A WAPI certificate application method, wireless terminal, and certificate identifier

Abstract

The present invention discloses a WAPI certificate application method, a wireless terminal (STA), and a WAPI certificate identifier (AS). The STA generates a first WAPI certificate through self-signature, and includes a first extended attribute in the first WAPI certificate to represent the WAPI certificate application intention. The AS determines the STA's WAPI certificate application intention based on the first extended attribute in the first WAPI certificate, generates a second WAPI certificate issued to the STA based on the information in the first WAPI certificate, and forms a third WAPI certificate by modifying the first WAPI certificate. The method of the present invention can apply for a WAPI certificate online based on the WAPI network to be accessed, without the need for other networks or upgrading existing APs, and has good convenience, compatibility, and cost-effectiveness.

Description

Technical Field

[0001] The present invention relates to the field of communication technology, and in particular to a WAPI certificate application method, a wireless terminal, and a certificate identifier. Background Art

[0002] WAPI is a WLAN wireless security standard and technology specified by China's national wireless LAN standard GB15629.11. WAPI uses digital certificates to identify wireless access points (APs), wireless terminals (STAs), and WAPI certificate identifiers. It authenticates APs and STAs based on a three-factor authentication system, ensuring the security of wireless access authentication and effectively preventing unauthorized terminals from accessing wireless networks and terminals from accessing counterfeit APs. In a WAPI wireless LAN, both the AP and STA must install a WAPI digital certificate for three-factor authentication. There are two common ways to obtain a WAPI wireless terminal certificate:

[0003] Method A: The WAPI certificate authentication server (AS) generates a key pair (including public and private keys) for the WAPI wireless terminal and generates a WAPI public key certificate based on the public key. The public key certificate is signed by the AS's private key. The public key certificate and private key of the terminal device are then delivered to the WAPI terminal through a secure channel for installation. This process requires a secure channel for certificate delivery because it includes sensitive information - the private key. In addition to verifying the identity of the applicant, the privacy and tamper-proofing of the message must also be guaranteed. If this secure channel is used online, the transmitted information must be encrypted or processed in a secure tunnel.

[0004] Method B: The WAPI terminal generates a key pair (including public and private keys) by itself and then generates a certificate signature application file. This file is called a P10 (short for the international standard PKCS#10) file. The P10 file includes the terminal device information (applicant's organization, device name, etc.), public key information, but does not include private key information. It also includes the P10 signature information made by the generator using its private key. The recipient can use the public key information in the P10 file to verify the signature of P10; the P10 file is passed to the AS. Based on the subject information (Subject) and public key information in the P10 file, the AS generates a public key certificate file for the applicant. The public key certificate file is signed with the AS's private key; this public key certificate file is then issued to the applicant for installation. This process does not include the private key information of the terminal device. During the transmission process, only the identity of the applicant and the tamper-proof check of the transmitted information need to be checked. There are no other security requirements.

[0005] In recent years, with the advancement of digitalization and intelligentization, WAPI wireless networks have been increasingly used in key national infrastructure industries. More and more mobile operating terminals, such as robots and work tablets, are connected to WAPI wireless private networks. Applications for WAPI wireless terminal certificates in these industries generally use Method B, as described above. Method B has two specific methods:

[0006] Method B1: Manual process. The WAPI wireless terminal generates a P10 file, which is then transmitted to the certificate application administrator via a non-WAPI network email connection. After receiving the P10 file, the administrator generates the certificate file using the AS human-computer interface and then sends the certificate file to the applicant via email. If the AS is located on the intranet, the administrator obtains the P10 file from an external computer and copies it from the external network to the intranet. After the AS generates the certificate, the certificate file is copied from the intranet to the external network and then sent to the applicant.

[0007] Method B2: Auxiliary system process. The online application for a WAPI certificate is completed by using a network other than the WAPI network to be connected. When applying for a certificate, the WAPI terminal temporarily connects to the auxiliary network to transfer the P10 file over the network or completes the application online using a software system based on a non-WAPI network.

[0008] The problem with method B1 is that it is troublesome and inefficient. Method B2 can solve this problem, but it has cost issues due to the cost of building an auxiliary network. At the same time, in some industries with high security requirements, the security management system does not allow "one machine with two networks", that is, it does not allow a network device to be used in multiple networks. In this way, method B2 will be restricted because the security management system does not allow WAPI terminals to access networks other than the intended WAPI network.

