] Step S1202, the enterprise application cloud platform pushes the MAC address and enterprise employee binding relationship to the cloud AP management platform.

[0130] In one embodiment of the present application, the enterprise employee may be the employee's work number, name, etc., or the enterprise employee's account name in the enterprise application APP, etc. Optionally, the enterprise application cloud platform may only push the MAC address to the cloud AP management platform, and maintain the binding relationship between the MAC address and the enterprise employee locally.

[0131] Step S1203: The cloud AP management platform generates and pushes a MAC-PSK hash table to the AP device SDK.

[0132] In one embodiment of the present application, the cloud AP management platform can generate a one-key MAC-PSK hash table based on the MAC address pushed by the enterprise application cloud platform, and send the MAC-PSK hash table to the device SDK (Software Development Kit) of the cloud AP.

[0133] Step S1204: The cloud AP management platform generates and pushes the enterprise employee PSK to the enterprise application cloud platform.

[0134] In one embodiment of the present application, the cloud AP may send the association relationship between the PSK and the MAC address to the enterprise application cloud platform so that the enterprise application cloud platform can distribute the PSK according to the MAC address.

[0135] Optionally, there is no strict order between step S1204 and step S1203. Step S1203 may be performed first and then step S1204; step S1204 may be performed first and then step S1203; or step S1203 and step S1204 may be performed simultaneously.

[0136] Step S1205, the enterprise application cloud platform forwards the enterprise employee PSK to the enterprise application APP.

[0137] Optionally, the enterprise application cloud platform pushes the PSK to the corresponding enterprise application APP based on the MAC address reported by the enterprise application APP and the association between the MAC address and the PSK. It should be noted that after obtaining the association between the MAC address and the PSK, the enterprise application cloud platform can actively push the PSK to the corresponding enterprise application APP, or send it to the corresponding enterprise application APP upon receiving the access key acquisition request sent by the enterprise application APP.

[0138] Step S1206: The user initiates one-click networking in the enterprise application APP.

[0139] Alternatively, if Fig.13As shown, a "one-click networking" control 1301 can be displayed in the enterprise application APP. After the user selects the enterprise network to be connected, the user can click the "one-click networking" control 1301, and then the enterprise application APP on the terminal will push the PSK to the cloud AP device. Since the cloud AP device will also obtain the MAC address of the terminal during the communication with the enterprise application APP, the cloud AP device will quickly verify according to the MAC-PSK hash table.

[0140] Specifically, the corresponding PSK can be retrieved from the MAC-PSK hash table according to the MAC address of the terminal, and then verified whether it is consistent with the PSK pushed by the enterprise application APP. If it is consistent, the verification is determined to be successful. Compared with the solution in which the AP stores the key list separately and verifies whether the PSK pushed by the enterprise application APP exists in the key list by retrieving the key in the key list, this solution greatly reduces the verification time. At the same time, since the AP needs to verify whether the MAC address exists in the MAC-PSK hash table, it can also directly reject the access request initiated by the device with the illegal MAC address, avoiding the frequent access request initiated by the malicious device and affecting the performance of the access point device. In addition, the technical solution of the embodiment of the present application can also avoid the problem of mixed use of access keys.

[0141] Fig.12 The technical solution of the embodiment shown is a one-machine-one-key application scenario. However, in some scenarios, some terminal devices cannot install enterprise application APPs, which results in these terminal devices being unable to follow Fig.12 For this situation, the embodiment of the present application proposes to use a dynamic key to ensure that these terminal devices can easily access the network. For example, a user can initiate an application for a dynamic key on a terminal that can install an enterprise application APP. After the cloud AP management platform generates the corresponding dynamic key, the dynamic key can be returned to the user. Then the user can use the dynamic key to enable the terminal device to initiate an access request. When the connection is successful, the access point device can add the MAC address and dynamic key of the successfully connected terminal device to the MAC-PSK hash table, thereby achieving Fig.12 The connection management scheme shown in FIG. At the same time, the dynamic key is time-limited and is only valid within this time, thereby achieving effective management of the dynamic key. The specific process can be as follows Fig.14 As shown, the following steps are included:

[0142] Step S1401, the enterprise application APP installed on the terminal 1 applies for a dynamic key from the enterprise application cloud platform.

