A smart device commissioning method and apparatus

Abstract

Embodiments of the present application disclose a method and device for network access of a smart device, applied to the smart device, the method comprising: establishing a first connection with a smart terminal; determining a specified encryption suite with the smart terminal through the first connection, and performing bidirectional authentication with the smart terminal through the first connection; determining that the bidirectional authentication is passed, and then establishing a second connection with the smart terminal, the second connection being a TLS connection; receiving network access data encrypted by the specified encryption suite and sent by the smart terminal through the second connection; and decrypting the encrypted network access data by using the specified encryption suite, and performing network access according to the network access data.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of Internet of Things, and in particular to a smart device network access method and device. BACKGROUND

[0002] At present, when a smart device needs to access a network, a hotspot is sent out. After a smart terminal connects to the hotspot, the device address sent by the smart device is listened to through UDP broadcast. Then, the wifi name and password are encrypted by using a fixed encryption algorithm, and are sent to the smart device through UDP broadcast. After receiving the encrypted wifi name and password, the smart device decrypts and checks the wifi name and password, and finally accesses the network according to the wifi name and password. Attackers can capture the data of UDP broadcast to obtain the device address and the encrypted wifi name and password of the smart device. Moreover, since the wifi name and password are encrypted by using a fixed encryption algorithm, the attackers can crack the wifi name and password by using brute force cracking, dictionary exhaustive method and the like, so as to obtain the wifi name and password. Therefore, there is an urgent need for a smart device network access method capable of improving the security of network access data and reducing the risk of network access data leakage. SUMMARY

[0003] The present application provides a smart device network access method and device to solve the above technical problems.

[0004] To this end, the present application provides a smart device network access method, applied to a smart device, and the method comprises the following steps.

[0005] establishing a first connection with a smart terminal;

[0006] determining a specified encryption suite with the smart terminal through the first connection, and performing bidirectional authentication with the smart terminal through the first connection;

[0007] if the bidirectional authentication is passed, establishing a second connection with the smart terminal, wherein the second connection is a TLS connection;

[0008] receiving network access data encrypted by using the specified encryption suite and sent by the smart terminal through the second connection;

[0009] decrypting the encrypted network access data by using the specified encryption suite, and accessing the network according to the network access data.

[0010] The first connection with the smart terminal comprises the following steps.

[0011] sending a first connection establishment request to the intelligent terminal, so that the intelligent terminal establishes the first connection according to the identification data and the first connection request, wherein the identification data indicates a device address of the intelligent device, and the identification data is obtained by the intelligent terminal from the intelligent device before establishing the first connection.

[0012] wherein the determining, by the intelligent terminal, a specified encryption suite through the first connection comprises:

[0013] sending, by the intelligent terminal, a plurality of encryption suites to the intelligent device through the first connection;

[0014] receiving, by the intelligent terminal, the specified encryption suite sent by the intelligent terminal through the first connection, wherein the specified encryption suite is determined from the plurality of encryption suites.

[0015] wherein the performing, by the intelligent terminal, mutual authentication with the intelligent device through the first connection comprises:

[0016] sending, by the intelligent terminal, first authentication data to the intelligent device through the first connection, so that the intelligent device verifies the first authentication data by using the specified encryption suite;

[0017] receiving, by the intelligent terminal, second authentication data sent by the intelligent terminal through the first connection after the verification is passed;

[0018] verifying the second authentication data by using the specified encryption suite.

[0019] wherein the determining that the mutual authentication is passed comprises:

[0020] determining that the verification of the second authentication data is passed, and sending a second connection establishment request to the intelligent device, so that the intelligent device establishes the second connection according to the second connection request.

[0021] Another aspect of the embodiments of the present application provides a method for controlling an intelligent device to access a network, applied to an intelligent terminal, and the method comprises:

[0022] establishing a first connection with an intelligent device;

[0023] determining, by the intelligent terminal, a specified encryption suite through the first connection with the intelligent device, and performing mutual authentication with the intelligent device through the first connection;

[0024] determining that the mutual authentication is passed, and establishing a second connection with the intelligent device, wherein the second connection is a TLS connection;

[0025] encrypting access data by using the specified encryption suite;

[0026] send the encrypted on-network data to the smart device through the second connection, so that the smart device decrypts the encrypted on-network data by using the specified encryption suite and performs on-network according to the on-network data.