[0009] Patent 200910189481.4 "A WAPI Certificate Acquisition Method, Device and Network System" provides a method for obtaining a WAPI certificate based on a WAPI wireless network, but it is not applicable in some areas. For example, the WAPI terminals used in the production networks of national infrastructure industries such as the power grid industry often do not have or are not allowed to have mobile phone functions, and do not have the IMSI (International Mobile Subscriber Identity) involved in this patent. At the same time, these terminals do not have pre-installed WAPI certificates. Moreover, the documentation of this patent does not explain how to send the issued certificate to the wireless terminal, nor does it explain how to download the AS certificate to the terminal.

[0010] Patent 201010221869.0 "A method, system and device for updating a WAPI certificate" provides a method for updating a WAPI certificate based on a WAPI wireless network. However, it updates the certificate of an AP or STA that already has a WAPI certificate, and cannot solve the problem of a STA without a WAPI certificate applying for a WAPI certificate online for the first time. At the same time, the relevant method must also extend and modify the protocol of ordinary APs, which leads to AP compatibility issues.

[0011] There are also other invented methods that implement online WAPI certificate application based on WAPI wireless network by extending the WAPI wireless authentication protocol. However, this protocol extension requires AP software upgrade, which has compatibility issues and thus leads to certain limitations in actual use. Furthermore, this compatibility issue will further limit the application of this method of extending the WAPI wireless authentication protocol if there are APs from multiple manufacturers in the wireless network. Summary of the Invention

[0012] Based on the technical problems existing in the background technology, the present invention proposes a WAPI certificate application method, a wireless terminal, and a WAPI certificate identifier.

[0013] The present invention proposes a WAPI certificate application method, a wireless terminal (STA), and a WAPI certificate authentication device (AS). The STA generates a first WAPI certificate through self-signature, and includes a first extended attribute in the first WAPI certificate to represent the WAPI certificate application intention. The AS determines the STA's WAPI certificate application intention based on the first extended attribute in the first WAPI certificate, and generates a second WAPI certificate issued to the STA based on information in the first WAPI certificate. The third WAPI certificate is formed by modifying the first WAPI certificate. The modification includes adding a second extended attribute to carry the second WAPI certificate, adding a third extended attribute to carry the AS public key certificate, and re-signing. The STA and the AS interact based on the standard WAPI authentication protocol through a WAPI wireless network to achieve the transfer of the first and third WAPI certificates, thereby enabling the wireless terminal to apply for WAPI certificates online.

[0014] S1: To apply for a WAPI certificate, a wireless terminal STA associates with a wireless access point AP in the WAPI wireless network to be accessed. After receiving a WAPI authentication activation message from the AP, the STA sends a standard WAPI access authentication message to the AP. The terminal certificate in the WAPI access authentication message is a first WAPI certificate generated by the STA through self-signature.

[0015] S2: After receiving the standard certificate authentication request message, the WAPI certificate identifier AS obtains the terminal certificate, i.e., the first WAPI certificate, from the message. The AS checks the first extended attribute of the first WAPI certificate to determine whether the authentication request is a certificate application by the STA. If so, the AS performs an applicant authorization check based on the applicant authentication information included in the first extended attribute of the first WAPI certificate. If the authorization check passes, the AS generates a second WAPI certificate issued to the STA based on the first WAPI certificate. The AS then modifies the first WAPI certificate to form a third WAPI certificate, includes the third WAPI certificate as the terminal certificate in the terminal certificate field of the authentication result of the certificate authentication response message, and uses a specific authentication result value to indicate the certificate application result status. Modifying the first WAPI certificate includes adding a second extended attribute to identify and include the second certificate, adding a third extended attribute to identify and include the AS certificate, and re-signing the certificate with the AS private key.

[0016] S3: After receiving the standard access authentication response message, the STA obtains the terminal certificate authentication result value from the message to determine the certificate application result status. If the result status is successful, the STA obtains the terminal certificate, i.e., the third WAPI certificate, from the authentication result. The STA then obtains the second WAPI certificate, i.e., the WAPI certificate applied for by the STA, from the second extended attribute of the third WAPI certificate, and obtains the AS certificate from the third extended attribute of the third WAPI certificate.

