Monitoring methods, devices, storage media, and electronic equipment used to access clients.

Abstract

This invention discloses a monitoring method, device, storage medium, and electronic device for access clients. The method includes: when a client accesses a wireless access point, obtaining the client's random number, the wireless access point's random number, and basic elements through the wireless access point; generating a pair of transmission keys based on the client's random number, basic elements, and the wireless access point's random number; decrypting wireless messages sent by the client to the wireless access point using the pair of transmission keys to obtain the client's account information; and determining whether the client is an allowed client based on the client's account information. This invention solves the technical problem of being unable to identify clients accessing a router.

Description

Technical Field

[0001] This invention relates to the field of wireless networks, and more specifically, to a method, apparatus, storage medium, and electronic device for monitoring access clients. Background Technology

[0002] In existing technologies, wireless access points such as routers are typically password-protected. After entering the password, clients can connect to the router and access the network. For example, when guests come to your home, they can connect to the router and access the network using the wireless password.

[0003] However, existing technologies cannot identify and screen clients connecting to the router. Summary of the Invention

[0004] This invention provides a method, apparatus, storage medium, and electronic device for monitoring access clients, in order to at least solve the technical problem of being unable to identify clients accessing the router.

[0005] According to one aspect of the present invention, a monitoring method for access clients is provided, wherein the working channel of a wireless network interface card (NIC) is the same as the working channel of a wireless access point, the NIC stores a service set identifier and a key of the wireless access point, and the method includes: when a client accesses the wireless access point, obtaining a client random number of the client, and obtaining a wireless access point random number and a basic element of the wireless access point through the wireless access point; generating a pairwise transmission key based on the client random number, the basic element, and the wireless access point random number; decrypting a wireless message sent by the client to the wireless access point using the pairwise transmission key to obtain the client's account information, and determining whether the client is an allowed client based on the client's account information.

[0006] According to another aspect of the present invention, a monitoring device for accessing a client is provided, wherein the working channel of the wireless network card itself is the same as the working channel of the wireless access point, the wireless network card stores the service set identifier and key of the wireless access point, and the device includes: an acquisition module, configured to acquire a client random number of the client and a wireless access point random number and basic elements of the wireless access point through the wireless access point when the client accesses the wireless access point; a generation module, configured to generate a pair of transmission keys based on the client random number, the basic elements and the wireless access point random number; and a decryption module, configured to decrypt the wireless message sent by the client to the wireless access point using the pair of transmission keys, acquire the client's account information, and determine whether the client is an allowed client based on the client's account information.

[0007] As an optional example, the above apparatus further includes: a receiving module, configured to set itself to a listening mode and receive a wireless access point flag of the wireless access point to be monitored; a sending module, configured to send an acquisition request to the wireless access point according to the wireless access point flag and acquire the channel flag of the working channel of the wireless access point; and a modifying module, configured to modify its own working channel according to the channel flag to be consistent with the channel flag.

[0008] As an optional example, the above apparatus further includes: a storage module for storing the key in a storage table according to the service set identifier, wherein the storage table includes a service set identifier column and a key column, and the service set identifier and the key correspond one-to-one.

[0009] As an optional example, the above generation module includes: a splicing unit, used to splice the above client random number, the above wireless access point random number and the above basic elements to form the above paired transmission key.

[0010] As an optional example, the above decryption module includes: a decryption unit, used to decrypt the wireless message using the above-mentioned paired transmission keys as decryption keys to obtain the plaintext content of the wireless message; and a determination unit, used to take the data of the mn-th bit in the above-mentioned plaintext content as the account information, wherein the mn-th bit is the location in the above-mentioned plaintext content where the account information is stored.

[0011] As an optional example, the above apparatus further includes: a processing module, configured to decrypt the wireless message sent by the client to the wireless access point using the paired transmission key to obtain the client's account information, and then compare the account information with a whitelist; if the whitelist does not contain the account information, the module notifies the wireless access point to discard the wireless message.

[0012] According to another aspect of the present invention, a storage medium is also provided, wherein a computer program is stored in the storage medium, and the computer program is executed by a processor to perform the above-described monitoring method for accessing the client.

[0013] According to another aspect of the present invention, an electronic device is also provided, including a memory and a processor, wherein the memory stores a computer program and the processor is configured to execute the above-described monitoring method for accessing a client through the computer program.

