Wireless access detection method, device, electronic device and storage medium

Abstract

The present invention relates to the field of network security technology, and in particular to a method, device, electronic device and storage medium for detecting wireless access. The method is applied to a foreground wireless access point, and the foreground wireless access point is set corresponding to a target wireless access point. The method comprises: receiving an access request sent by a sender; parsing the access request to determine a parsing result, and the parsing result comprises a current access step; matching the current access step with an access process template to determine a matching result, and the access process template is determined based on an authentication method of the foreground wireless access point, and the access process template comprises an access step; when the matching result is that the access is completed, forwarding the received data of the sender to the target wireless access point for processing. The current access step is matched using the access process template to segment the access process, and the establishment of a connection process template eliminates the differences between different authentication methods and improves the detection efficiency.

Description

Technical Field

[0001] The present invention relates to the technical field of network security, and in particular to a detection method, device, electronic equipment and storage medium for wireless access. Background Art

[0002] In recent years, wireless LAN has been used more and more widely. It has the characteristics of high access rate and flexible networking, and has great advantages in transmitting mobile data. However, in this rapid development process, the security of wireless LAN has become more and more important. In theory, any computer within the range of radio waves can monitor and access the wireless network. Therefore, for enterprise users, if the security measures of their wireless LAN are not strict enough, it is entirely possible to be eavesdropped, hijacked, or even obtain internal information. In order to prevent malicious access to the wireless LAN, its security is particularly important.

[0003] The existing wireless access detection method generally adds additional information to the data frame sent by the terminal connected to the wireless network, and performs access detection through the additional information. However, this method requires modifying the original data frame and adding additional information, which increases the transmission load of the network. This makes it difficult to detect wireless access in a timely manner when the network is congested. Summary of the invention

[0004] In view of this, embodiments of the present invention provide a method, device, electronic device and storage medium for detecting wireless access to solve the problem of low efficiency of wireless access detection.

[0005] According to a first aspect, an embodiment of the present invention provides a wireless access detection method, which is applied to a foreground wireless access point, where the foreground wireless access point is set corresponding to a target wireless access point, and the method includes:

[0006] receiving an access request sent by a sending end;

[0007] Parsing the access request to determine a parsing result, wherein the parsing result includes a current access step;

[0008] Matching the current access step with an access process template to determine a matching result, wherein the access process template is determined based on the authentication method of the foreground wireless access point, and the access process template includes an access step;

[0009] When the matching result is access completion, the data received from the sending end is forwarded to the target wireless access point for processing.

[0010] The wireless access detection method provided by the embodiment of the present invention performs malicious access detection by setting a foreground wireless access point corresponding to the target wireless access point. Only after the foreground wireless access point passes the detection, the data is forwarded to the target wireless access point for processing, thereby ensuring the security of the target wireless access point. At the same time, in the foreground wireless access point detection process, the access process template is used to match the current access step to segment the access process, and the establishment of the connection process template eliminates the differences between different authentication methods, improves the compatibility of the detection method, and the information used in the access detection is obtained from the access request, without adding additional information, and without changing the original access request, reducing the amount of data processing and improving the detection efficiency.

[0011] In some implementations, the parsing result includes a sender address, and matching the current access step with an access process template to determine a matching result includes:

[0012] Acquire access status data corresponding to the sender address, wherein the access status data includes access steps completed by the sender;

[0013] Matching the completed access step with the access process template to determine the next access step of the last completed access step;

[0014] The current access step is matched with the determined next access step to determine the matching result.

[0015] The wireless access detection method provided by the present invention utilizes access status data to store the access steps of each sending end address, so as to facilitate the rapid determination of the last completed access step during subsequent matching, thereby improving detection efficiency.

[0016] In some implementations, matching the current access step with the determined next access step to determine the matching result includes:

[0017] When the current access step matches the determined next access step, an access response is sent to the sending end and the access status data is updated.

[0018] The wireless access detection method provided by the embodiment of the present invention sends an access response to the sending end when a match is detected, so as to remind the sending end to perform subsequent access steps.

[0019] In some implementations, matching the current access step with the determined next access step to determine the matching result includes:

[0020] When the current access step does not match the determined next access step, the sender address is added to a blacklist and the access request is ignored.