[0017] Furthermore, in S1, the certificate subject (or holder) of the first WAPI certificate includes the applicant's key information, public key information, and the certificate application behavior is identified by the first extended attribute of the first WAPI certificate. The first extended attribute also includes the applicant's identification information, and the identification information is manually entered by the applicant when applying.

[0018] The beneficial effects of the present invention are:

[0019] The method of the present invention can apply for a WAPI certificate online based on the WAPI network to be accessed, does not require the use of other networks, and does not require upgrading the existing AP, and has good convenience, compatibility and economy. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Figure 1 The self-signed WAPI certificate generated by the wireless terminal is the first WAPI certificate;

[0021] Figure 2 WAPI certificate authentication result composition information;

[0022] Figure 3 Standard WAPI authentication process;

[0023] Figure 4The AS forms a third WAPI certificate based on the first WAPI certificate. DETAILED DESCRIPTION

[0024] The technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments.

[0025] Reference Figure 1-4 A WAPI certificate application method is provided, involving a wireless terminal (STA) and a WAPI certificate authenticator (AS). The STA generates a first WAPI certificate by self-signing, and includes a first extended attribute in the first WAPI certificate to represent the WAPI certificate application intention. The AS determines the STA's WAPI certificate application intention based on the first extended attribute in the first WAPI certificate, and generates a second WAPI certificate issued to the STA based on the information in the first WAPI certificate. The third WAPI certificate is formed by modifying the first WAPI certificate. The modification includes adding a second extended attribute to carry the second WAPI certificate, adding a third extended attribute to carry the AS public key certificate, and re-signing. The STA and the AS interact based on the standard WAPI authentication protocol through a WAPI wireless network to realize the transfer of the first WAPI certificate and the third WAPI certificate, thereby realizing the online application of the WAPI certificate by the wireless terminal.

[0026] S1: To apply for a WAPI certificate, the wireless terminal STA associates with the wireless access point (AP) in the WAPI wireless network it intends to access. After receiving the WAPI authentication activation message from the AP, the STA sends a standard WAPI access authentication message to the AP. The terminal certificate in the WAPI access authentication message is the first WAPI certificate generated by the STA through self-signed signature.

[0027] S2: After receiving the standard certificate authentication request message, the WAPI certificate authentication device (AS) obtains the terminal certificate, i.e., the first WAPI certificate, from it. The AS checks the first extended attribute of the first WAPI certificate to determine whether the authentication request is a certificate request from the STA. If so, the AS performs an applicant authorization check based on the applicant authentication information included in the first extended attribute of the first WAPI certificate.

[0028] S3: After receiving the standard access authentication response message, the STA obtains the terminal certificate authentication result value from it to determine the certificate application result status. If the result status is successful, it extracts the terminal certificate, i.e., the third WAPI certificate, from the authentication result. It then extracts the second WAPI certificate, i.e., the WAPI certificate applied for by the STA, from the second extended attribute of the third WAPI certificate. It also extracts the AS certificate from the third extended attribute of the third WAPI certificate. In S1, the certificate subject (or holder) of the first WAPI certificate includes the applicant's key information and public key information, and the certificate application behavior is identified by the first extended attribute of the first WAPI certificate. The first extended attribute also includes the applicant's authentication information, which is manually entered by the applicant during the application. In S2, if the authorization check passes, a second WAPI certificate is generated and issued to the STA based on the first WAPI certificate, and then the first WAPI certificate is modified to form a third WAPI certificate. The third WAPI certificate is included as a terminal certificate in the terminal certificate field of the authentication result of the certificate authentication response message, and a specific authentication result value is used to indicate the certificate application result status; the first WAPI certificate is modified, including adding a second extended attribute to identify and include the second certificate, adding a third extended attribute to identify and include the AS certificate, and re-signing with the AS private key.

[0029] In order to illustrate the embodiments of this patent, the standard WAPI authentication process is first described. Figure 3 The standard WAPI authentication process is as follows:

[0030] (1) After the wireless terminal STA associates with the AP, the AP sends an authentication activation (ACTIVE) message to the STA, which includes the AP's certificate information.