[0014] In this embodiment of the invention, when a client accesses the aforementioned wireless access point, the method involves obtaining the client's random number and the wireless access point's random number and basic elements through the wireless access point; generating a pair of transmission keys based on the client's random number, the basic elements, and the wireless access point's random number; decrypting the wireless packets sent by the client to the wireless access point using the pair of transmission keys to obtain the client's account information; and determining whether the client is an allowed client based on the client's account information. Because this method can obtain the client's random number when the client accesses the wireless access point, further generate a pair of transmission keys, and use the pair of transmission keys to decrypt the wireless packets to obtain the client's account information, it achieves the purpose of identifying clients accessing the router, thereby solving the technical problem of being unable to identify clients accessing the router. Attached Figure Description

[0015] The accompanying drawings, which are included to provide a further understanding of the invention and form part of this application, illustrate exemplary embodiments of the invention and, together with their description, serve to explain the invention and do not constitute an undue limitation thereof. In the drawings:

[0016] Figure 1 This is a flowchart of an optional monitoring method for access clients according to an embodiment of the present invention;

[0017] Figure 2 This is a schematic diagram of the STA and AP connection for an optional monitoring method for an access client according to an embodiment of the present invention;

[0018] Figure 3 This is a schematic diagram of the structure of an optional monitoring device for accessing a client according to an embodiment of the present invention;

[0019] Figure 4 This is a schematic diagram of an optional electronic device according to an embodiment of the present invention. Detailed Implementation

[0020] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0021] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0022] According to a first aspect of the present invention, a method for monitoring an access client is provided, wherein the working channel of a wireless network interface card (NIC) is the same as the working channel of a wireless access point, and the wireless NIC stores a service set identifier and a key of the wireless access point. Optionally, as shown in the example... Figure 1 As shown, the above method includes:

[0023] S102, when the client accesses the wireless access point, obtain the client's random number, as well as the wireless access point's random number and basic elements through the wireless access point.

[0024] S104, Generate a pair of transmission keys based on the client random number, basic elements and wireless access point random number;

[0025] S106, use the paired transmission key to decrypt the wireless message sent by the client to the wireless access point, obtain the client's account information, and determine whether the client is an allowed client based on the client's account information.

[0026] Optionally, the client monitoring method described above in this embodiment can be applied to wireless access points in homes, such as wireless routers, or in shops, or in other scenarios that include wireless access points. When a client accesses a wireless access point, the system can obtain the client's account information and check whether the client is an authorized access client, thereby completing the client access monitoring.

[0027] In this embodiment, the client can be a terminal, and the account information can be the terminal's unique identifier, thus enabling access monitoring of the terminal. The client can also be an application on the terminal, in which case the account information can be the user's account used to log in to the application, allowing access monitoring of specific applications.

[0028] The aforementioned wireless network card can set its own operating channel to be the same as the wireless access point's operating channel, allowing the wireless network card to receive wireless packets sent to the wireless access point without needing to connect directly to it. Although connection to the access point is not required, the wireless network card still needs to obtain the access point's service set identifier and key to control it. If a client connects to the access point, the wireless network card can obtain the access point's random number and, through the access point, the client's random number. It then generates a pair of transmission keys using the client's random number, the access point's random number, and basic elements. These keys are used to decrypt the wireless packets sent by the client to the access point to obtain the client's account information. Once the account information is obtained, client login monitoring can be performed based on this information.

[0029] In the above method, when a client accesses the wireless access point, the client's random number can be obtained, and a pair of transmission keys can be generated. The pair of transmission keys can then be used to decrypt the wireless packets to obtain the client's account information, thereby achieving the purpose of identifying clients accessing the router.

[0030] As an optional example, the above method also includes:

[0031] The wireless network card sets itself to listening mode and receives the wireless access point flag of the wireless access point it wants to listen to.

[0032] Based on the wireless access point identifier, the wireless network card sends an acquisition request to the wireless access point to obtain the channel identifier of the wireless access point's working channel.

[0033] The wireless network card modifies its own working channel according to the channel identifier, adjusting it to be consistent with the channel identifier.