[0027] The determining the specified encryption suite through the first connection with the smart device comprises:

[0028] receiving a plurality of encryption suites sent by the smart device through the first connection;

[0029] determining the specified encryption suite from the plurality of encryption suites;

[0030] sending the specified encryption suite to the smart device through the first connection.

[0031] The mutual authentication through the first connection with the smart device comprises:

[0032] receiving first authentication data sent by the smart device through the first connection;

[0033] verifying the first authentication data by using the specified encryption suite;

[0034] if the verification is passed, sending second authentication data to the smart device through the first connection, so that the smart device verifies the second authentication data by using the specified encryption suite.

[0035] Another aspect of the embodiment of the application provides a smart device on-network method, which comprises:

[0036] the smart device establishes a first connection with the smart terminal;

[0037] the smart device determines a specified encryption suite through the first connection with the smart terminal and performs mutual authentication with the smart terminal through the first connection;

[0038] if the mutual authentication is passed, the smart device establishes a second connection with the smart terminal, and the second connection is a TLS connection;

[0039] the smart terminal encrypts on-network data by using the specified encryption suite and sends the encrypted on-network data to the smart device;

[0040] the smart device decrypts the encrypted on-network data by using the specified encryption suite and performs on-network according to the on-network data.

[0041] Another aspect of the embodiment of the application provides a smart device on-network device, which comprises:

[0042] The first connection module is configured to establish a first connection with the intelligent terminal.

[0043] The first authentication module is configured to determine a specified encryption suite with the intelligent terminal through the first connection, and perform bidirectional authentication with the intelligent terminal through the first connection.

[0044] The second connection module is configured to establish a second connection with the intelligent terminal if the authentication is passed, the second connection being a TLS connection, and receive the network access data encrypted by the specified encryption suite sent by the intelligent terminal through the second connection.

[0045] The first network access module is configured to decrypt the encrypted network access data by using the specified encryption suite and perform network access according to the network access data.

[0046] In the above scheme, the first connection is established for authentication between the intelligent terminal and the intelligent device. The authentication can verify the identity of the intelligent terminal and the intelligent device, and ensure the security of data transmission. After the first connection is established, the intelligent terminal and the intelligent device jointly determine the specified encryption suite, which is used for encrypting the network access data. Therefore, the key for encrypting the network access data is no longer a fixed key or encryption algorithm, but a specified encryption suite determined by the intelligent terminal and the intelligent device. The network access data is encrypted by the specified encryption suite, which significantly improves the security of the network access data, and the encrypted network access data is sent to the intelligent device through the second connection instead of UDP broadcast, which greatly reduces the risk of network access data leakage. BRIEF DESCRIPTION OF DRAWINGS

[0047] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings needed in the embodiments will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.

[0048] Figure 1 A flowchart of a method for network access of an intelligent device according to an embodiment of the present application is shown;

[0049] Figure 2 A flowchart of a method for determining a specified encryption suite according to another embodiment of the present application is shown;

[0050] Figure 3 A flowchart of a bidirectional authentication method according to another embodiment of the present application is shown;

[0051] Figure 4 A flowchart of a method for controlling network access of an intelligent device according to another embodiment of the present application is shown;

[0052] Figure 5 A flow chart of another smart device onboarding method according to another embodiment of the present application is shown;

[0053] Figure 6 A flow chart of a specific smart device onboarding method according to another embodiment of the present application is shown;

[0054] Figure 7 A structural schematic diagram of a smart device onboarding apparatus according to an embodiment of the present application is shown;

[0055] Figure 8 A structural schematic diagram of a control smart device onboarding apparatus according to an embodiment of the present application is shown;

[0056] Figure 9 A structural schematic diagram of another smart device onboarding apparatus according to an embodiment of the present application is shown. DETAILED DESCRIPTION

[0057] In order to make the purposes, features and advantages of the present application more obvious and easy to understand, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only some of the embodiments of the present application, but not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work fall within the scope of protection of the present application.