[0031] (2) After receiving the authentication activation message from the WAP, the STA sends an access authentication request message to the AP. This message includes the STA's certificate information.

[0032] (3) After receiving the access authentication request from the STA, the AP sends a certificate authentication request message to the WAPI certificate authenticator (AS). This message includes the AP's own certificate information and the received STA certificate information.

[0033] (4) After receiving the certificate authentication request from the AP, the AS performs a certificate authentication check, generates a certificate authentication result, and sends a certificate authentication response message to the AP. The certificate authentication response message includes a "certificate authentication result" field, which contains information such as Figure 2 The WAPI certificate authentication result composition information is shown as follows, where the first authentication result and the first certificate are for the AP, and the second authentication result and the second certificate are for the STA.

[0034] (5) After receiving the certificate authentication response message from the AS, the AP sends an access authentication response message to the STA. This message includes the certificate authentication result of the AS. The AP rejects or accepts the STA's access based on the certificate authentication result.

[0035] (6) After the STA receives the access authentication response message from the AP, this message includes the composite AS certificate authentication result, which includes the AS certificate authentication result and the AS's signature. The STA determines whether to access the connected AP based on the AS certificate authentication result.

[0036] The following describes embodiments.

[0037] Regarding the WAPI certificate application method, wireless terminal, and WAPI certificate identifier of the present invention, in the following Figure 3 In the figure showing the standard WAPI authentication process, the wireless terminal STA101 and the WAPI certificate authenticator AS103 are involved in the implementation of the method related to the present invention, while the wireless access point AP102 is not involved in any implementation of the method related to the present invention.

[0038] When STA101 associates with AP102, AP102 will send a WAPI authentication activation message to STA101. After STA101 receives the authentication activation message from AP102, if STA102 is applying for a WAPI certificate at this time, it will first generate a self-signed certificate, the content of which is as follows: Figure 3 The self-signed WAPI certificate generated by the wireless terminal is the first WAPI certificate. The first WAPI certificate is then encapsulated as the wireless terminal's own WAPI certificate in the STA certificate field of a standard WAPI access authentication message and sent to AP 102. In this embodiment, bit 2 (certificate verification request flag) of the FLAG field of the WAPI access authentication message sent by STA 101 is set to 1. According to the WAPI authentication protocol standard, this indicates that STA 101 requests verification of the validity of AP 102's certificate. That is, upon receiving the WAPI access authentication message, AP 102 will request AS 103 to perform WAPI certificate authentication.

[0039] In the method described in this patent, STA101 replaces the aforementioned P10 file with a self-signed certificate. The self-signed certificate includes all the key contents of the P10 file, namely, several domain names (DomainName, DN) of the certificate subject (or holder) and the certificate public key. The first WAPI certificate generated by the self-signature of STA101 also includes an extended attribute, namely the first extended attribute 100. In the WAPI standard, digital certificates use the X509V3 format. This type of certificate allows users to define domain-specific extended attributes in the extended attribute domain. The extended attributes are encapsulated with the ASN.1-encoded SEQUENCE type (i.e., type 0x30), which includes two fields: object identifier, i.e., OID, and attribute value. The OID in the extended attribute is used to represent the purpose of this extended attribute, and its type is ASN.1-encoded ObjectIdenfier, while the attribute value is specific content related to this purpose, and its type is ASN.1-encoded OCTETString. STA101 indicates to AS103 through the first extended attribute 100 that it is applying for a WAPI certificate. At the same time, the STA also uses the attribute value of the first extended attribute 100 to carry the authorization and authentication information of the wireless terminal. The authorization information is a password or authorization verification code, which is sent by the administrator of AS103 to the user of STA101 (or the debugging and installation personnel) through other channels, such as mobile phone text messages, internal organizational emails, and voice calls. The user of STA101 enters it into the STA101 system before STA101 initiates the WAPI certificate application.