[0143] It should be noted that the enterprise application APP can be an APP developed for a specific enterprise, or it can be a public platform for all enterprises. If the enterprise application APP is a public platform for all enterprises, then the enterprise user needs to create enterprise information on the public platform, bind the enterprise's cloud AP with the enterprise information, and configure it on the cloud AP, such as configuring SSID, etc.

[0144] Step S1402, the enterprise application cloud platform verifies the employee's identity, and after passing, initiates a dynamic key application request to the cloud AP management platform.

[0145] In one embodiment of the present application, the employee identity may be the employee's work number, name, etc., or the employee's account name in the enterprise application APP, etc. Reviewing the employee identity may include reviewing whether the employee is an employee of the enterprise, reviewing whether the employee has the authority to apply for a dynamic key, etc.

[0146] Step S1403 , the cloud AP management platform generates a dynamic key and a validity period of the dynamic key, and returns the dynamic key and the validity period to the device SDK of cloud AP1 .

[0147] Step S1404: The cloud AP management platform returns the generated dynamic key and validity period to the enterprise application cloud platform.

[0148] Optionally, the cloud AP management platform may also only return the dynamic key to the enterprise application cloud platform, while the validity period of the dynamic key may not be returned to the enterprise application cloud platform.

[0149] It should be noted that there is no strict order between step S1404 and step S1403. Step S1403 may be executed first and then step S1404; step S1404 may be executed first and then step S1403; or step S1403 and step S1404 may be executed simultaneously.

[0150] Step S1405 , the enterprise application cloud platform forwards the dynamic key and the validity period to the enterprise application APP of terminal 1 that applies for the dynamic key.

[0151] Optionally, the enterprise application cloud platform may also only return the dynamic key to the enterprise application APP, while the validity period of the dynamic key may not be returned to the enterprise application APP.

[0152] Step S1406, after the enterprise application APP of terminal 1 obtains the dynamic key and the validity period, the user can enter the dynamic key on other terminals (such as terminal 2, terminal 3, terminal n, etc.) within the validity period to initiate networking with cloud AP1.

[0153] It should be noted that if the enterprise application APP of terminal 1 does not obtain the validity period, the user can use the dynamic key to initiate a connection on other terminals, and then cloud AP1 determines whether the dynamic key has exceeded the validity period.

[0154] Step S1407, if other terminals successfully connect to cloud AP1, the device SDK of cloud AP1 will generate (or add) a MAC-PSK hash table according to the MAC address and dynamic key of the terminal, and push it to the cloud AP management platform.

[0155] Step S1408, the cloud AP management platform pushes the MAC-PSK hash table of the terminal device that successfully accesses cloud AP1 to other APs of the enterprise (such as Fig.14 The cloud AP2) shown in FIG. 2 ensures that the terminal device can also be connected normally on other APs.

[0156] It should be noted that when a terminal device connects to other APs, since other APs already have the MAC-PSK hash table of the terminal device, Fig.12 The authentication process in the .

[0157] based on Fig.12 and Fig.14 A specific application scenario of the technical solution shown is: Employee A has multiple devices, including a smartphone, a printer, and a scanner. Employee A's smartphone can use Fig.12 After connecting to the network, employee A also wants to connect the printer and scanner devices to the network. However, since the printer and scanner devices cannot install the enterprise application APP, employee A can Fig.14 The solution shown is to use a smartphone to apply for a dynamic key.

[0158] After applying for the dynamic key, employee A uses the dynamic key to connect the printer and scanner to AP1's network. The printer and scanner also store the dynamic key. AP1 can associate the MAC address of the printer and scanner with the dynamic key and upload it to the cloud AP management platform, which then sends it to other APs, such as AP2.

[0159] If employee A moves the printer device to another area, such as the coverage area of ​​AP2, the printer device can initiate an access request to AP2 based on the previously saved dynamic key. Since AP2 has saved the association between the MAC address of the printer device and the dynamic key, the printer device can be quickly authenticated to ensure that the printer device quickly accesses the AP2 network.