[0058] TECHNICAL PROBLEM

[0059] In order to improve the security of onboarding data and reduce the risk of onboarding data leakage, an embodiment of the present application provides a smart device onboarding method, as shown in the figure, which comprises the following steps: Figure 1

[0060] Step 101: establishing a first connection with a smart terminal.

[0061] The first connection can be a TCP connection, an Http connection, etc.

[0062] Step 102: determining a specified encryption suite with the smart terminal through the first connection, and performing bidirectional authentication with the smart terminal through the first connection.

[0063] In the embodiment, each encryption suite contains multiple encryption algorithms, including asymmetric encryption algorithms, symmetric encryption algorithms, authentication verification algorithms, ECDH algorithms, etc. Among them, the authentication verification algorithm is used to verify the authentication data. The asymmetric encryption algorithm, the symmetric encryption algorithm and the ECDH algorithm are used to encrypt the onboarding data. The keys of the encryption algorithms in each encryption suite are different.​

[0064] The multiple encryption suites sent by the smart device to the smart terminal during the first time of network entry are fixed multiple encryption suites. After network entry, the smart device can connect to the server to update the multiple encryption suites locally.

[0065] The smart device and the smart terminal determine the designated encryption suite through the first connection.

[0066] In step 103, if the two-way authentication is determined to be passed, a second connection is established with the smart terminal, and the second connection is a TLS connection.

[0067] In step 104, the network entry data encrypted by the designated encryption suite sent by the smart terminal is received through the second connection.

[0068] In step 105, the encrypted network entry data is decrypted by the designated encryption suite, and network entry is performed according to the network entry data.

[0069] After the smart terminal encrypts the network entry data by the designated encryption suite, the encrypted network entry data is sent to the smart device through the second connection. The smart device decrypts the encrypted network entry data by the designated encryption suite, and then performs network entry according to the network entry data.

[0070] The first connection is established for two-way authentication between the smart terminal and the smart device. Through two-way authentication, the identities of the smart terminal and the smart device can be verified, and the security of data transmission can be ensured. After the first connection is established, the smart terminal and the smart device determine the designated encryption suite together. The encryption suite is used for encrypting the network entry data. Therefore, the key for encrypting the network entry data is no longer a fixed key or encryption algorithm, but a designated encryption suite determined by the smart terminal and the smart device. By encrypting the network entry data by the designated encryption suite, the security of the network entry data is significantly improved, and the risk of network entry data leakage is greatly reduced after encryption through the second connection instead of UDP broadcast to the smart device.

[0071] In an example of the present application, a method for establishing a first connection is also provided, comprising:

[0072] In step 201, a first connection establishment request is sent to the smart terminal, so that the smart terminal establishes the first connection according to the identification data and the first connection request. The identification data indicates the device address of the smart device, and the identification data is obtained by the smart terminal from the smart device before establishing the first connection.

[0073] Firstly, before the first connection is established, the smart device enters a network configuration state, i.e. sends out a hotspot, and broadcasts identification data of the smart device through UDP broadcast of a specified port. The smart terminal (mobile phone, PC computer or tablet computer) connects the hotspot and starts to listen to the UDP broadcast of the specified port. The smart terminal acquires and analyzes the identification data of the smart device. Then, after receiving the first connection establishment request sent by the smart device, the smart terminal establishes the first connection with the smart device according to the identification data and the first connection establishment request.

[0074] In the embodiment, the smart device is taken as a client for establishing the first connection, and the smart terminal is taken as a server for establishing the first connection. When the first connection is established, the party that initiates the first connection request is the client. For the server when the first connection is established, the performance requirement for the device is relatively large. Therefore, when the first connection is established, the smart device is taken as the client, so that the performance requirement for the smart device can be reduced, thereby reducing the cost of the smart device.

[0075] It should be noted that in other embodiments, when the first connection is established, the smart device can also be taken as the server, and the smart terminal is taken as the client.

[0076] After the smart terminal acquires the identification data of the smart device by listening to the broadcast, the smart terminal sends a first connection establishment request to the smart device according to the identification data;

[0077] The smart device receives the first connection establishment request, and establishes the first connection with the smart terminal according to the first connection establishment request.