[0021] The wireless access detection method provided by the embodiment of the present invention adds the sender address to the blacklist when a mismatch is detected. When the current wireless access point processes high-concurrency access requests, the sender in the blacklist is ignored, thereby improving the detection efficiency under high-concurrency access requests.

[0022] In some implementations, the parsing result further includes a receiving end address, and before the step of matching the completed access step with the access process template to determine the next access step of the last completed access step includes:

[0023] comparing the receiving end address with the receiving end address in the access status data;

[0024] When the receiving end address is consistent with the receiving end address in the access status data, the step of matching the completed access step with the access process template to determine the next access step of the last completed access step is performed.

[0025] The wireless access detection method provided by the embodiment of the present invention first uses the receiving end address for matching before matching the access step. Only when the receiving end address is consistent can the access process template be matched, which reduces the amount of matching data and improves detection efficiency.

[0026] In some implementations, the acquiring access status data corresponding to the sender address includes:

[0027] Using the sender address to query whether there is corresponding access status data;

[0028] When there is no corresponding access status data, establishing access status data corresponding to the sender address, and sending a response frame to the sender to obtain a next access step;

[0029] When corresponding access status data exists, the access status data corresponding to the sender address is extracted.

[0030] In some implementations, the access process template is determined in a manner including:

[0031] Obtaining the authentication method of the front-end wireless access point;

[0032] Based on the process of the authentication method, the access process template is established in a key-value pair manner.

[0033] The wireless access detection method provided by the embodiment of the present invention uses a key-value pair to establish an access process template, which has a fast search speed and improves detection efficiency. At the same time, the access process template is established using the authentication method, so that the access process template is consistent with the authentication method, and the detection method under different authentication methods can be unified; access detection is realized by multiplexing data in the access request, and the load of the communication link can not be increased additionally.

[0034] According to a second aspect, an embodiment of the present invention provides a wireless access detection device, which is applied to a foreground wireless access point, and the foreground wireless access point is set corresponding to a target wireless access point. The device includes:

[0035] A receiving module, used for receiving an access request sent by a sending end;

[0036] A parsing module, configured to parse the access request to determine a parsing result, wherein the parsing result includes a current access step;

[0037] A matching module, configured to match the current access step with an access process template to determine a matching result, wherein the access process template is determined based on an authentication method of the foreground wireless access point, and the access process template includes an access step;

[0038] The forwarding module is used to forward the data received from the sending end to the target wireless access point for processing when the matching result is access completion.

[0039] According to a third aspect, an embodiment of the present invention provides an electronic device, comprising: a memory and a processor, the memory and the processor being communicatively connected to each other, the memory storing computer instructions, and the processor executing the wireless access detection method described in the first aspect or any one of the embodiments of the first aspect by executing the computer instructions.

[0040] According to a fourth aspect, an embodiment of the present invention provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable the computer to execute the wireless access detection method described in the first aspect or any one implementation of the first aspect.

[0041] It should be noted that, for the corresponding beneficial effects of the wireless access detection device, electronic device, and computer-readable storage medium provided by the embodiments of the present invention, please refer to the description of the corresponding beneficial effects of the wireless access detection method above, which will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] In order to more clearly illustrate the specific implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0043] Figure 1 is a scene diagram of wireless access detection according to an embodiment of the present invention;

[0044] Figure 2 is a flow chart of a wireless access detection method according to an embodiment of the present invention;

[0045] Figure 3 is a flow chart of a wireless access detection method according to an embodiment of the present invention;

[0046] Figure 4 is a structural block diagram of a wireless access detection device according to an embodiment of the present invention;

[0047] Figure 5 It is a schematic diagram of the hardware structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0048] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0049] The threats currently faced by wireless LANs mainly include seven categories: passive eavesdropping and network traffic analysis, active eavesdropping and message injection, message deletion and interception, fake and malicious APs, session hijacking, man-in-the-middle attacks, and denial of service (DoS) attacks. Implementing the CCMP encryption mechanism of AES specified in 802.11 in the network can solve passive eavesdropping and network traffic analysis, active eavesdropping and message injection, message deletion and interception; the RSN solution proposed in 802.11 can eliminate fake and malicious APs, session hijacking, and man-in-the-middle attacks. As for DoS attacks, the current security protocols cannot provide a good solution, and due to some characteristics of wireless LANs, it will suffer from DoS attacks in conventional wired networks as well as some DoS attacks unique to wireless LANs.