[0160] In one embodiment of the present application, Fig.12 The technical solution of the illustrated embodiment can be understood as a "one machine, one key" function because one terminal device is assigned one access key. Fig.14 The technical solution of the embodiment shown in the figure can be understood as a "one key for multiple devices" function because one dynamic key can be used by multiple terminal devices. In one embodiment of the present application, the "one device one key" function and the "one key for multiple devices" function can be selected according to the actual application scenario and user needs. For example, Fig.15 As shown, the switch controls of the "one machine one password" function and the "one password multiple machines" function can be displayed in the enterprise application APP. If the user turns off the "one machine one password" function and turns on the "one password multiple machines" function, then after selecting the network, the "one-click application" control 1501 can be clicked, and then the enterprise application APP on the terminal will send a dynamic key application request to the enterprise application cloud platform to trigger Fig.14 The process shown.

[0161] The following describes an apparatus embodiment of the present application, which can be used to execute the network connection management method in the above-mentioned embodiment of the present application. For details not disclosed in the apparatus embodiment of the present application, please refer to the above-mentioned embodiment of the network connection management method of the present application.

[0162] Fig.16 A block diagram of a network connection management apparatus according to an embodiment of the present application is shown. The network connection management apparatus may be arranged in an access point device.

[0163] Reference Fig.16 As shown, according to an embodiment of the present application, a network connection management device 1600 includes: a first receiving unit 1602 , a first processing unit 1604 , a first generating unit 1606 and a transmission unit 1608 .

[0164] Among them, the first receiving unit 1602 is configured to receive a dynamic key for connecting to an access point device; the first processing unit 1604 is configured to respond to an access request including the dynamic key sent by a site device and establish a connection with the site device if the access request is received; the first generating unit 1606 is configured to associate the physical address of the site device with the dynamic key after successfully establishing a connection with the site device, and generate an association relationship between the physical address and the dynamic key; the transmission unit 1608 is configured to transmit the association relationship to other access point devices, so that the other access point devices verify the access request initiated by the site device based on the dynamic key according to the association relationship.

[0165] In some embodiments of the present application, based on the above solution, the first receiving unit 1602 is configured to: receive a dynamic key for connecting to the access point device sent by an access point management platform; or receive a pre-configured dynamic key for connecting to the access point device.

[0166] In some embodiments of the present application, based on the above solution, the transmission unit 1608 is configured to: send the association relationship to an access point management platform so that the access point management platform forwards the association relationship to the other access point devices; or

[0167] The association relationship is sent to the other access point device through the communication link between the other access point device and the other access point device.

[0168] In some embodiments of the present application, based on the aforementioned scheme, the first receiving unit 1602 is also configured to: receive the validity period of the dynamic key; the first processing unit is configured to: determine whether the dynamic key included in the access request is within the validity period according to the validity period, and if it is determined that the dynamic key is within the validity period, establish a connection with the site device.

[0169] In some embodiments of the present application, based on the aforementioned scheme, the transmission unit 1608 is further configured to: transmit the validity period of the dynamic key to the other access point devices, so that the other access point devices verify the access request initiated by the site device based on the dynamic key according to the association relationship within the validity period.

[0170] Fig.17 A block diagram of a network connection management device according to an embodiment of the present application is shown. The network connection management device can be set in an access point management platform.

[0171] Reference Fig.17 As shown, according to an embodiment of the present application, a network connection management device 1700 includes: an allocating unit 1702 , a first sending unit 1704 , a second receiving unit 1706 and a second sending unit 1708 .

[0172] Among them, the allocation unit 1702 is configured to allocate a dynamic key for connecting to the access point device in response to a key application request; the first sending unit 1704 is configured to send the dynamic key to the access point device and the initiator of the key application request, so that the access point device verifies the received access request based on the dynamic key; the second receiving unit 1706 is configured to receive an association relationship between a physical address sent by the access point device and the dynamic key, where the physical address is an address owned by a site device that successfully accesses the access point device based on the dynamic key; the second sending unit 1708 is configured to send the association relationship to other access point devices, so that the other access point devices verify the access request initiated by the site device based on the dynamic key based on the association relationship.