[0078] As shown in FIG. 1, Figure 2 In an example of the present application, a determination method of a specified encryption suite is further provided, which comprises:

[0079] Step 301: sending a plurality of encryption suites to the smart terminal through the first connection.

[0080] After the first connection is established, the smart device sends a plurality of encryption suites to the smart terminal through the first connection.

[0081] Step 302: receiving a specified encryption suite sent by the smart terminal through the first connection, wherein the specified encryption suite is determined from the plurality of encryption suites.

[0082] In the embodiment, after the smart terminal receives the plurality of encryption suites sent by the smart device through the first connection, the smart terminal selects one of the plurality of encryption suites as the specified encryption suite.

[0083] After the first connection is established, the smart terminal and the smart device jointly determine the specified encryption suite. Therefore, the key for encrypting the network access data is no longer a fixed key or encryption algorithm, but the encryption suite determined by the smart terminal and the smart device. By encrypting the network access data through the specified encryption suite, the security of the network access data is significantly improved.

[0084] As shown in the example of the present application, a two-way authentication method is also provided, comprising: Figure 3

[0085] Step 401, sending first authentication data to the smart terminal through the first connection, so that the smart terminal verifies the first authentication data using the specified encryption suite.

[0086] Step 402, receiving second authentication data sent by the smart terminal through the first connection after the verification is passed.

[0087] Step 403, verifying the second authentication data using the specified encryption suite.

[0088] The first authentication data and the second authentication data can be certificate chain data, or some custom feature data.

[0089] Before the second connection is established, two-way authentication is performed between the smart terminal and the smart device through the first connection, which can verify the identity of the smart terminal and the smart device. The security of the smart device network access can be significantly improved, and the risk of information leakage caused by attackers impersonating the smart terminal to attack can be prevented.

[0090] In the above example, the first authentication data and the second authentication data are set as certificate chain data, which can further improve the security of two-way authentication.

[0091] In an example of the present application, a second connection establishment method is also provided, comprising:

[0092] Step 501, determining that the verification of the second authentication data is passed, sending a second connection establishment request to the smart terminal, so that the smart terminal establishes the second connection according to the second connection request.

[0093] ​The second connection is established after the smart terminal and the smart device are authenticated, which can significantly improve the security of the smart device in the network, prevent the smart terminal from being impersonated by an attacker to attack, and further cause the risk of information leakage. By establishing the second connection, the encrypted network access data is sent to the smart device through the second connection instead of through the UDP broadcast, which greatly reduces the risk of network access data leakage. Correspondingly, when establishing the second connection, the smart device as a client sends a second connection establishment request to the server smart terminal, which can reduce the performance requirements of the smart device and further reduce the cost of the smart device.

[0094] It should be noted that in other embodiments, when establishing the second connection, the smart device can also act as a server and the smart terminal as a client.

[0095] The smart device determines that the second authentication data passes the verification, and sends verification pass information to the smart terminal;

[0096] The smart terminal receives the verification pass information and sends a second connection establishment request to the smart device;

[0097] The smart device receives the second connection establishment request and establishes a second connection with the smart terminal according to the second connection establishment request.

[0098] As shown in Figure 4 In an example of the present application, a method for controlling a smart device to access the network is also provided, comprising:

[0099] Step 601, establishing a first connection with a smart device;

[0100] Step 602, determining a specified encryption suite with the smart device through the first connection, and performing bidirectional authentication with the smart device through the first connection;

[0101] Step 603, determining that the bidirectional authentication passes, then establishing a second connection with the smart device, the second connection being a TLS connection;

[0102] Step 604, encrypting network access data using the specified encryption suite;

[0103] Step 605, sending the encrypted network access data to the smart device through the second connection, so that the smart device decrypts the encrypted network access data using the specified encryption suite and accesses the network according to the network access data.

[0104] In an example of the present application, another method for establishing a first connection is also provided, comprising:

[0105] Receiving a first connection establishment request sent by the smart device;

[0106] establish the first connection according to the identification data and the first connection request, the identification data indicating a device address of the smart device, the identification data being obtained by the smart terminal from the smart device before the first connection is established.