[0050] The most common DOS attack is the association flood attack. The most notable feature of this type of attack is that it performs high-concurrency operations during the access phase of the wireless LAN, causing the wireless LAN access point (AP) to exceed the workload, ultimately leading to a denial of service. The association flood attack, whose full name is the association flood (flooding) attack, is usually referred to as an Asso attack. It is a form of wireless network denial of service attack. It attempts to fill the AP's client association table with a large number of imitation and forged wireless client associations, thereby flooding the AP. At the 802.11 layer, shared decryption authentication is flawed and difficult to use. The only other alternative is open authentication (null authentication), which relies on higher-level authentication, such as 802.1x or VPN. Open authentication allows any client to pass the authentication and then associate. Attackers who exploit this vulnerability can imitate many clients by creating multiple connections to connected or associated clients, thereby flooding the client association table of the target AP. After the client association table overflows, legitimate clients will no longer be able to associate, and the denial of service attack is completed.

[0051] At present, there are some methods for security detection in the access phase of wireless local area networks. For example, when a terminal (STA) connected to a wireless access point sends an authentication request to the AP, it will obtain the parameters for constructing a puzzle. After successful authentication, in the association phase, the STA needs to carry the puzzle solution. The AP verifies the puzzle solution carried in the request and decides whether to access the STA, thereby checking the legitimacy of the STA's access and avoiding malicious access by the STA. Alternatively, by adding tags and key management centers (KDC) to the connection model to implement two-way verification of information between the STA and the AP, the behavior of the STA during the access process can be constrained to avoid malicious attacks on the AP.

[0052] However, the above methods all require adding additional information to the STA's data frame and require the STA to perform calculations, which increases the STA's calculation load and the network's transmission load, which has certain disadvantages in the case of network congestion.

[0053] Based on this, an embodiment of the present invention provides a wireless access detection method, which analyzes the access request through a foreground wireless access point, and only after the foreground wireless access point confirms that a certain sender has completed access, will the data of the sender be forwarded to the target wireless access point. The foreground wireless access point and the target wireless access point are set correspondingly.

[0054] For example, Figure 1An optional application scenario of wireless access detection is shown. The target AP is a real wireless access point, and the foreground AP is set corresponding to the target AP. In a wireless network, all access requests of STA are analyzed and processed by the foreground AP. After the foreground AP passes the STA detection, the foreground AP will forward the data of the STA to the target AP. Among them, the foreground AP analyzes the access request by using the access process template corresponding to the access and authentication method. Only when the access request matches the access process template, it will be determined that the access detection of the sender that issued the access request has passed. The access process template is used to represent several steps of access authentication. For example, the authentication steps corresponding to authentication method A are abcd in sequence. Then, after receiving the access request, the current access step in the access request is matched with the access process template to determine whether it can be matched, so as to determine whether the STA sending the access request is a legitimate STA or a malicious STA.

[0055] The specific processing process of the wireless access detection method will be described in detail below.

[0056] According to an embodiment of the present invention, an embodiment of a method for detecting wireless access is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0057] In this embodiment, a wireless access detection method is provided, which is used in the foreground AP mentioned above. Figure 2 is a flow chart of a method for detecting wireless access according to an embodiment of the present invention. Figure 2 As shown, the process includes the following steps:

[0058] S11, receiving an access request sent by a sending end.

[0059] When the sender (STA) accesses the wireless access point (target AP), it needs to send an access request to the foreground AP first. Since the foreground AP corresponds to the target AP, the foreground AP can receive the access request sent by the sender. For different access authentication methods, if a complete wireless access needs to be completed, multiple interactions are required. During each interaction, the sender sends a corresponding data frame to the foreground AP to indicate which access step is currently being performed.

[0060] S12, analyzing the access request to determine the analysis result.

[0061] The analysis result includes the current access step.

[0062] The foreground AP parses the received access request, for example, parses the corresponding fields of the access request to determine the current access step.

[0063] S13, matching the current access step with the access process template to determine a matching result.

[0064] The access process template is determined based on the authentication method of the foreground wireless access point, and the access process template includes access steps.