[0034] Optionally, in this embodiment, the wireless network card sets itself to monitoring mode. Monitoring mode is used to monitor clients accessing the wireless access point. The wireless network card can first determine the wireless access point to monitor. Different wireless access points can be distinguished by their wireless access point identifiers. Based on the wireless access point identifier, the wireless network card sends an acquisition request to the wireless access point to obtain the channel identifier of the wireless access point's operating channel. Then, the wireless network card sets its own operating channel to match the channel identifier.

[0035] As an optional example, the above method also includes:

[0036] The wireless network card stores the key in a storage table according to the service set identifier. The storage table includes a service set identifier column and a key column, and the service set identifier and key are in one-to-one correspondence.

[0037] In this embodiment, the wireless network card can maintain a storage table. The storage table stores the correspondence between service set identifiers and keys. The two are in a one-to-one correspondence. A key can be uniquely mapped to a service set identifier. The wireless network card can determine the relationship between the service set identifier and the key by querying the storage table.

[0038] As an optional example, generating a pair of transmission keys based on a client random number, a basic element, and a wireless access point random number includes:

[0039] The client random number, the wireless access point random number, and the basic element are concatenated to form a pair of transmission keys.

[0040] Optionally, the order of concatenation in this embodiment can be limited, such as first generating a client random number, then a wireless access point random number, and finally the basic element; other orders are also possible, or the order is not limited. The concatenation yields a pair of transmission keys.

[0041] As an optional example, the wireless messages sent by the client to the wireless access point are decrypted using a pair of transmission keys to obtain the client's account information, including:

[0042] The wireless message is decrypted using a pair of transmission keys as the decryption key to obtain the plaintext content of the wireless message.

[0043] The mn-th bit of the plaintext content is used as the account information, where the mn-th bit is the location where the account information is stored in the plaintext content.

[0044] Optionally, in this embodiment, the account information is stored at a specific location within the wireless message. After decoding the wireless message to obtain the plaintext content, the content at the specific location within the plaintext content can be retrieved, thereby obtaining the account information.

[0045] As an alternative example, after decrypting the wireless messages sent by the client to the wireless access point using a pair of transmission keys to obtain the client's account information, the above method also includes:

[0046] Compare account information with the whitelist;

[0047] If the account information is not included in the whitelist, the wireless access point is notified to discard the wireless packet.

[0048] Optionally, in this embodiment, after obtaining account information, it can be compared with a whitelist, which records account information of accounts allowed to access the wireless network. By comparing the information, clients that are not allowed to log in can be denied access to the wireless access point.

[0049] As an optional example, the above method also includes:

[0050] The client generates a client random number based on the first password entered by the user and its own service set identifier, while the wireless access point generates a wireless access point random number based on the second password used to connect to the wireless access point and its own service set identifier.

[0051] In this embodiment, the wireless network card can operate in monitor mode and share the same channel with the wireless access point (AP). Monitor mode allows the wireless network card to receive packets with the destination Ethernet address (Media Access Control Address, MAC address) instead of its own. Monitor mode does not require access to the wireless AP. The AP's Service Set Identifier (SSID) and key are set in the wireless network card. The monitoring client (Station, STA) associates with the AP (WPA authentication process, obtaining the STA's MAC address and the pairing keys SNonce and ANonce, where SNonce is a random number generated by the client and ANonce is a random number generated by the wireless access point). Figure 2 The process of associating a STA with an AP involves the following steps: The STA calculates the SNonce, the AP calculates the ANonce, and the AP sends the ANonce to the STA. The STA uses the basic elements PMK, SNonce, and ANonce to generate a pairwise transient key (PTK). The STA then sends the SNonce and MIC to the AP; the MIC is a field used for message integrity checks. The AP uses PMK, SNonce, and ANonce to generate the PTK and a group temporary key (GTK): the AP's PMK is calculated from the AP's SSID and PSK. The PSK is the access password for the wireless access point. The AP returns the GTK and MIC to the STA, and the STA sends the MIC to the AP. After obtaining the PTK from the AP, the wireless network card performs inverse operations on the PTK to obtain the plaintext. Finally, the application layer message is parsed to obtain the client's account information. For example, the client account of the client accessing the network can be obtained and compared to see if the account is allowed to access the network (whether the terminal is allowed to access the network). Alternatively, the QQ account can be extracted from the QQ login message according to the corresponding format to see if the QQ account is allowed to log in (whether the application is allowed to access the network, which can be used to restrict specific applications in office areas).

