A WAPI authentication escape method

Abstract

The present invention discloses a method for WAPI authentication escape, a wireless access point, and a wireless terminal, comprising the following steps: AP declares authentication escape capability through an authentication activation message, and STA declares authentication escape capability through a flag field in an access authentication request message; if both AP and STA have authentication escape capability, AP and STA respectively save a base key and a base key identifier of the authentication process after WAPI authentication is successful; when a WAPI authentication server (AS) is unavailable, AP initiates key negotiation to STA based on the saved base key identifier, and STA and AP complete key negotiation based on the saved base key. The method improves the WAPI authentication protocol flow, and can realize that when AS is unavailable, the wireless terminal can still safely access the wireless access point and roam between multiple wireless access points, thereby improving the survivability and availability of the WAPI wireless network.

Description

Technical Field

[0001] The present invention relates to the field of communication technology, and in particular to a WAPI authentication escape method. Background Art

[0002] In recent years, with the advancement of digitalization and intelligence, WAPI wireless networks have been increasingly used in the country's key infrastructure industries, and more and more mobile work terminals have been connected to the WAPI wireless private network, such as robots and work tablets.

[0003] In these WAPI wireless networks, there may be a wide area network between the AP and the AS, such as Figure 3 The schematic diagram of the electric power WAPI wireless network structure shows a substation WAPI wireless network. In the substation WAPI wireless network, the AP and wireless terminal are located in the substation, the AS is located at the master station (in the power bureau building computer room), and there is a complex network between the substation and the master station, including a wide area network, a firewall or a two-way physical isolation device. If the network between the substation and the master station fails, or the AS fails, the STA in the substation will not be able to access the AP, and the STA will not be able to roam between APs. At this time, the substation robot and other operating terminals will not be able to operate; but in fact, the substation robot only needs to communicate with the business server in the substation when it is operating. Currently, there is no mechanism for wireless access points AP and WAPI wireless terminals STA to solve the problem that STA can still safely access AP when AS is unavailable and STA can still safely roam between multiple APs. Summary of the invention

[0004] Based on the technical problems existing in the background technology, the present invention proposes a WAPI authentication escape method.

[0005] A WAPI authentication escape method proposed in the present invention comprises the following steps:

[0006] S1: The AP declares the authentication escape capability through the authentication activation message and the STA declares the authentication escape capability through the flag field in the access authentication request message;

[0007] S2: If both the AP and STA have the authentication escape capability, the AP and STA will save the base key and base key identifier of the authentication process respectively after WAPI authentication succeeds.

[0008] S3: When the WAPI authentication server (AS) is unavailable, the AP initiates key negotiation to the STA based on the saved base key identifier, and the STA and the AP complete the key negotiation based on the saved base key. This method improves the WAPI authentication protocol process, maintains security, and can complete mutual authentication and key negotiation between the AP and the STA when the AS is unavailable, thereby achieving WAPI authentication escape and improving the availability of the WAPI wireless network.

[0009] Preferably, in S1, the AP sets the 7th bit of the authentication activation message flag field to 1 to declare that the AP has the authentication escape capability, and the STA sets the 7th bit of the access authentication request message flag field to 1 to declare that the STA has the authentication escape capability; the STA records its Flag field after receiving the authentication activation message from the AP, and the AP records its Flag field after receiving the access authentication message from the STA.

[0010] Preferably, in S2, the AP and the STA record and save the base key BK, base key identifier BKID, and the other party's MAC address obtained by the key derivation calculation performed for key negotiation after the WAPI authentication is successful; the record saving includes creating related BK and BKID information when there is no corresponding record, updating the saved information of BK and BKID after each successful WAPI authentication, and deleting the related BK and BKID saved information if the WAPI authentication is unsuccessful.

[0011] Preferably, in S3, after receiving the access authentication request from the STA, the AP sends a certificate authentication request message to the AS in accordance with the WAPI protocol standard process. If the waiting time for the AS response message times out, the AS is determined to be unavailable. Then the AP checks its own configuration and checks whether the Flag field of the currently accessed STA has the authentication escape capability. If both have, the authentication escape processing is triggered. The authentication escape processing of the AP includes: the AP searches for the BK and BKID corresponding to the MAC address of the currently accessed STA in the BK and BKID saved information. If not found, it indicates that no successful WAPI authentication has been performed with this STA, and the connection with this STA is disconnected. If found, a unicast key negotiation message is sent to this STA and then the unicast key negotiation phase is entered. The BKID in the unicast key negotiation message comes from the found BKID information.