[0065] As mentioned above, the access process template corresponds to the authentication method of the foreground AP, which indicates the steps required for wireless access. That is, the access process is segmented to obtain the corresponding access steps, and the access steps are stored according to the logic between them to obtain the access process template.

[0066] When the foreground AP obtains the current access step, it matches the current access step with the access process template to determine whether the current access step exists in the access process template, or whether the current access step should be executed according to the order between the access steps, etc. If the current access step cannot be matched with the access process template, it can be confirmed that the sender is a malicious STA; if the current access step can be matched with the access process template, it is confirmed whether the current access step is the last step of the access process. If it is the last step, it means that the access process is completed; if it is not the last step, an access response is sent to the sender to obtain the next access step.

[0067] This step will be described in detail below.

[0068] S14, when the matching result is access completion, forwarding the data received from the sender to the target wireless access point for processing.

[0069] As mentioned above, if the current access step is the next step of the access process and can match the access process template, it means that the access is completed. The foreground AP forwards the data received from the sender to the target AP for processing. Specifically, when the STA and the AP interact with each other, the foreground AP will check the corresponding access status according to the MAC address of the STA. Only when the STA is in the access completion state will the data packet of the STA be forwarded to the target AP by the foreground AP. If the access state of the STA does not belong to the connection completion, or the data structure does not exist, the data will be ignored.

[0070] The wireless access detection method provided in this embodiment performs malicious access detection by setting a foreground wireless access point corresponding to the target wireless access point. Only after the foreground wireless access point passes the detection, the data is forwarded to the target wireless access point for processing, thereby ensuring the security of the target wireless access point. At the same time, in the foreground wireless access point detection process, the access process template is used to match the current access step to segment the access process, and the establishment of the connection process template eliminates the differences between different authentication methods, improves the compatibility of the detection method, and the information used in the access detection is obtained from the access request, without adding additional information, and without changing the original access request, reducing the amount of data processing and improving the detection efficiency.

[0071] In this embodiment, a wireless access detection method is provided, which is used in the foreground AP mentioned above. Figure 3 is a flow chart of a method for detecting wireless access according to an embodiment of the present invention. Figure 3 As shown, the process includes the following steps:

[0072] S21, receiving an access request sent by a sending end.

[0073] For details, please see Figure 2 S11 of the illustrated embodiment will not be described in detail here.

[0074] S22, analyzing the access request to determine the analysis result.

[0075] The analysis result includes the current access step and the sender address.

[0076] For details, please see Figure 2 S12 of the illustrated embodiment will not be described in detail here.

[0077] S23, matching the current access step with the access process template to determine a matching result.

[0078] The access process template is determined based on the authentication method of the foreground wireless access point, and the access process template includes access steps.

[0079] Specifically, the above S23 includes:

[0080] S231, obtaining access status data corresponding to the sender address.

[0081] The access status data includes access steps completed by the sending end.

[0082] A plurality of access status data are stored in the foreground AP, and the access status data correspond to the sender address. Therefore, the foreground AP can query the corresponding access status data from the plurality of access status data using the sender address.

[0083] The access status data is used to indicate the access steps that the sender has completed. For example, the data structure of the STA access status data stored in the foreground AP is:

[0084] {MAC address of STA: [MAC address of AP, completed steps]}

[0085] The data structure is a dictionary data type. The key of the dictionary is the MAC address of the STA, and the value is a list. The first element of the list is the MAC address of the AP, and the second element of the list is a linked list, which records the steps that the STA has completed during the access process. The MAC address of the STA comes from the access request. If the access request is in the form of an 802.11 frame, then Address2 in the 802.11 frame represents the MAC address of the STA, and Address1 in the 802.11 frame represents the MAC address of the AP.

[0086] In some implementations, the above S231 includes:

[0087] (1) Use the sender address to query whether there is corresponding access status data.

[0088] (2) When there is no corresponding access status data, establish the access status data corresponding to the sender address, and send a response frame to the sender to obtain the next access step.

[0089] (3) When corresponding access status data exists, extract the access status data corresponding to the sender address.

[0090] After receiving the access request, the foreground AP uses the sender address in the parsed result of the access request to query the access status data to determine whether the access request is a new access request. If the access request is a new access request, the foreground AP needs to establish the access status data structure of the STA in the memory, and then send a response frame to the STA; if it is an access request in the access process, the foreground AP needs to obtain the access status data of the STA based on the MAC address of the STA.