[0052] It should be noted that, for the sake of simplicity, the foregoing method embodiments are all described as a series of actions. However, those skilled in the art should understand that the present invention is not limited to the described order of actions, because according to the present invention, some steps can be performed in other orders or simultaneously. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are preferred embodiments, and the actions and modules involved are not necessarily essential to the present invention.

[0053] According to another aspect of the embodiments of this application, a monitoring device for access clients is also provided, wherein the working channel of the wireless network card itself is the same as the working channel of the wireless access point, and the wireless network card stores the service set identifier and key of the wireless access point, such as... Figure 3 As shown, the above-mentioned device includes:

[0054] The acquisition module 302 is used to acquire the client's random number and the wireless access point random number and basic elements through the wireless access point when the client accesses the wireless access point.

[0055] The generation module 304 is used to generate a pair of transmission keys based on the client random number, basic elements and wireless access point random number;

[0056] The decryption module 306 is used to decrypt the wireless messages sent by the client to the wireless access point using a pair of transmission keys, obtain the client's account information, and determine whether the client is an authorized client based on the client's account information.

[0057] Optionally, the client access monitoring device described above in this embodiment can be applied to wireless access points in homes, such as wireless routers, or in shops, or in other scenarios that include wireless access points. When a client accesses the wireless access point, the device can obtain the client's account information and check whether the client is an authorized access client, thereby completing the client access monitoring.

[0058] In this embodiment, the client can be a terminal, and the account information can be the terminal's unique identifier, thus enabling access monitoring of the terminal. The client can also be an application on the terminal, in which case the account information can be the user's account used to log in to the application, allowing access monitoring of specific applications.

[0059] The aforementioned wireless network card can set its own operating channel to be the same as the wireless access point's operating channel, allowing the wireless network card to receive wireless packets sent to the wireless access point without needing to connect directly to it. Although connection to the access point is not required, the wireless network card still needs to obtain the access point's service set identifier and key to control it. If a client connects to the access point, the wireless network card can obtain the access point's random number and, through the access point, obtain the client's random number and basic elements. It then generates a pair of transmission keys using these keys and uses them to decrypt wireless packets sent by the client to the access point to obtain the client's account information. Once the account information is obtained, client login monitoring can be performed based on this information.

[0060] In the above method, when a client accesses the wireless access point, the client's random number and basic elements can be obtained, and then a pair of transmission keys can be generated. The pair of transmission keys can be used to decrypt the wireless packets to obtain the client's account information, thereby achieving the purpose of identifying the client accessing the router.

[0061] As an optional example, the above-described apparatus further includes:

[0062] The receiving module is used to set itself to listening mode and receive the wireless access point flag of the wireless access point to be listened to.

[0063] The sending module is used to send an acquisition request to the wireless access point based on the wireless access point identifier to obtain the channel identifier of the wireless access point's working channel;

[0064] The modification module is used to modify its own working channel according to the channel flag, adjusting it to be consistent with the channel flag.

[0065] Optionally, in this embodiment, the wireless network card sets itself to monitoring mode. Monitoring mode is used to monitor clients accessing the wireless access point. The wireless network card can first determine the wireless access point to monitor. Different wireless access points can be distinguished by their wireless access point identifiers. Based on the wireless access point identifier, the wireless network card sends an acquisition request to the wireless access point to obtain the channel identifier of the wireless access point's operating channel. Then, the wireless network card sets its own operating channel to match the channel identifier.

[0066] As an optional example, the above-described apparatus further includes:

[0067] The storage module is used to store the key in a storage table according to the service set identifier. The storage table includes a service set identifier column and a key column, and the service set identifier and key are in one-to-one correspondence.

[0068] In this embodiment, the wireless network card can maintain a storage table. The storage table stores the correspondence between service set identifiers and keys. The two are in a one-to-one correspondence. A key can be uniquely mapped to a service set identifier. The wireless network card can determine the relationship between the service set identifier and the key by querying the storage table.

[0069] As an optional example, the above-mentioned generation module includes:

[0070] The splicing unit is used to concatenate the client random number, the wireless access point random number, and the basic element to form a pair of transmission keys.

[0071] Optionally, the order of concatenation in this embodiment can be limited, such as first generating a client random number, then a wireless access point random number, and finally the basic element; other orders are also possible, or the order is not limited. The concatenation yields a pair of transmission keys.

