WiFi access method, system, device and medium

Abstract

The present invention discloses a WiFi access method, system, device and medium, relates to the field of wireless communication security technology, solves the technical problem that the existing WiFi access device has low security and poor compatibility, and the key points of the technical solution are that an access module receives request information of a terminal, obtains an authentication mode supported by the terminal according to the request information, and queries the security level of the terminal in a database, and a main control module respectively enables different authentication modes according to the security level of the terminal and the supported authentication mode, thereby ensuring the security of WiFi access, solving the compatibility problem of the terminal with different authentication modes, and improving user experience.

Description

Technical Field

[0001] The present invention relates to the field of wireless communication security technology, and in particular to a WiFi access method, system, device and medium. Background Art

[0002] With the development of technology, WiFi applications are becoming more and more widely used, but security issues have always been an issue that WiFi devices need to focus on. The WiFi KRACK incident in 2017 prompted the WiFi Alliance to launch the WPA3 certification model. This shows that WiFi security is one of the most important factors in WiFi devices.

[0003] The current WiFi authentication system supports modes including OPEN, WPA, WPA2, WPA3, WPA / WPA2 and WPA2 / WPA3. Among them, only WPA3 is safe and reliable, and the others are at risk of being attacked. OPEN mode has no password, and it is not recommended for private devices, but is suitable for devices in public places; WPA authentication mode, it has been proven that the password is easy to crack; WPA2 authentication mode, before 2017, was considered the most secure and reliable technology, but it was still attacked in 2017, which is the KRACK incident; WPA / WPA2 mixed mode, the device works in either WPA mode or WPA2 mode according to the terminal configuration, and both modes have been proven to be vulnerable to attacks; WPA2 / WPA3 mixed mode, when the terminal only supports WPA2 authentication method, the device will work in WPA2 mode, which is also vulnerable to attacks.

[0004] Currently, only the WPA3 mode is the most secure, but WPA3 is a newly launched technology that many devices do not support, so some terminals cannot connect and there are compatibility issues. Therefore, the authentication systems used by current WiFi devices have the following defects: (1) Using authentication systems before WPA3 will cause attacks and is an unsafe system; (2) Using WPA3 authentication will cause some terminals to be unable to connect, there are compatibility issues, and the user experience is poor. Summary of the invention

[0005] The present invention provides a WiFi access method and system, the technical purpose of which is to improve the security of WiFi equipment, solve the compatibility problem of terminals, and improve user experience.

[0006] The above technical objectives of the present disclosure are achieved through the following technical solutions:

[0007] A WiFi access method, comprising:

[0008] Receiving request information from a terminal;

[0009] Acquire the authentication mode supported by the terminal according to the request information, and query the security level of the terminal in a database;

[0010] Enable corresponding authentication according to the security level and the authentication mode supported by the terminal;

[0011] After receiving a message about an authentication mode supported by the terminal, informing the terminal to use the authentication mode for authentication;

[0012] A connection request from the terminal is received and a connection is made according to the authentication mode.

[0013] Furthermore, the authentication mode includes a password-free authentication mode, a WPA2 authentication mode and a WPA3 authentication mode, and the security level of the terminal includes a first security level, a second security level and a third security level.

[0014] Furthermore, when the security level of the terminal is the first security level, the password-free authentication mode is turned on; when the security level of the terminal is the second security level or the third security level, if the terminal supports the WPA3 authentication mode, the WPA3 authentication mode is maintained for authentication; if the terminal does not support the WPA3 authentication mode, the WPA2 authentication mode is turned on for authentication.

[0015] Furthermore, when the terminal is at the third security level, after notifying the terminal of the authentication mode, attack detection is performed.

[0016] A WiFi access system, comprising:

[0017] Access module, receiving request information from the terminal;

[0018] The main control module obtains the authentication mode supported by the terminal according to the request information, and queries the security level of the terminal in the database; after receiving the message of the authentication mode supported by the terminal, notifies the terminal to use the authentication mode for authentication;

[0019] A database storing security level information of the terminal;

[0020] An authentication module, which starts corresponding authentication according to the security level and the authentication mode supported by the terminal;

[0021] A connection module receives a connection request from the terminal and connects according to the authentication mode.

[0022] Furthermore, the authentication module includes:

[0023] A first authentication unit, which starts a password-free authentication mode when the security level of the terminal is the first security level;

[0024] A second authentication unit, when the security level of the terminal is the second security level or the third security level and the terminal does not support the WPA3 authentication mode, turns on the WPA2 authentication mode for authentication;

[0025] The third authentication unit maintains the WPA3 authentication mode for authentication when the security level of the terminal is the second security level or the third security level and the terminal supports the WPA3 authentication mode.