[0091] S232, matching the completed access steps with the access process template to determine the next access step of the last completed access step.

[0092] As described above, the access process template represents the steps of the access process, and the access status data represents the completed access steps. Based on this, the foreground AP matches the best completed access step in the access status data with the access process template to determine the next access step of the last completed access step.

[0093] S233, matching the current access step with the determined next access step to determine a matching result.

[0094] The next access step of the last completed access step obtained in S232 is determined from the access process template. The foreground AP matches the current access step with the determined next access step to determine whether the two can match and obtain a corresponding matching result.

[0095] When the current access step matches the determined next access step, an access response is sent to the sender and the access status data is updated. When the current access step does not match the determined next access step, the sender address is added to a blacklist and the access request is ignored.

[0096] Specifically, according to the access process template, it is determined whether the current access step is the next step of the last step of the completed access step. If it meets the template, it will be responded to, otherwise it will be discarded. For STAs that do not meet the access process template, the foreground AP will record the MAC address of the STA and establish a blacklist mechanism. When the foreground AP processes high-concurrency access requests, it will ignore the STAs in the blacklist.

[0097] When a match is detected, an access response is sent to the sender to remind the sender to perform subsequent access steps. When a mismatch is detected, the sender address is added to the blacklist. When the current wireless access point processes high-concurrency access requests, it will ignore the sender in the blacklist, improving the detection efficiency under high-concurrency access requests.

[0098] In some implementations, the parsing result also includes a receiving end address. Based on this, the above step before S232 also includes:

[0099] (1) Compare the receiving end address with the receiving end address in the access status data.

[0100] (2) When the receiving end address is consistent with the receiving end address in the access status data, the step of matching the completed access step with the access process template to determine the next access step of the last completed access step is performed.

[0101] For requests in the access process, the foreground AP needs to obtain the access status data of the STA based on the MAC address of the STA. First, determine whether the receiving end address in the access request is equal to the first value in the list of the access status data. If they are not equal, they are directly discarded. If they are equal, the completed access step is matched with the access process template to determine the next access step of the last completed access step.

[0102] Before matching the access step, the receiving end address is used for matching. Only when the receiving end address is consistent can the access process template be matched, which reduces the amount of matching data and improves detection efficiency.

[0103] S24, when the matching result is access completion, forwarding the data received from the sender to the target wireless access point for processing.

[0104] For details, please see Figure 2 S14 of the illustrated embodiment will not be described in detail here.

[0105] The wireless access detection method provided in this embodiment uses access status data to store the access steps of each sending end address, so that the last completed access step can be quickly determined during subsequent matching, thereby improving detection efficiency.

[0106] In some implementations, the access process template is determined by:

[0107] (1) Obtain the authentication method of the front-end wireless access point.

[0108] (2) Based on the authentication process, an access process template is established using a key-value pair.

[0109] Before wireless access detection, you need to build a foreground AP for the target AP to receive access requests and hide the target AP. For an existing target AP, the foreground AP needs to have the same name, authentication method, and password as the target AP, so that the STA originally connected to this AP can switch seamlessly. For a newly created target AP, the foreground AP can choose a new name, authentication method, and password. After the STA passes the foreground AP verification, the foreground AP can completely forward the request to the target AP.

[0110] Establish an access process template according to the authentication method of the front-end AP, including but not limited to authentication, association, four-way handshake and other processes. The format of the template is typical, as follows:

[0111] {Completed Step: Next Step}

[0112] Among them, the key of the dictionary is the completed step. When the STA accesses, the foreground AP can quickly determine whether the current step of the STA is the next step of the previous step when accessing, and whether the current STA has completed the access process when receiving a cancellation association or cancellation authentication request.

[0113] The access process template is established by using key-value pairs, which has fast search speed and improves detection efficiency. At the same time, the access process template is established by using the authentication method, so that the access process template is consistent with the authentication method, which can achieve the unification of detection methods under different authentication methods; access detection is achieved by multiplexing the data in the access request, which can also avoid adding extra load to the communication link.