[0107] In an example of the present application, another method for determining a specified encryption suite is also provided, comprising:

[0108] receiving a plurality of encryption suites sent by the smart device through the first connection;

[0109] determining a specified encryption suite from the plurality of encryption suites;

[0110] sending the specified encryption suite to the smart device through the first connection.

[0111] In an example of the present application, another method for two-way authentication is also provided, comprising:

[0112] receiving first authentication data sent by the smart device through the first connection;

[0113] verifying the first authentication data by using the specified encryption suite;

[0114] if the verification is passed, sending second authentication data to the smart device through the first connection, so that the smart device verifies the second authentication data by using the specified encryption suite.

[0115] In an example of the present application, another method for establishing a second connection is also provided, comprising:

[0116] receiving a second connection establishment request sent by the smart device, and establishing the second connection according to the second connection request.

[0117] As shown in Figure 5 In an example of the present application, another method for onboarding a smart device is also provided, comprising:

[0118] Step 701, a smart device establishes a first connection with a smart terminal;

[0119] Step 702, the smart device determines a specified encryption suite with the smart terminal through the first connection, and performs two-way authentication with the smart terminal through the first connection;

[0120] Step 703, the smart device determines that the two-way authentication is passed, and then establishes a second connection with the smart terminal, the second connection being a TLS connection;

[0121] Step 704, the intelligent terminal encrypts the network access data by using the specified encryption suite, and sends the encrypted network access data to the intelligent device.

[0122] Step 705, the intelligent device decrypts the encrypted network access data by using the specified encryption suite, and performs network access according to the network access data.

[0123] In an example of the present application, another method for establishing a first connection is provided, comprising:

[0124] The intelligent device sends a first connection establishment request to the intelligent terminal.

[0125] The intelligent terminal establishes the first connection according to the identification data and the first connection request, wherein the identification data indicates a device address of the intelligent device, and the identification data is obtained by the intelligent terminal from the intelligent device before establishing the first connection.

[0126] In an example of the present application, another method for determining a specified encryption suite is provided, comprising:

[0127] The intelligent device sends a plurality of encryption suites to the intelligent terminal through the first connection.

[0128] The intelligent terminal determines the specified encryption suite from the plurality of encryption suites.

[0129] The intelligent terminal sends the specified encryption suite to the intelligent device through the first connection.

[0130] In an example of the present application, another method for two-way authentication is provided, comprising:

[0131] The intelligent device sends first authentication data to the intelligent terminal through the first connection.

[0132] The intelligent terminal checks the first authentication data by using the specified encryption suite.

[0133] If the checking is passed, the intelligent terminal sends second authentication data to the intelligent device through the first connection.

[0134] The intelligent device checks the second authentication data by using the specified encryption suite.

[0135] In an example of the present application, another method for establishing a second connection is provided, comprising:

[0136] If the checking of the second authentication data is passed, the intelligent device sends a second connection establishment request to the intelligent terminal.

[0137] The intelligent terminal establishes the second connection according to the second connection request.

[0138] As Figure 6 shown in the present application, a specific intelligent device network access method is also provided in an example, comprising:

[0139] Step 801, the intelligent device starts the network access mode and sends out a hotspot.

[0140] Step 802, the intelligent device broadcasts identification data.

[0141] It should be noted that the intelligent terminal needs to connect to the hotspot sent by the intelligent device after the intelligent device sends out the hotspot.

[0142] Step 803, the intelligent terminal listens to the broadcast and obtains the identification data.

[0143] Step 804, the intelligent device sends a first connection establishment request to the intelligent terminal.

[0144] Step 805, the intelligent terminal receives the first connection establishment request and establishes a first connection with the intelligent device according to the identification data and the first connection establishment request.

[0145] Step 806, the intelligent device sends a plurality of encryption suites to the intelligent terminal through the first connection.

[0146] Step 807, the intelligent terminal receives the plurality of encryption suites and determines a specified encryption suite therefrom.

[0147] Step 808, the intelligent terminal sends the specified encryption suite to the intelligent device.

[0148] Step 809, the intelligent device receives the specified encryption suite and sends first authentication data to the intelligent terminal.

[0149] Step 810, the intelligent terminal receives the first authentication data, verifies the first authentication data, and sends second authentication data to the intelligent device after verification.