[0012] Preferably, in S3, when the STA receives a unicast key negotiation state while waiting for an access authentication response message, it is determined that the connected AP has triggered a WAPI authentication escape, and the STA checks the configuration of the STA and the authentication escape capability of the connected AP. If both the STA and the AP have the authentication escape capability, the STA starts the authentication escape process; the STA searches for the BK and BKID saved information according to the received BKID. If not found, it indicates that no successful WAPI authentication has been performed with this AP, and the connection with the current AP is disconnected. If found, the unicast key negotiation stage is entered, and then both the STA and the AP enter the unicast key negotiation state, and the WAPI key negotiation process is completed through the standard WAPI protocol process.

[0013] The beneficial effects of the present invention are:

[0014] 1. In the present invention, when the WAPI certificate identifier AS is unavailable, the credibility of the other end can be determined based on the base key BK and base key identifier BKID information stored by both parties. Under a credible situation, the WAPI authentication escape process is performed to achieve the secure establishment of the WAPI connection between the STA and the AP, which is beneficial to improving the generation capability and availability of the WAPI wireless network. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] Figure 1 A WAPI access authentication process diagram of a WAPI authentication escape method proposed by the present invention;

[0016] Figure 2 A WAPI authentication escape process diagram of a WAPI authentication escape method proposed by the present invention;

[0017] Figure 3 A schematic diagram of the structure of a power WAPI wireless network for a WAPI authentication escape method proposed by the present invention;

[0018] Figure 4 A FLAG byte diagram in the WAPI authentication protocol of a WAPI authentication escape method proposed by the present invention;

[0019] Figure 5 This is a unicast key negotiation message definition diagram of a WAPI authentication escape method proposed by the present invention. DETAILED DESCRIPTION

[0020] The technical solutions in the embodiments of the present invention will be described clearly and completely below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments.

[0021] Reference Figure 1-4, a WAPI authentication escape method, comprising the following steps:

[0022] S1: The AP declares the authentication escape capability through the authentication activation message and the STA declares the authentication escape capability through the flag field in the access authentication request message;

[0023] S2: If both the AP and STA have the authentication escape capability, the AP and STA will save the base key and base key identifier of the authentication process respectively after WAPI authentication succeeds.

[0024] S3: When the WAPI authentication server (AS) is unavailable, the AP initiates key negotiation to the STA based on the saved base key identifier, and the STA and the AP complete the key negotiation based on the saved base key. This method improves the WAPI authentication protocol process, maintains security, and can complete mutual authentication and key negotiation between the AP and the STA when the AS is unavailable, thereby achieving WAPI authentication escape and improving the availability of the WAPI wireless network.

[0025] In the present invention, in S1, the AP sets the 7th bit of the authentication activation message flag field to 1 to declare that the AP has the authentication escape capability, and the STA sets the 7th bit of the access authentication request message flag field to 1 to declare that the STA has the authentication escape capability; the STA records its Flag field after receiving the authentication activation message from the AP, and the AP records its Flag field after receiving the access authentication message from the STA.

[0026] In the present invention, in S2, the AP and the STA record and save the base key BK, the base key identifier BKID, and the other party's MAC address obtained by the key derivation calculation for key negotiation after the WAPI authentication is successful; the record saving includes creating related BK and BKID information when there is no corresponding record, updating the saved information of BK and BKID after each successful WAPI authentication, and deleting the related BK and BKID saved information if the WAPI authentication is unsuccessful.

[0027] In the present invention, in S3, that is, after receiving the access authentication request from the STA, the AP sends a certificate authentication request message to the AS according to the standard process of the WAPI protocol. If the waiting time for the AS response message times out, the AS is determined to be unavailable. Then the AP checks its own configuration and checks whether the Flag field of the currently accessed STA has the authentication escape capability. If both have, the authentication escape processing is triggered. The authentication escape processing of the AP includes: the AP searches the BK and BKID corresponding to the MAC address of the currently accessed STA in the BK and BKID saved information. If not found, it indicates that no successful WAPI authentication has been performed with this STA, and the connection with this STA is disconnected. If found, a unicast key negotiation message is sent to this STA and then the unicast key negotiation phase is entered. The BKID in the unicast key negotiation message comes from the found BKID information.

[0028] In the present invention, in S3, when the STA receives the unicast key negotiation state while waiting for the access authentication response message state, it is determined that the connected AP has triggered the WAPI authentication escape, and the STA checks the configuration of the STA and the authentication escape capability of the connected AP. If both the STA and the AP have the authentication escape capability, the STA starts the authentication escape process; the STA searches for the BK and BKID saved information according to the received BKID. If it is not found, it indicates that no successful WAPI authentication has been performed with this AP, and the connection with the current AP is disconnected. If it is found, the unicast key negotiation stage is entered, and then both the STA and the AP enter the unicast key negotiation state, and the WAPI key negotiation process is completed through the standard WAPI protocol process.