[0114] As a specific application example of this embodiment, the wireless access detection method includes:

[0115] Step 1: Build a foreground AP for the target AP to receive access requests and hide the target AP. Establish a mode such as Figure 1 As shown. Figure 1 In the example, the specific roles include target AP, foreground AP, legitimate STA, and malicious STA. The target AP only interacts with the foreground AP and is invisible in the public network. External STAs can detect the foreground AP, and the connection template and data structure processing of the wireless LAN are all performed in the foreground AP.

[0116] Step 2: Establish an access process template according to the authentication method of the foreground AP, including but not limited to authentication, association, four-way handshake and other processes. In this embodiment, the target AP adopts the WEP authentication method, and the access process template of the foreground AP in this embodiment is obtained as follows:

[0117] {Empty: Not authenticated, not associated}

[0118] {Unauthenticated and not associated: Authentication not associated}

[0119] {Authentication not associated: Authentication associated}

[0120] {Authenticated and associated: data exchange}

[0121] Step 3: According to the established access process template, the data structure of the STA access status data stored in the foreground AP is designed as follows:

[0122] {MAC address of STA: [MAC address of AP, completed steps]}

[0123] This structure is a dictionary data type. The key of the dictionary is the MAC address of the STA, and the value is a list. The first element of the list is the MAC address of the AP. The second element of the list is a linked list, which records the steps that the STA has completed during the access process. The MAC address of the STA comes from Address2 in the 802.11 frame, and the MAC address of the AP comes from Address1 in the 802.11 frame.

[0124] Step 4: The foreground AP processes the received STA access request frame. In this embodiment, it is assumed that the AP's MAC address is: 00-01-6C-06-A6-29, and the STA's MAC address is: 00-01-6C-06-A6-28. When the STA is a new access request, the corresponding data structure cannot be found in the memory according to the STA's MAC address. At this time, the previous state is defined as "empty" and the corresponding data structure is established in the foreground AP memory:

[0125] {00-01-6C-06-A6-28:[00-01-6C-06-A6-29,empty]}

[0126] At this time, the template is matched. Since the AP receives an authentication request frame, the current state is "unauthenticated and unassociated". According to the MAC address of the STA, it can be found that the previous state is "empty". According to the template matching, the next state is "unauthenticated and unassociated", so it is a legal state. If the authentication is successful, an authentication response is sent to the STA, and the data structure is modified as follows:

[0127] {00-01-6C-06-A6-28:[00-01-6C-06-A6-29, empty->unauthenticated and unassociated]}

[0128] If the verification fails, a corresponding authentication failure response is sent, but the access status data is not modified.

[0129] Malicious requests can be well matched according to the template rules. For STAs that do not conform to the access process template, the foreground AP will record the MAC address and establish a blacklist mechanism. When the foreground AP processes high-concurrency access requests, it will ignore the STAs in the blacklist.

[0130] For STAs that complete the access request, the front desk will forward their data to the target AP to implement data interaction.

[0131] Step 5: When the STA and AP are interacting with each other, the foreground AP will check the corresponding status according to the MAC of the STA. Only when the STA is in the access completion state will the STA's data packet be forwarded to the target AP by the foreground AP. In this embodiment, only the structure of the access status data is in the form of:

[0132] {00-01-6C-06-A6-28:[00-01-6C-06-A6-29, empty->unauthenticated and unassociated->authenticated and unassociated->authenticated and associated->data exchange]}, the STA and the target AP are allowed to exchange data. If the access status of the STA does not belong to connection completion, or there is no access status data corresponding to the STA, then the data will be ignored.

[0133] This method cuts the access process of the wireless local area network and establishes a connection process template to eliminate the differences between different authentication methods and improve the compatibility of the detection method. Adding a foreground AP to the target AP further improves the security of the wireless local area network and plays a certain role in protecting the real network. At the same time, the data in the 802.11 frame is reused to reduce the network load, making the method more available and avoiding increasing the communication delay when the network load is high. This method is suitable for the detection of malicious access in wireless local area networks. The detection method not only realizes the unification of detection methods under different authentication methods, but also does not increase the load of the communication link.

[0134] In this embodiment, a wireless access detection device is also provided, which is used to implement the above embodiments and preferred implementation modes, and the descriptions that have been made are not repeated. As used below, the term "module" can implement a combination of software and / or hardware of a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceivable.