[0150] Step 811, the intelligent device receives the second authentication data, verifies the second authentication data, and sends a second connection establishment request to the intelligent terminal after verification.

[0151] Step 812, the intelligent terminal receives the second connection establishment request and establishes a second connection with the intelligent device according to the second connection establishment request, the second connection being a TLS connection.

[0152] Step 813, the intelligent terminal encrypts network access data using the specified encryption suite and sends the network access data to the intelligent device through the second connection.

[0153] In step 814, the smart device receives the encrypted onboarding data, decrypts the encrypted onboarding data using the specified encryption suite, and performs onboarding according to the onboarding data.

[0154] As shown in Figure 7 An example of the present application provides a smart device onboarding apparatus, which includes:

[0155] A first connection module 10 is configured to establish a first connection with a smart terminal.

[0156] A first authentication module 20 is configured to determine a specified encryption suite with the smart terminal through the first connection, and perform bidirectional authentication with the smart terminal through the first connection.

[0157] A second connection module 30 is configured to establish a second connection with the smart terminal if the bidirectional authentication is passed, the second connection being a TLS connection, and receive onboarding data encrypted by the smart terminal using the specified encryption suite through the second connection.

[0158] A first onboarding module 40 is configured to decrypt the encrypted onboarding data using the specified encryption suite and perform onboarding according to the onboarding data.

[0159] The first connection module 10 is further configured to send a first connection establishment request to the smart terminal, so that the smart terminal establishes the first connection according to identification data and the first connection request, the identification data indicating a device address of the smart device, the identification data being obtained by the smart terminal from the smart device before establishing the first connection.

[0160] The first connection module 10 is further configured to send a plurality of encryption suites to the smart terminal through the first connection.

[0161] The first connection module 10 is further configured to receive the specified encryption suite sent by the smart terminal through the first connection, the specified encryption suite being determined from the plurality of encryption suites.

[0162] The first connection module 10 is further configured to send first authentication data to the smart terminal through the first connection, so that the smart terminal verifies the first authentication data using the specified encryption suite.

[0163] The first connection module 10 is further configured to receive second authentication data sent by the smart terminal through the first connection after verification.

[0164] The first authentication module 20 is further configured to verify the second authentication data using the specified encryption suite.

[0165] The second connection module 30 is further configured to determine that the second authentication data passes the verification, and send a second connection establishment request to the intelligent terminal, so that the intelligent terminal establishes the second connection according to the second connection request.

[0166] As shown in Figure 8 The present application provides a control intelligent device onboarding device, which comprises:

[0167] The third connection module 50 is configured to establish a first connection with the intelligent device.

[0168] The second authentication module 60 is configured to determine a specified encryption suite with the intelligent device through the first connection, and perform bidirectional authentication with the intelligent device through the first connection.

[0169] The fourth connection module 70 is configured to establish a second connection with the intelligent device if the bidirectional authentication passes, and the second connection is a TLS connection.

[0170] The first encryption module 80 is configured to encrypt onboarding data by using the specified encryption suite.

[0171] The fourth connection module 70 is further configured to send the encrypted onboarding data to the intelligent device through the second connection, so that the intelligent device decrypts the encrypted onboarding data by using the specified encryption suite and performs onboarding according to the onboarding data.

[0172] The third connection module 50 is further configured to receive a first connection establishment request sent by the intelligent device.

[0173] The third connection module 50 is further configured to establish the first connection according to identification data and the first connection request, wherein the identification data indicates a device address of the intelligent device, and the identification data is obtained by the intelligent terminal from the intelligent device before establishing the first connection.

[0174] The third connection module 50 is further configured to receive a plurality of encryption suites sent by the intelligent device through the first connection.

[0175] The third connection module 50 is further configured to determine a specified encryption suite from the plurality of encryption suites.

[0176] The third connection module 50 is further configured to send the specified encryption suite to the intelligent device through the first connection.

[0177] The third connection module 50 is further configured to receive first authentication data sent by the intelligent device through the first connection.

[0178] The second authentication module 60 is further configured to verify the first authentication data by using the specified encryption suite.