[0173] In some embodiments of the present application, based on the aforementioned scheme, the network connection management device 1700 also includes: a second generating unit, configured to generate a validity period of the dynamic key; the first sending unit is also configured to send the validity period to the access point device, so that the access point device verifies the received access request based on the dynamic key within the validity period.

[0174] In some embodiments of the present application, based on the aforementioned scheme, the allocation unit 1702 is also configured to: before responding to the key application request, receive a key application request sent by the application server, and the key application request is sent by the application server after the identity authentication of the application client that initiated the key application is passed.

[0175] Fig.18 A block diagram of a network connection management apparatus according to an embodiment of the present application is shown. The network connection management apparatus may be arranged in an access point device.

[0176] Reference Fig.18 As shown, according to an embodiment of the present application, a network connection management device 1800 includes: a third receiving unit 1802 , an acquiring unit 1804 and a verifying unit 1806 .

[0177] Among them, the third receiving unit 1802 is configured to receive an association relationship between a physical address and a dynamic key, where the association relationship is generated by other access point devices based on the dynamic key and the physical address of a site device that uses the dynamic key and successfully establishes a connection with the other access point; the acquisition unit 1804 is configured to obtain the physical address of the designated device and the access key included in the access request if an access request sent by a designated device is received; the verification unit 1806 is configured to verify the access request based on the association relationship, the physical address of the designated device, and the access key included in the access request.

[0178] In some embodiments of the present application, based on the aforementioned solution, the verification unit 1806 is configured to: if it is determined according to the association relationship that the physical address of the designated device is associated with the access key included in the access request, then determine that the access request is successfully verified;

[0179] If the physical address of the designated device does not exist in the association relationship, the access request is rejected.

[0180] In some embodiments of the present application, based on the aforementioned scheme, the third receiving unit 1802 is also configured to: receive the validity period of the dynamic key; the verification unit 1806 is configured to: within the validity period, verify the access request according to the association relationship, the physical address of the designated device, and the access key contained in the access request.

[0181] Fig.19 A schematic diagram of the structure of a computer system suitable for implementing an electronic device of an embodiment of the present application is shown.

[0182] It should be noted that Fig.19 The computer system 1900 of the electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0183] like Fig.19 As shown, the computer system 1900 includes a central processing unit (CPU) 1901, which can perform various appropriate actions and processes according to the program stored in the read-only memory (ROM) 1902 or the program loaded from the storage part 1908 to the random access memory (RAM) 1903, such as executing the method described in the above embodiment. In RAM 1903, various programs and data required for system operation are also stored. CPU 1901, ROM 1902 and RAM 1903 are connected to each other through bus 1904. Input / output (I / O) interface 1905 is also connected to bus 1904.

[0184] The following components are connected to the I / O interface 1905: an input section 1906 including a keyboard, a mouse, etc.; an output section 1907 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 1908 including a hard disk, etc.; and a communication section 1909 including a network interface card such as a LAN (Local Area Network) card, a modem, etc. The communication section 1909 performs communication processing via a network such as the Internet. A drive 1910 is also connected to the I / O interface 1905 as needed. A removable medium 1911, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 1910 as needed so that a computer program read therefrom is installed into the storage section 1908 as needed.

[0185] In particular, according to an embodiment of the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present application includes a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a computer program for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication section 1909, and / or installed from a removable medium 1911. When the computer program is executed by a central processing unit (CPU) 1901, various functions defined in the system of the present application are executed.

[0186] It should be noted that the computer-readable medium shown in the embodiment of the present application may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, - but not limited to - an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM), a flash memory, an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present application, a computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by an instruction execution system, device or device or used in combination with it. In the present application, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, wherein a computer-readable computer program is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than computer-readable storage media, which may send, propagate, or transmit programs for use by or in conjunction with an instruction execution system, apparatus, or device. The computer program contained on the computer-readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above.