[0072] As an optional example, the above decryption module includes:

[0073] The decryption unit is used to decrypt the wireless message using a pair of transmission keys as the decryption key to obtain the plaintext content of the wireless message.

[0074] The determining unit is used to take the data in the mn-th bit of the plaintext content as account information, where the mn-th bit is the location in the plaintext content where the account information is stored.

[0075] Optionally, in this embodiment, the account information is stored at a specific location within the wireless message. After decoding the wireless message to obtain the plaintext content, the content at the specific location within the plaintext content can be retrieved, thereby obtaining the account information.

[0076] As an optional example, the above-described apparatus further includes:

[0077] The processing module is used to decrypt the wireless packets sent by the client to the wireless access point using a pair of transmission keys to obtain the client's account information. Then, it compares the account information with the whitelist. If the account information is not included in the whitelist, it notifies the wireless access point to discard the wireless packet.

[0078] Optionally, in this embodiment, after obtaining account information, it can be compared with a whitelist, which records account information of accounts allowed to access the wireless network. By comparing the information, clients that are not allowed to log in can be denied access to the wireless access point.

[0079] For other examples of this embodiment, please refer to the examples above, which will not be repeated here.

[0080] Figure 4 This is a schematic diagram of an optional electronic device according to an embodiment of this application, such as... Figure 4 As shown, it includes a processor 402, a communication interface 404, a memory 406, and a communication bus 408. The processor 402, communication interface 404, and memory 406 communicate with each other via the communication bus 408.

[0081] Memory 406 is used to store computer programs;

[0082] When processor 402 executes a computer program stored in memory 406, it performs the following steps:

[0083] When a client accesses the wireless access point, the client's random number is obtained through the wireless access point, as well as the wireless access point's random number and basic elements.

[0084] A pair of transmission keys is generated based on the client random number, the basic element, and the wireless access point random number.

[0085] The paired transmission key is used to decrypt the wireless message sent by the client to the wireless access point to obtain the client's account information, and the client's account information is used to determine whether the client is an allowed client to access the network.

[0086] Optionally, in this embodiment, the communication bus can be a PCI (Peripheral Component Interconnect) bus or an EISA (Extended Industry Standard Architecture) bus, etc. This communication bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 4 The symbol is represented by a single thick line, but this does not indicate that there is only one bus or one type of bus. The communication interface is used for communication between the aforementioned electronic devices and other devices.

[0087] The memory may include RAM, or non-volatile memory, such as at least one disk storage device. Optionally, the memory may also be at least one storage device located remotely from the aforementioned processor.

[0088] As an example, the memory 406 described above may include, but is not limited to, the acquisition module 302, the generation module 304, and the decryption module 306 in the monitoring device of the access client. Furthermore, it may include, but is not limited to, other module units in the monitoring device of the access client, which will not be elaborated upon in this example.

[0089] The aforementioned processor can be a general-purpose processor, including but not limited to: CPU (Central Processing Unit), NP (Network Processor), etc.; it can also be DSP (Digital Signal Processor), ASIC (Application Specific Integrated Circuit), FPGA (Field-Programmable Gate Array), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components.

[0090] Optionally, specific examples in this embodiment can refer to the examples described in the above embodiments, and will not be repeated here.

[0091] Those skilled in the art will understand that Figure 4 The structure shown is for illustrative purposes only. The device implementing the above-described monitoring method for access clients can be a terminal device, such as a smartphone (e.g., an Android phone, an iOS phone), a tablet computer, a PDA, a mobile Internet device (MID), a PAD, or other terminal devices. Figure 4 This does not limit the structure of the aforementioned electronic devices. For example, the electronic device may also include components that are more... Figure 4 The more or fewer components shown (such as network interfaces, display devices, etc.), or having the same Figure 4 The different configurations shown.

[0092] Those skilled in the art will understand that all or part of the steps in the various methods of the above embodiments can be implemented by a program instructing the hardware related to the terminal device. The program can be stored in a computer-readable storage medium, which may include: flash drive, ROM, RAM, disk or optical disk, etc.

[0093] According to another aspect of the present invention, a computer-readable storage medium is also provided, wherein a computer program is stored therein, wherein the computer program is executed by a processor to perform the steps in the above-described monitoring method for accessing a client.