[0179] The third connection module 50 is further configured to, if the verification is passed, send second authentication data to the smart device through the first connection, so that the smart device verifies the second authentication data by using the specified encryption suite.

[0180] The fourth connection module 70 is further configured to receive a second connection establishment request sent by the smart device, and establish the second connection according to the second connection request.

[0181] As shown in Figure 9 The present application provides a smart device network access device, which comprises:

[0182] The fifth connection module 90 is configured to establish a first connection between the smart device and the smart terminal.

[0183] The third authentication module 100 is configured to determine a specified encryption suite by the smart device through the first connection with the smart terminal, and perform bidirectional authentication by the smart device through the first connection with the smart terminal.

[0184] The sixth connection module 110 is configured to, if the bidirectional authentication is passed, establish a second connection between the smart device and the smart terminal, wherein the second connection is a TLS connection.

[0185] The second encryption module 120 is configured to encrypt network access data by the smart terminal by using the specified encryption suite, and send the encrypted network access data to the smart device.

[0186] The second network access module 130 is configured to decrypt the encrypted network access data by the smart device by using the specified encryption suite, and perform network access according to the network access data.

[0187] The fifth connection module 90 is further configured to send a first connection establishment request to the smart terminal by the smart device.

[0188] The fifth connection module 90 is further configured to establish the first connection according to identification data and the first connection request by the smart terminal, wherein the identification data indicates a device address of the smart device, and the identification data is obtained by the smart terminal from the smart device before establishing the first connection.

[0189] The fifth connection module 90 is further configured to send a plurality of encryption suites to the smart terminal by the smart device through the first connection.

[0190] The fifth connection module 90 is further configured to determine, by the intelligent terminal, a specified encryption suite from the plurality of encryption suites.

[0191] The fifth connection module 90 is further configured to send, by the intelligent terminal, the specified encryption suite to the intelligent device through the first connection.

[0192] The fifth connection module 90 is further configured to send, by the intelligent device, first authentication data to the intelligent terminal through the first connection.

[0193] The third authentication module 100 is further configured to verify, by the intelligent terminal, the first authentication data by using the specified encryption suite.

[0194] The fifth connection module 90 is further configured to send, by the intelligent terminal, second authentication data to the intelligent device through the first connection when the verification is passed.

[0195] The third authentication module 100 is further configured to verify, by the intelligent device, the second authentication data by using the specified encryption suite.

[0196] The sixth connection module 110 is further configured to send, by the intelligent device, a second connection establishment request to the intelligent terminal when the verification of the second authentication data is passed.

[0197] The sixth connection module 110 is further configured to establish, by the intelligent terminal, the second connection according to the second connection request.

[0198] In one example, the embodiments of the present application further provide a mobile terminal, which comprises at least one memory and a processor in communication connection with the at least one memory; wherein the memory stores instructions executable by the at least one processor, and the instructions are configured to execute the above-mentioned Figures 1 to 4 The method for the intelligent device to access a network according to any one of the embodiments.

[0199] In addition, the embodiments of the present application further provide a computer readable storage medium, which stores computer executable instructions, and the computer executable instructions are used to execute the above-mentioned Figures 1 to 4 The method for the intelligent device to access a network according to any one of the embodiments.

[0200] In the description of the application, the description of the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" etc. means that the specific features, structures, materials or characteristics described in connection with the embodiment or example are included in at least one embodiment or example of the application. Moreover, the specific features, structures, materials or characteristics described can be combined in any appropriate manner in any one or more embodiments or examples. In addition, different embodiments or examples described in the specification and characteristics of different embodiments or examples can be combined and combined by those skilled in the art without contradiction.

[0201] In addition, the terms "first", "second" are only for descriptive purposes and cannot be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined with "first", "second" can explicitly or implicitly include at least one of the features. In the description of the embodiments of the application, the meaning of "multiple" is two or more, unless otherwise specifically limited.

[0202] It should be understood that the term "and / or" used herein only describes the association relationship of the associated objects, which means that there can be three relationships, for example, A and / or B, which means that there are three cases of A alone, A and B together, and B alone. In addition, the character " / " in this paper generally represents that the front and rear associated objects are a "or" relationship.