[0187] The flowchart and block diagram in the accompanying drawings illustrate the possible architecture, functions and operations of the system, method and computer program product according to various embodiments of the present application. Wherein, each box in the flowchart or block diagram can represent a module, a program segment, or a part of the code, and the above-mentioned module, program segment, or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flowchart, and the combination of boxes in the block diagram or flowchart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0188] The units involved in the embodiments described in this application may be implemented by software or hardware, and the units described may also be set in a processor. The names of these units do not, in some cases, constitute limitations on the units themselves.

[0189] As another aspect, the present application also provides a computer-readable medium, which may be included in the electronic device described in the above embodiment; or may exist independently without being assembled into the electronic device. The above computer-readable medium carries one or more programs, and when the above one or more programs are executed by an electronic device, the electronic device implements the method described in the above embodiment.

[0190] It should be noted that, although several modules or units of the equipment for action execution are mentioned in the above detailed description, this division is not mandatory. In fact, according to the embodiments of the present application, the features and functions of two or more modules or units described above can be embodied in one module or unit. On the contrary, the features and functions of one module or unit described above can be further divided into being embodied by multiple modules or units.

[0191] Through the description of the above implementation methods, it is easy for those skilled in the art to understand that the example implementation methods described here can be implemented by software or by combining software with necessary hardware. Therefore, the technical solution according to the implementation methods of the present application can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, and includes several instructions to enable a computing device (which can be a personal computer, a server, a touch terminal, or a network device, etc.) to execute the method according to the implementation methods of the present application.

[0192] Those skilled in the art will readily appreciate other embodiments of the present application after considering the specification and practicing the embodiments disclosed herein. The present application is intended to cover any variations, uses or adaptations of the present application, which follow the general principles of the present application and include common knowledge or customary technical means in the art that are not disclosed in the present application.

[0193] It should be understood that the present application is not limited to the precise structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present application is limited only by the appended claims.

Claims

1. A network connection management method, characterized in that: The network connection management method is performed by an access point device, and the network connection management method includes: The access point device receives a dynamic key for connecting to the access point device allocated by the access point management platform, and the dynamic key is sent by the access point management platform to the site device that applies for the dynamic key; If an access request including the dynamic key is received from the site device, responding to the access request and establishing a connection with the site device; After successfully establishing a connection with the site device, associating the physical address of the site device with the dynamic key to generate an association relationship between the physical address and the dynamic key; The access point device transmits the association relationship to other access point devices, so that the other access point devices determine that the access request sent by the site device is successfully authenticated when the access key included in the access request sent by the site device and the physical address of the site device meet the association relationship.

2. The network connection management method according to claim 1, characterized in that: The association relationship is transmitted to other access point devices, including: sending the association relationship to an access point management platform, so that the access point management platform forwards the association relationship to the other access point devices; or The association relationship is sent to the other access point device through the communication link between the other access point device and the other access point device.

3. The network connection management method according to any one of claims 1 to 2, characterized in that: The network connection management method further includes: receiving a validity period of the dynamic key; Responding to the access request and establishing a connection with the site device includes: determining whether the dynamic key included in the access request is within the validity period according to the validity period, and establishing a connection with the site device if it is determined that the dynamic key is within the validity period.

4. The network connection management method according to claim 3, characterized in that: The network connection management method further includes: The validity period of the dynamic key is transmitted to the other access point devices, so that the other access point devices verify the access request initiated by the site device based on the dynamic key according to the association relationship within the validity period.

5. A network connection management method, characterized in that: The network connection management method is executed by an access point management platform, and the network connection management method includes: In response to the key application request, allocating a dynamic key for connecting to the access point device; Sending the dynamic key to the access point device and the initiator of the key application request, so that the access point device verifies the received access request based on the dynamic key; receiving an association relationship between a physical address sent by the access point device and the dynamic key, wherein the physical address is an address owned by a site device that successfully accesses the access point device based on the dynamic key; The association relationship is sent to other access point devices, so that when the access key included in the access request sent by the site device and the physical address of the site device meet the association relationship, the other access point devices determine that the access request sent by the site device is successfully authenticated.

6. The network connection management method according to claim 5, characterized in that: The network connection management method further includes: Generate a validity period for the dynamic key; The validity period is sent to the access point device, so that the access point device verifies a received access request based on the dynamic key within the validity period.