[0026] Furthermore, the system also includes an attack detection module. When the terminal is at the third security level, the attack detection module performs attack detection after notifying the terminal of the authentication mode.

[0027] A WiFi access device comprises a memory, a processor and a computer program stored in the memory and executable on the processor, wherein the processor implements any of the WiFi access methods described above when executing the program.

[0028] A computer medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements any of the above-mentioned WiFi access methods.

[0029] The beneficial effects of the present disclosure are as follows: in the WiFi access method, system, device and medium described in the present disclosure, the access module receives request information from the terminal, obtains the authentication mode of the terminal according to the request information, and queries the security level of the terminal in the database, and the main control module then enables different authentication modes according to the security level and authentication mode of the terminal, thereby ensuring the security of WiFi access, solving the compatibility problem of the terminal with different authentication modes, and improving the user experience. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] Figure 1 This is a schematic diagram of the process of the present disclosure;

[0031] Figure 2 A schematic diagram of the disclosed system;

[0032] Figure 3 This is a flow chart of Embodiment 1 of the present disclosure;

[0033] Figure 4 This is a flow chart of Embodiment 2 of the present disclosure;

[0034] Figure 5 This is a schematic diagram of the third embodiment of the present disclosure. DETAILED DESCRIPTION

[0035] The technical solution of the present disclosure will be described in detail below in conjunction with the accompanying drawings. In the description of the present disclosure, it should be understood that the terms "first", "second", and "third" are only used for descriptive purposes and cannot be understood as indicating or implying relative importance or implicitly indicating the number of indicated technical features, and are only used to distinguish different components.

[0036] Figure 1 The flow chart of the disclosed method is as follows: Figure 1 As shown, after receiving the request information of the terminal, the authentication mode supported by the terminal is obtained according to the request information, and the security level of the terminal is queried in the database, and then the corresponding authentication is started according to the security level of the terminal and the supported authentication mode; after receiving the message of the authentication mode supported by the terminal, the terminal is notified to use the authentication mode for authentication, and finally the connection request of the terminal is received and connected according to the authentication mode. The authentication modes described in the present invention include the password-free authentication mode, the WPA2 authentication mode and the WPA3 authentication mode; the security level of the terminal includes the first security level, the second security level and the third security level. In the present disclosure, the first security level indicates that the terminal has the highest security factor, that is, the security level is high, the second security level indicates that the security factor of the terminal is medium, and the third security level indicates that the security factor of the terminal is low, that is, the security level is low.

[0037] Figure 2 The schematic diagram of the disclosed system includes an access module, a main control module, a database, an authentication module and a connection module. The authentication module includes a first authentication unit, a second authentication unit and a third authentication unit. The first authentication unit is used for password-free authentication, the second authentication unit is used for WPA2 authentication, and the third authentication unit is used for WPA3 authentication. After the receiving module receives the request information (probe request) of the terminal, it detects all the information carried by the terminal, including the MAC address of the terminal, the supported rate and the current basic configuration. The database stores information such as the security level of the terminal. The user can add the terminal information to the database in advance, and can also freely set the security level of the terminal.

[0038] After the main control module inquires about the security level of the terminal applying for connection, it notifies the connection module to start the corresponding background authentication system. When the security level is the first security level, the connection module is notified to use the password-free authentication mode, and the terminal can be directly connected without a password, which improves the connection speed.

[0039] Figure 3This is a flow chart of the first embodiment of the present disclosure. When the security level of the terminal is the highest level, the password-free authentication mode is turned on for the terminal and the connection module is notified. When the security level of the terminal is not the highest level, the authentication mode adopted by the terminal is determined by whether the terminal supports the WPA3 authentication mode. If the terminal supports the WPA3 authentication mode, the terminal maintains the default WPA3 authentication mode and notifies the connection module; if the terminal does not support the WPA3 authentication mode, the connection module is notified to turn on the WPA2 authentication mode. After the connection module receives the authentication mode message, it notifies the terminal of the authentication mode through the probe response. The terminal sends a connection request and then connects according to the authentication mode of the terminal.

[0040] Figure 4 This is a flow chart of the second embodiment of the present disclosure, as shown in Figure 4 As shown, if the terminal's security level is the third security level, that is, the terminal has the lowest security factor, regardless of whether the terminal supports the WPA3 authentication mode, the terminal needs to perform attack detection before connecting. For example, when the security level is the third security level, if the terminal does not support the WPA3 authentication mode, the connection module is notified to use the WPA2 authentication mode. Before connecting using the WPA2 authentication mode, the terminal needs to be attacked and the timer (attack detection module) is started. If the number of connections is greater than the threshold within the specified time, the terminal is considered to have a tendency to network attacks. For example, if the number of times the terminal initiates a connection within 1 minute is greater than 5 times, that is, the password is entered incorrectly 5 times, the terminal is blacklisted.