[0094] Optionally, in this embodiment, those skilled in the art will understand that all or part of the steps in the various methods of the above embodiments can be implemented by a program instructing the hardware related to the terminal device. The program can be stored in a computer-readable storage medium, which may include: flash drive, read-only memory (ROM), random access memory (RAM), disk or optical disk, etc.

[0095] The sequence numbers of the above embodiments of the present invention are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0096] If the integrated units in the above embodiments are implemented as software functional units and sold or used as independent products, they can be stored in the aforementioned computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause one or more computer devices (which may be personal computers, servers, or network devices, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention.

[0097] In the above embodiments of the present invention, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0098] In the several embodiments provided in this application, it should be understood that the disclosed client can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces, indirect coupling or communication connection between units or modules, and may be electrical or other forms.

[0099] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0100] Furthermore, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0101] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A monitoring method for accessing clients, characterized in that, The wireless network card operates on the same channel as the wireless access point, and the wireless network card stores the service set identifier and key of the wireless access point. The method includes: The wireless network card sets itself to monitoring mode and receives the wireless access point flag of the wireless access point to be monitored; according to the wireless access point flag, the wireless network card sends an acquisition request to the wireless access point to obtain the channel flag of the working channel of the wireless access point; the wireless network card modifies its own working channel according to the channel flag to be consistent with the channel flag. When a client accesses the wireless access point, the process of the client associating with the wireless access point is monitored. Through the wireless access point, the client's random number is obtained, as well as the wireless access point's random number and basic elements are obtained. A pair of transmission keys is generated based on the client random number, the basic element, and the wireless access point random number. The paired transmission key is used to decrypt the wireless message sent by the client to the wireless access point to obtain the client's account information, and the client's account information is used to determine whether the client is an allowed client to access the network.

2. The method according to claim 1, characterized in that, The method further includes: The wireless network card stores the key in a storage table according to the service set identifier, wherein the storage table includes a service set identifier column and a key column, and the service set identifier and the key correspond one-to-one.

3. The method according to claim 1, characterized in that, The step of generating a pair of transmission keys based on the client random number, the basic element, and the wireless access point random number includes: The client random number, the wireless access point random number, and the basic element are concatenated to form the paired transmission key.

4. The method according to claim 1, characterized in that, The step of using the paired transmission key to decrypt the wireless message sent by the client to the wireless access point to obtain the client's account information includes: The wireless message is decrypted using the paired transmission key as the decryption key to obtain the plaintext content of the wireless message. The mn-th bit of the plaintext content is used as the account information, where the mn-th bit is the location in the plaintext content where the account information is stored.

5. The method according to claim 1, characterized in that, After decrypting the wireless message sent by the client to the wireless access point using the paired transmission key to obtain the client's account information, the method further includes: The account information is compared with the whitelist; If the account information is not included in the whitelist, the wireless access point is notified to discard the wireless packet.

6. The method according to claim 1, characterized in that, The method further includes: The client generates a client random number based on the first password entered by the user and its own service set identifier, and the wireless access point generates a wireless access point random number based on the second password used to connect to the wireless access point and its own service set identifier.

7. A monitoring device for accessing a client, characterized in that, The wireless network card operates on the same channel as the wireless access point. The wireless network card stores the service set identifier and key of the wireless access point. The device includes: The acquisition module is used to monitor the process of the client associating with the wireless access point when the client accesses the wireless access point, and to acquire the client's random number and the wireless access point's random number and basic elements through the wireless access point. The generation module is used to generate a pair of transmission keys based on the client random number, the basic element, and the wireless access point random number; The decryption module is used to decrypt the wireless messages sent by the client to the wireless access point using the paired transmission keys, obtain the client's account information, and determine whether the client is an allowed client based on the client's account information. The wireless network card sets itself to monitoring mode and receives the wireless access point flag of the wireless access point to be monitored. Based on the wireless access point flag, the wireless network card sends an acquisition request to the wireless access point to obtain the channel flag of the wireless access point's working channel. The wireless network card modifies its own working channel according to the channel flag to make it consistent with the channel flag.

8. A computer-readable storage medium storing a computer program, characterized in that, The computer program is executed by the processor to perform the method described in any one of claims 1 to 6.

9. An electronic device comprising a memory and a processor, characterized in that, The memory stores a computer program, and the processor is configured to execute the method described in any one of claims 1 to 6 through the computer program.

Images