7. The network connection management method according to claim 5 or 6, characterized in that: Before responding to the key application request, the network connection management method further includes: A key application request sent by an application server is received, wherein the key application request is sent by the application server after the identity authentication of the application client that initiates the key application is passed.

8. A network connection management method, characterized in that: The network connection management method is performed by an access point device, and the network connection management method includes: receiving an association relationship between a physical address and a dynamic key, wherein the association relationship is generated by other access point devices according to the dynamic key and a physical address of a station device that uses the dynamic key and successfully establishes a connection with the other access point devices, wherein the dynamic key is allocated by the access point management platform in response to a key application request and sent to an initiator of the key application request and the other access point devices; If an access request sent by a designated device is received, obtaining a physical address of the designated device and an access key included in the access request; If it is determined according to the association relationship that the physical address of the designated device is associated with the access key included in the access request, it is determined that the access request is successfully authenticated.

9. The network connection management method according to claim 8, characterized in that: The method further comprises: If the physical address of the designated device does not exist in the association relationship, the access request is rejected.

10. The network connection management method according to claim 8 or 9, characterized in that: The network connection management method further includes: receiving a validity period of the dynamic key; The method further includes: within the validity period, verifying the access request according to the association relationship, the physical address of the designated device, and the access key included in the access request.

11. A network connection management device, characterized in that: The network connection management device is applied to an access point device, and the network connection management device includes: A first receiving unit is configured to receive a dynamic key for connecting to an access point device allocated by an access point management platform, wherein the dynamic key is sent by the access point management platform to a site device that applies for the dynamic key; The first processing unit is configured to, if receiving an access request including the dynamic key sent by the site device, respond to the access request and establish a connection with the site device; A first generating unit is configured to associate the physical address of the site device with the dynamic key after successfully establishing a connection with the site device, and generate an association relationship between the physical address and the dynamic key; The transmission unit is configured to transmit the association relationship to other access point devices, so that when the access key included in the access request sent by the site device and the physical address of the site device meet the association relationship, the other access point devices determine that the access request sent by the site device is successfully authenticated.

12. A network connection management device, characterized in that: The network connection management device is applied to an access point management platform, and the network connection management device includes: an allocating unit configured to allocate a dynamic key for connecting to an access point device in response to a key application request; A first sending unit, configured to send the dynamic key to the access point device and the initiator of the key application request, so that the access point device verifies the received access request based on the dynamic key; A second receiving unit is configured to receive an association relationship between a physical address sent by the access point device and the dynamic key, wherein the physical address is an address owned by a station device that successfully accesses the access point device based on the dynamic key; The second sending unit is configured to send the association relationship to other access point devices, so that the other access point devices determine that the access request sent by the site device is successfully authenticated when the access key included in the access request sent by the site device and the physical address of the site device meet the association relationship.

13. A network connection management device, characterized in that: The network connection management device is applied to an access point device, and the network connection management device includes: a third receiving unit, configured to receive an association relationship between a physical address and a dynamic key, wherein the association relationship is generated by other access point devices according to the dynamic key and a physical address of a station device that uses the dynamic key and successfully establishes a connection with the other access point devices, and the dynamic key is allocated by the access point management platform in response to a key application request and sent to an initiator of the key application request and the other access point devices; an acquiring unit, configured to acquire a physical address of the designated device and an access key included in the access request if an access request sent by the designated device is received; The verification unit is configured to determine that the verification of the access request is successful if it is determined according to the association relationship that the physical address of the designated device is associated with the access key included in the access request.

14. A computer readable medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the network connection management method according to any one of claims 1 to 10 is implemented.

15. An electronic device, characterized in that: include: one or more processors; A storage device for storing one or more programs, when the one or more programs are executed by the one or more processors, enables the one or more processors to implement the network connection management method according to any one of claims 1 to 10.

16. A computer program product, characterized in that The computer program product includes a computer program, which is stored in a computer-readable storage medium. A processor of an electronic device reads and executes the computer program from the computer-readable storage medium, so that the electronic device executes the network connection management method according to any one of claims 1 to 10.

Images