[0040] like Figure 3 In the example, AP102, a standard wireless access point, receives the access authentication request message from STA101 and processes it according to the standard wireless terminal access message processing flow. Specifically, it places STA101's WAPI certificate (in this embodiment, the first WAPI certificate) along with AP102's own WAPI certificate into a certificate authentication request message and sends it to AS103. The so-called "standard" wireless access point AP102 does not include any specific implementations related to this patent; that is, the present invention does not require AP102 to make any modifications to its WAPI authentication processing. According to the WAPI technology standard, AP102 does not check STA101's WAPI certificate. However, because STA101 sets bit 2 (the certificate verification request flag) of the FLAG field of the WAPI access authentication message to 1, AP102 needs to request certificate authentication from AS103.

[0041] After receiving the WAPI certificate authentication request sent by AP102, AS103 authenticates AP102's WAPI certificate, similar to the general WAPI authentication process. It then checks STA101's certificate, i.e., the self-signed WAPI certificate generated by STA101, i.e., the first WAPI certificate. During this process, AS103 first checks whether the first WAPI certificate includes the first extended attribute 100. If the first extended attribute is not present, AS103 performs the general WAPI certificate authentication process. If the first extended attribute is present, AS103 performs the certificate request process, including the following steps:

[0042] (1) Application authentication: The authentication information of the applicant is extracted from the first extended attribute 100 to perform an authorization check. If the authorization check fails, the application result status value is recorded as R=102, indicating that the application authentication fails. Then, the certificate application result sending process is entered, i.e., the following (4) application result formation is performed.

[0043] (2) Generation of the Second Certificate: If the authorization check passes, the WAPI certificate issuance process continues. That is, based on the certificate subject (Subject) attributes and public key information in the first certificate, AS103 generates a WAPI certificate, i.e., the second WAPI certificate, which is issued to STA101. If this process is successfully completed, the application result status value is recorded as R=100, indicating that the application is successful. Otherwise, R=101 is recorded, indicating that the certificate issuance is abnormal.

[0044] (3) Formation of the Third Certificate: In order to transmit the second certificate and the AS certificate to STA 101 simultaneously, as a preferred solution, the first WAPI certificate is modified by: a) adding a second extended attribute, wherein the OID field identifies this extended field as a certificate issued to the STA, and its value field is the content of the second certificate; b) adding a third extended attribute, wherein the OID field identifies this extended field as the public key certificate of the AS, and its value field is the content of the AS public key certificate. This modification process forms the third WAPI certificate, whose content is as follows: Figure 4 The third WAPI certificate formed by the AS based on the first WAPI certificate is shown as an example.

[0045] (4) Application result formation: The "certificate authentication result" in the WAPI standard protocol is used to carry the application result and the third WAPI certificate, that is: a) The first authentication result and certificate fields of the certificate authentication result are filled with the authentication result value of AS103 on AP102's certificate and the certificate content of AP102. This is the standard WAPI protocol practice; b) If R=100, the second authentication result and certificate fields of the certificate authentication result are filled with the aforementioned application result status value R and the third certificate content. Otherwise, the second authentication result field of the certificate authentication result is filled with the aforementioned application result status value R and the first certificate content.

[0046] (5) Sending the application result: After AS103 forms the application result, it forms a WAPI certificate authentication response message according to the WAPI standard protocol and sends it to AP102. The certificate authentication result field in the message is formed in the above (4).

[0047] After receiving the WAPI Certificate Authentication Response message from AS103, AP102 analyzes the "Certificate Authentication Result" in it. Since the second certificate authentication result in the "Certificate Authentication Result" is not 0, from the perspective of the standard WAPI authentication protocol, the WAPI certificate authentication result is unsuccessful. In this case, AP102 will also send a standard Access Authentication Response message to STA101 and then disconnect the wireless association with STA101. The "Composite Authentication Result" field in the Access Authentication Response message includes the "Certificate Authentication Result" obtained from the WAPI Certificate Authentication Response message and the digital signature of AS103 on the "Certificate Authentication Result".

[0048] STA101 receives the access authentication response message from AP102. Since STA101 knows it is in the process of applying for a WAPI certificate, it parses the message to obtain the "composite authentication result," parses the "composite authentication result" to obtain the "certificate authentication result," and further parses the "certificate authentication result" to obtain the first certificate authentication result and certificate (which is the content of AP102's certificate), the second certificate authentication result and certificate, and then enters the certificate application result processing flow, which includes:

[0049] (1) Check the first certificate authentication result: If the result value is not 0, the certificate authentication of AP102 fails, indicating that AP102 is not trustworthy. STA102 cannot accept the access authentication response message sent by AP102, and this WAPI certificate application fails.