[0135] This embodiment provides a wireless access detection device, which is applied to a foreground wireless access point. The foreground wireless access point is set corresponding to a target wireless access point, such as Figure 4 As shown, the device comprises:

[0136] The receiving module 31 is used to receive the access request sent by the sending end;

[0137] A parsing module 32, configured to parse the access request to determine a parsing result, wherein the parsing result includes a current access step;

[0138] A matching module 33, configured to match the current access step with an access process template to determine a matching result, wherein the access process template is determined based on an authentication method of the foreground wireless access point, and the access process template includes an access step;

[0139] The forwarding module 34 is configured to forward the data received from the sending end to the target wireless access point for processing when the matching result is access completion.

[0140] In some implementations, the parsing result includes a sender address, and the matching module 33 includes:

[0141] An acquiring unit, configured to acquire access status data corresponding to the sender address, wherein the access status data includes access steps completed by the sender;

[0142] A first matching unit, configured to match the completed access step with the access process template to determine a next access step of the last completed access step;

[0143] The second matching unit is used to match the current access step with the determined next access step to determine the matching result.

[0144] In some embodiments, the first matching unit includes:

[0145] The first matching subunit is used to send an access response to the sending end and update the access status data when the current access step matches the determined next access step.

[0146] In some embodiments, the first matching unit includes:

[0147] The second matching subunit is used to add the sender address to a blacklist and ignore the access request when the current access step does not match the determined next access step.

[0148] In some implementations, the parsing result also includes a receiving end address, and the matching module 33 includes:

[0149] a comparing unit, configured to compare the receiving end address with the receiving end address in the access status data;

[0150] An execution unit is used to match the completed access step with the access process template to determine the next access step of the last completed access step when the receiving end address is consistent with the receiving end address in the access status data.

[0151] In some embodiments, the acquisition unit includes:

[0152] A query subunit, used to query whether corresponding access status data exists using the sender address;

[0153] An establishing subunit, configured to establish access status data corresponding to the sender address when no corresponding access status data exists, and send a response frame to the sender to obtain a next access step;

[0154] The extraction subunit is used to extract the access status data corresponding to the sending end address when corresponding access status data exists.

[0155] In some implementations, the access process template is determined in a manner including:

[0156] Obtaining the authentication method of the front-end wireless access point;

[0157] Based on the process of the authentication method, the access process template is established in a key-value pair manner.

[0158] The wireless access detection device in this embodiment is presented in the form of a functional unit, where the unit refers to an ASIC circuit, a processor and a memory that executes one or more software or fixed programs, and / or other devices that can provide the above functions.

[0159] The further functional description of each of the above modules is the same as that of the above corresponding embodiments and will not be repeated here.

[0160] The embodiment of the present invention also provides an electronic device having the above Figure 4 The wireless access detection device is shown.

[0161] See also Figure 5 , Figure 5 is a schematic diagram of the structure of an electronic device provided by an optional embodiment of the present invention, such as Figure 5 As shown, the electronic device may include: at least one processor 41, such as a CPU (Central Processing Unit), at least one communication interface 43, a memory 44, and at least one communication bus 42. The communication bus 42 is used to realize the connection and communication between these components. The communication interface 43 may include a display screen (Display) and a keyboard (Keyboard), and the optional communication interface 43 may also include a standard wired interface and a wireless interface. The memory 44 may be a high-speed RAM memory (Random Access Memory) or a non-volatile memory (non-volatile memory), such as at least one disk storage. The memory 44 may optionally be at least one storage device located away from the aforementioned processor 41. The processor 41 may be combined with Figure 4 In the described device, the memory 44 stores an application program, and the processor 41 calls the program code stored in the memory 44 to execute any of the above method steps.

[0162] The communication bus 42 may be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus. The communication bus 42 may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 5 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0163] Among them, the memory 44 may include a volatile memory (English: volatile memory), such as a random access memory (English: random-access memory, abbreviated: RAM); the memory may also include a non-volatile memory (English: non-volatile memory), such as a flash memory (English: flash memory), a hard disk drive (English: hard disk drive, abbreviated: HDD) or a solid-state drive (English: solid-state drive, abbreviated: SSD); the memory 44 may also include a combination of the above types of memory.

[0164] The processor 41 may be a central processing unit (CPU), a network processor (NP), or a combination of a CPU and a NP.