[0029] like Figure 4 The FLAG byte in the WAPI authentication protocol is Figure 1 The protocol field in each WAPI protocol message shown in the WAPI access authentication process is one byte, of which the 7th bit, B7, is currently defined as reserved in the WAPI protocol. This reserved byte is used to declare that the wireless access point or AP or the wireless terminal STA has the WAPI authentication escape capability. The WAPI authentication escape capability means that when the WAPI certificate identifier (AS) is unavailable, the STA and the AP can make a mutual credibility judgment and enter the key agreement phase when they judge that each other is trustworthy, so that the STA and the AP can communicate securely when the AS is unavailable, including the roaming handover of the STA between multiple APs. When the AP sends an authentication activation message to the STA, if the B7 of the Flag is 1, it indicates that the AP has the WAPI authentication escape capability; similarly, when the STA sends an access authentication message to the AP, if the B7 of the Flag is 1, it indicates that the STA has the WAPI authentication escape capability.

[0030] like Figure 2The schematic diagram of the WAPI authentication escape process includes two entities, namely, the wireless access point AP1201 and the wireless terminal STA entity 101. The processing and process related to the method described in this embodiment include:

[0031] In order to implement the WAPI authentication escape disclosed in this embodiment when the AS is unavailable, STA 101 and AP 102 will record the base key BK and base key BKID in the WAPI authentication process when the WAPI authentication is successfully completed for the first time. The recorded content includes the MAC address, BKID, and BK of the other end; each subsequent successful completion of the WAPI authentication will update the recorded BKID and BK; if the authentication of STA 101 and AP 102 fails, STA 101 and AP 102 will delete the recorded BKID and BK respectively.

[0032] S21: After establishing a wireless association with the STA, the AP 102 sends an authentication activation message to the STA 101, wherein Flag B7 of the message is set to 1, indicating that the AP 102 has the WAPI authentication escape capability.

[0033] S22: After receiving the authentication activation message from AP 102, STA 101 performs authentication-related processing specified by the WAPI protocol, records the Flag field of AP 102, and then sends an access authentication request message to AP 102, in which FlagB7 of the message is set to 1, indicating that STA 101 has the WAPI authentication escape capability.

[0034] S23: After receiving the access authentication request message from STA 101, AP 102 performs the relevant processing specified by the WAPI authentication protocol, records the Flag field of STA 101, and then sends a certificate authentication request message to AS 103. The WAPI certificate authentication request interaction between AP 102 and AS103 does not require any changes compared to the standard.

[0035] S24: Assuming that AS 103 is unavailable, this may be because the network connection between AP 102 and AS 103 is unavailable, or AS 103 may be faulty and unavailable, resulting in a timeout when AP 102 is waiting for the authentication response message from AS 103. AP 102 determines that AS 103 is unavailable.

[0036] S25: AP 102 determines that AS 103 is unavailable. In this case, AP 102 checks whether it has the WAPI authentication escape capability and whether the currently connected STA 101 has the WAPI authentication escape capability. If both have the WAPI authentication escape capability, AP 102 triggers the WAPI authentication escape process: (a) AP 102 searches for the BK and BKID corresponding to the MAC address of STA 101 in the saved BK and BKID information. If not found, it indicates that AP 102 has not successfully performed WAPI authentication with STA 101, and thus determines that STA 101 is untrustworthy, and disconnects from STA 101; (b) If found, it determines that STA 101 is trustworthy, and sends a unicast key negotiation message to STA 101 (the message structure is as shown in FIG. 1 ). Figure 5 The unicast key negotiation phase is then entered, where the BKID is the BKID information found based on the MAC address of STA 101.

[0037] S26: STA 101 is in the state of waiting for the access authentication response message. In this state, it receives the unicast key negotiation request message from AP 102. STA 101 can determine that AP 102 has triggered the WAPI authentication escape process. Then STA 101 checks whether it has the WAPI authentication survival capability and whether AP 102 has the WAPI authentication survival capability. If both are available, STA 101 starts the WAPI authentication escape process: (a) STA 101 searches for the saved BK and BKID information according to the BKID in the received unicast key negotiation request message. If not found, it indicates that no successful WAPI authentication has been performed with AP 102. It is determined that AP 102 is untrustworthy and the connection with AP 102 is disconnected. (b) If found, it enters the unicast key negotiation phase, performs relevant protocol processing and sends a unicast key negotiation response message to AP 102.