[0041] Figure 5 This is a schematic diagram of the third embodiment of the present disclosure, as shown in Figure 5 As shown, when the security level of the terminal is the third security level, the authentication module sends the authentication mode to the connection module before the connection. The attack detection module will perform attack detection on the terminal. The terminal can only connect after passing the attack detection, otherwise the terminal will be added to the blacklist.

[0042] When the authentication is successful or the connection is disconnected, the information about the terminal security level in the database needs to be updated to prepare for the next connection. The terminal security level can be defined by some rules, such as the connection time, number of connections and weekend connection time of the terminal access device. In theory, the longer the connection time and the more successful connections, the higher the terminal security level. Table 1 is an example of the definition of terminal security level. There may be other conditions that affect the security level in actual use, which are not listed one by one. From Table 1, if the current terminal security level is level 3, when the terminal connection conditions meet the level 2 conditions, it can be upgraded to level 2. Similarly, it can be upgraded to level 1 if the level 1 conditions are met.

[0043]

[0044] Table 1

[0045] The above are exemplary embodiments of the present disclosure, and the protection scope of the present disclosure is defined by the claims and their equivalents.

Claims

1. A WiFi access method, characterized in that: include: Receiving request information from a terminal; Acquire the authentication mode supported by the terminal according to the request information, and query the security level of the terminal in a database; Starting authentication corresponding to the security level according to the security level and the authentication mode supported by the terminal; After receiving a message about an authentication mode supported by the terminal, informing the terminal to use the authentication mode for authentication; receiving a connection request from the terminal and connecting according to the authentication mode; The starting authentication corresponding to the security level according to the security level and the authentication mode supported by the terminal includes: When it is found that the security level of the terminal is the highest security level, the password-free authentication mode is turned on; as well as, When it is found that the security level of the terminal is the lowest security level, the terminal is notified of the authentication mode and then attack detection is performed.

2. The WiFi access method according to claim 1, characterized in that: The authentication modes include a password-free authentication mode, a WPA2 authentication mode, and a WPA3 authentication mode, and the security level of the terminal includes a first security level, a second security level, and a third security level.

3. The WiFi access method according to claim 2, characterized in that: When the security level of the terminal is the first security level, the password-free authentication mode is turned on; when the security level of the terminal is the second security level or the third security level, if the terminal supports the WPA3 authentication mode, the WPA3 authentication mode is maintained for authentication; if the terminal does not support the WPA3 authentication mode, the WPA2 authentication mode is turned on for authentication.

4. The WiFi access method according to claim 2, wherein: When the terminal is at the third security level, after notifying the terminal of the authentication mode, attack detection is performed.

5. The WiFi access method according to any one of claims 1 to 4, characterized in that: The method further comprises: When the connection is established or disconnected, the security level information is updated according to a preset rule, and the security level of the terminal is defined by the connection duration, the number of connections and the weekend connection duration of the terminal access device.

6. A WiFi access system, characterized in that: include: Access module, receiving request information from the terminal; The main control module obtains the authentication mode supported by the terminal according to the request information, and queries the security level of the terminal in a database; After receiving a message about an authentication mode supported by the terminal, informing the terminal to use the authentication mode for authentication; A database storing security level information of the terminal; an authentication module, which starts authentication corresponding to the security level according to the security level and an authentication mode supported by the terminal; A connection module, receiving a connection request from the terminal and connecting according to the authentication mode; The authentication module, when finding that the security level of the terminal is the highest security level, starts a password-free authentication mode; The system also includes an attack detection module, which performs attack detection after notifying the terminal of an authentication mode when it is found that the security level of the terminal is the lowest security level.

7. The WiFi access system according to claim 6, characterized in that: The authentication modes include a password-free authentication mode, a WPA2 authentication mode, and a WPA3 authentication mode, and the security level of the terminal includes a first security level, a second security level, and a third security level.

8. The WiFi access system according to claim 7, characterized in that: The authentication module comprises: A first authentication unit, which starts a password-free authentication mode when the security level of the terminal is the first security level; A second authentication unit, when the security level of the terminal is the second security level or the third security level and the terminal does not support the WPA3 authentication mode, turns on the WPA2 authentication mode for authentication; The third authentication unit maintains the WPA3 authentication mode for authentication when the security level of the terminal is the second security level or the third security level and the terminal supports the WPA3 authentication mode.

9. The WiFi access system according to claim 7, characterized in that: The attack detection module performs attack detection after notifying the terminal of the authentication mode when the terminal is at the third security level.

10. A WiFi access device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the WiFi access method according to any one of claims 1 to 5 is implemented.

11. A computer medium, characterized in that The computer medium stores a computer program, and when the computer program is executed by the processor, the WiFi access method according to any one of claims 1 to 5 is implemented.

Images