[0165] The processor 41 may further include a hardware chip. The hardware chip may be an application-specific integrated circuit (ASIC), a programmable logic device (PLD), or a combination thereof. The PLD may be a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL), or any combination thereof.

[0166] Optionally, the memory 44 is also used to store program instructions. The processor 41 can call the program instructions to implement the wireless access detection method shown in any embodiment of the present application.

[0167] The embodiment of the present invention also provides a non-transitory computer storage medium, which stores computer executable instructions, and the computer executable instructions can execute the wireless access detection method in any of the above method embodiments. The storage medium can be a disk, an optical disk, a read-only memory (ROM), a random access memory (RAM), a flash memory, a hard disk (HDD) or a solid-state drive (SSD), etc.; the storage medium can also include a combination of the above types of memory.

[0168] Although the embodiments of the present invention have been described in conjunction with the accompanying drawings, those skilled in the art may make various modifications and variations without departing from the spirit and scope of the present invention, and such modifications and variations are all within the scope defined by the appended claims.

Claims

1. A method for detecting wireless access, It is characterized in that Applied to a foreground wireless access point, the foreground wireless access point is set corresponding to a target wireless access point, and the method includes: receiving an access request sent by a sending end; Parsing the access request to determine a parsing result, wherein the parsing result includes a current access step; Matching the current access step with an access process template to determine a matching result, wherein the access process template is determined based on the authentication method of the foreground wireless access point, and the access process template includes an access step; When the matching result is access completion, forwarding the data received from the sending end to the target wireless access point for processing; The parsing result includes a sender address, and the matching of the current access step with the access process template to determine the matching result includes: Acquire access status data corresponding to the sender address, wherein the access status data includes access steps completed by the sender; Matching the completed access step with the access process template to determine the next access step of the last completed access step; The current access step is matched with the determined next access step to determine the matching result.

2. The method according to claim 1, It is characterized in that The matching the current access step with the determined next access step to determine the matching result includes: When the current access step matches the determined next access step, an access response is sent to the sending end and the access status data is updated.

3. The method according to claim 1, It is characterized in that The matching the current access step with the determined next access step to determine the matching result includes: When the current access step does not match the determined next access step, the sender address is added to a blacklist and the access request is ignored.

4. The method according to claim 1, It is characterized in that The parsing result also includes a receiving end address. Before the step of matching the completed access step with the access process template to determine the next access step of the last completed access step, the step includes: comparing the receiving end address with the receiving end address in the access status data; When the receiving end address is consistent with the receiving end address in the access status data, the step of matching the completed access step with the access process template to determine the next access step of the last completed access step is performed.

5. The method according to claim 1, It is characterized in that The acquiring access status data corresponding to the sender address includes: Using the sender address to query whether there is corresponding access status data; When there is no corresponding access status data, establishing access status data corresponding to the sender address, and sending a response frame to the sender to obtain a next access step; When corresponding access status data exists, the access status data corresponding to the sender address is extracted.

6. The method according to claim 1, It is characterized in that The method of determining the access process template includes: Obtaining the authentication method of the front-end wireless access point; Based on the process of the authentication method, the access process template is established in a key-value pair manner.

7. A wireless access detection device, It is characterized in that Applied to a foreground wireless access point, the foreground wireless access point is set corresponding to a target wireless access point, and the device includes: A receiving module, used for receiving an access request sent by a sending end; A parsing module, configured to parse the access request to determine a parsing result, wherein the parsing result includes a current access step; A matching module, configured to match the current access step with an access process template to determine a matching result, wherein the access process template is determined based on an authentication method of the foreground wireless access point, and the access process template includes an access step; A forwarding module, configured to forward the data received from the sending end to the target wireless access point for processing when the matching result is access completion; Wherein, the parsing result includes a sender address, and the matching module includes: An acquiring unit, configured to acquire access status data corresponding to the sender address, wherein the access status data includes access steps completed by the sender; A first matching unit, configured to match the completed access step with the access process template to determine a next access step of the last completed access step; The second matching unit is used to match the current access step with the determined next access step to determine the matching result.

8. An electronic device, It is characterized in that include: A memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the wireless access detection method according to any one of claims 1 to 6 by executing the computer instructions.

9. A computer-readable storage medium, It is characterized in that The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a computer to execute the wireless access detection method according to any one of claims 1 to 6.

Images