[0050] (2) Check the second certificate authentication result: If the result value is not 100, it indicates that the WAPI certificate application is unsuccessful, and its value indicates the reason for the failure; if the second certificate authentication result is equal to 100, it indicates that the WAPI certificate application is successful.

[0051] (3) Verify the digital signature of the "certificate authentication result": If the WAPI certificate application is successful, STA101 uses the second certificate in the "certificate authentication result" as the third WAPI certificate generated by AS103, extracts the second certificate from the second extended attribute of the third WAPI certificate, extracts the AS's public key certificate from the third extended attribute of the third WAPI certificate, and uses the AS's public key certificate to verify the digital signature of the "composite authentication result". If the signature fails, it indicates that the application result obtained by this WAPI certificate application is unreliable and the WAPI certificate application fails. On the contrary, if the signature passes, it indicates that the application result obtained by this WAPI certificate application is credible, and STA102 accepts the second certificate as the WAPI terminal digital certificate obtained by the application and accepts the AS certificate as the AS's public key certificate.

[0052] The above description is only a preferred specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any technician familiar with the technical field, within the technical scope disclosed by the present invention, who makes equivalent replacements or changes based on the technical solution and inventive concept of the present invention, should be covered by the scope of protection of the present invention.

Claims

1. A method for applying for a WAPI certificate, characterized in that: The method involves a wireless terminal STA and a WAPI certificate authenticator AS. The STA generates a first WAPI certificate by self-signing, and includes a first extended attribute in the first WAPI certificate to represent a WAPI certificate application intention. The AS determines the STA's WAPI certificate application intention based on the first extended attribute in the first WAPI certificate, and generates a second WAPI certificate issued to the STA based on information in the first WAPI certificate. The third WAPI certificate is formed by modifying the first WAPI certificate, wherein the modification includes adding a second extended attribute to carry the second WAPI certificate, adding a third extended attribute to carry the AS public key certificate, and re-signing. The STA and the AS interact based on a standard WAPI authentication protocol through a WAPI wireless network to realize the transfer of the first WAPI certificate and the third WAPI certificate, thereby realizing online application of the WAPI certificate by the wireless terminal. S1: To apply for a WAPI certificate, the wireless terminal STA associates with the wireless access point (AP) in the WAPI wireless network it intends to access. After receiving the WAPI authentication activation message from the AP, the STA sends a standard WAPI access authentication message to the AP. The terminal certificate in the WAPI access authentication message is the first WAPI certificate generated by the STA through self-signed signature. S2: After the WAPI certificate identifier AS receives the standard certificate authentication request message sent by the AP, the certificate authentication request message is sent by the AP to the AS after the AP receives the standard WAPI access request message sent by the STA, and obtains the terminal certificate, i.e., the first WAPI certificate, from the message. The AS determines whether the certificate authentication request message is a WIPI certificate application behavior of the STA by checking the first extension item of the first WAPI certificate. If so, the AS performs an applicant authorization check based on the applicant authentication information included in the first extension item of the first WAPI certificate, forms a certificate authentication result, and sends an access authentication response message to the AP. If the authorization check passes, the AS generates a second WAPI certificate issued to the STA based on the first WAPI certificate, and then modifies the first WAPI certificate to form a third WAPI certificate. The third WAPI certificate is included as the terminal certificate in the terminal certificate field of the certificate authentication result of the access authentication response message, and a specific certificate authentication result value is used to indicate the certificate application result status; The modifying of the first WAPI certificate includes adding a second extension item to identify and include the second WAPI certificate, and adding a third extension item to identify the AS public key certificate; S3: After receiving the standard access authentication response message from the AP, the STA obtains the terminal certificate authentication result value from the message to determine the certificate application result status. If the result status is successful, the STA obtains the terminal certificate (i.e., the third WAPI certificate) from the certificate authentication result. The STA then obtains the second WAPI certificate (i.e., the WAPI certificate applied for by the STA) from the second extension of the third WAPI certificate, and obtains the AS public key certificate from the third extension of the third WAPI certificate.

Images