[0038] As a result, both STA 101 and AP 102 enter the unicast key negotiation state. The following process is the standard WAPI protocol process, which includes S27AP 102 sending a unicast key negotiation confirmation message to STA 101 to complete the unicast key negotiation, and further multicast key announcement process. The multicast key announcement is based on the result of the unicast key negotiation. Finally, STA 101 completes the entire key negotiation process with AP 102. AP 102 opens the communication port of STA 101, and both parties enter the communication state.

[0039] Assuming that a third-party AP or STA obtains BKID from the air interface, these APs or STAs participate in the aforementioned WAPI authentication escape process by counterfeiting. Since the third-party AP or STA cannot have the correct private key information, the message signature verification during the key negotiation process fails, and the key negotiation process cannot be completed. It can be seen that the WAPI authentication escape method described in this embodiment is secure.

[0040] A WAPI authentication escape method and a wireless access point (AP) and a wireless terminal (STA) device can determine the credibility of the other end based on the base key BK and base key identifier BKID information stored by both parties when a WAPI certificate identifier AS is unavailable, and establish a WAPI connection between the STA and the AP through WAPI authentication escape processing under a credible condition, which is safe and conducive to improving the generation capability and availability of the WAPI wireless network.

[0041] The above description is only a preferred specific implementation manner of the present invention, but the protection scope of the present invention is not limited thereto. Any technician familiar with the technical field can make equivalent replacements or changes according to the technical scheme and inventive concept of the present invention within the technical scope disclosed by the present invention, which should be covered by the protection scope of the present invention.

Claims

1. A WAPI authentication escape method, characterized in that: The following steps are involved: S1: The AP declares the authentication escape capability through the authentication activation message and the STA declares the authentication escape capability through the flag field in the access authentication request message; S2: If both the AP and STA have the authentication escape capability, the AP and STA will save the base key and base key identifier of the authentication process respectively after WAPI authentication succeeds. S3: When the WAPI authentication server (AS) is unavailable, the AP initiates key negotiation with the STA based on the stored base key identifier, and the STA and AP complete key negotiation based on the stored base key. In S1, the AP sets the 7th bit of the authentication activation message flag field to 1 to declare that the AP has the authentication escape capability, and the STA sets the 7th bit of the access authentication request message flag field to 1 to declare that the STA has the authentication escape capability; The STA records the Flag field after receiving the authentication activation message from the AP, and the AP records the Flag field after receiving the access authentication message from the STA.

2. A WAPI authentication escape method according to claim 1, characterized in that: In the S2, the AP and the STA record and save the base key BK, the base key identifier BKID, and the other party's MAC address obtained by the key derivation calculation for key negotiation after the WAPI authentication is successful; the record saving includes creating related BK and BKID information when there is no corresponding record, updating the saved information of BK and BKID after each successful WAPI authentication, and deleting the related BK and BKID saved information if the WAPI authentication is unsuccessful.

3. A WAPI authentication escape method according to claim 1, characterized in that: In S3, after receiving the access authentication request from the STA, the AP sends a certificate authentication request message to the AS according to the standard process of the WAPI protocol. If the waiting time for the AS response message times out, the AS is determined to be unavailable. Then the AP checks its own configuration and checks whether the Flag field of the currently accessed STA has the authentication escape capability. If both have, the authentication escape processing is triggered. The authentication escape processing of the AP includes: the AP searches the BK and BKID corresponding to the MAC address of the currently accessed STA in the BK and BKID saved information. If not found, it indicates that no successful WAPI authentication has been performed with this STA, and the connection with this STA is disconnected. If found, a unicast key negotiation message is sent to this STA and then the unicast key negotiation phase is entered. The BKID in the unicast key negotiation message comes from the found BKID information.

4. The WAPI authentication escape method according to claim 1, characterized in that: In S3, when the STA receives a unicast key negotiation message while waiting for an access authentication response message, it is determined that the connected AP has triggered a WAPI authentication escape. The STA checks the configuration of the STA and the authentication escape capability of the connected AP. If both the STA and the AP have the authentication escape capability, the STA starts the authentication escape process. STA searches for BK and BKID saved information according to the received BKID. If it is not found, it indicates that it has not successfully performed WAPI authentication with this AP, and disconnects from the current AP. If it is found, it enters the unicast key negotiation phase, and then both the STA and the AP enter the unicast key negotiation state, and complete the WAPI key negotiation process through the standard WAPI protocol process.

Images