[0203] Depending on the context, the word "if" as used herein can be interpreted as "when" or "upon" or "in response to determining" or "in response to detecting". Similarly, depending on the context, the phrase "if it is determined" or "if (a stated condition or event) is detected" can be interpreted as "when it is determined" or "in response to determining" or "when (a stated condition or event) is detected" or "in response to detecting (a stated condition or event)".

[0204] In several embodiments provided in the application, it should be understood that the disclosed system, device and method can be implemented in other ways. For example, the above-described device embodiments are only schematic, for example, the division of the units is only a logical function division, and actual implementation can have another division manner, for example, a plurality of units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between the displayed or discussed mutual ones can be indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0205] In addition, each of the function units in each embodiment of the present application can be integrated in one processing unit, or each unit can be physically present separately, or two or more units can be integrated in one unit. The integrated unit can be realized in the form of hardware or in the form of hardware plus software function unit.

[0206] The integrated unit realized in the form of software function unit can be stored in a computer readable storage medium. The software function unit stored in a storage medium includes a plurality of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) or a processor to execute part of the steps of the method described in each embodiment of the present application. The foregoing storage medium includes a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and various media capable of storing program codes.

[0207] The above is only a specific embodiment of the present application, but the protection scope of the present application is not limited to this. Any person skilled in the art can easily think of changes or replacements within the technical scope disclosed in the present application, which should be covered within the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. A method for smart devices to access the network, characterized in that, Applied to smart devices, the method includes: Establish the first connection with the smart terminal; The first connection is used to determine a specified encryption suite with the smart terminal, and two-way authentication is performed with the smart terminal through the first connection. If the two-way authentication is successful, a second connection is established with the smart terminal, and the second connection is a TLS connection; The second connection is used to receive network access data sent by the smart terminal after being encrypted using a specified encryption suite. The encrypted network access data is decrypted using the specified encryption suite, and the network access is initiated based on the network access data. The step of determining the specified encryption suite through the first connection with the smart terminal includes: Multiple encryption kits are sent to the smart terminal through the first connection; Receive a specified encryption suite sent by the smart terminal through the first connection, wherein the specified encryption suite is determined from the plurality of encryption suites; The step of performing two-way authentication with the smart terminal through the first connection includes: Send first authentication data to the smart terminal through the first connection, so that the smart terminal can verify the first authentication data using the specified encryption suite; Receive the second authentication data sent through the first connection after the smart terminal has passed verification; The second authentication data is verified using the specified encryption suite.

2. The method for intelligent devices to access the network according to claim 1, characterized in that, Establishing the first connection with the smart terminal includes: A first connection establishment request is sent to the smart terminal so that the smart terminal establishes the first connection based on the identification data and the first connection establishment request. The identification data indicates the device address of the smart device and is obtained by the smart terminal from the smart device before establishing the first connection.

3. The method for intelligent devices to access the network according to claim 1, characterized in that, The step of establishing a second connection with the smart terminal after confirming that the two-way authentication is successful includes: Once the verification of the second authentication data is confirmed to be successful, a second connection establishment request is sent to the smart terminal so that the smart terminal establishes the second connection according to the second connection establishment request.

4. A method for controlling the network access of intelligent devices, characterized in that, Applied to smart terminals, the method includes: Establish the first connection with smart devices; The first connection is used to determine a specified encryption suite with the smart device, and two-way authentication is performed with the smart device through the first connection. If the two-way authentication is successful, a second connection is established with the smart device, and the second connection is a TLS connection; Encrypt the incoming data using the specified encryption suite; The encrypted network access data is sent to the smart device through the second connection, so that the smart device can decrypt the encrypted network access data using the specified encryption suite and enter the network according to the network access data; The step of determining the specified encryption suite with the smart device through the first connection includes: Receive multiple encryption kits sent by the smart device through the first connection; The specified encryption suite is determined from the plurality of encryption suites; The specified encryption suite is sent to the smart device via the first connection; The step of performing two-way authentication with the smart device through the first connection includes: Receive the first authentication data sent by the smart device through the first connection; The first authentication data is verified using the specified encryption suite; If the verification is successful, the second authentication data is sent to the smart device through the first connection, so that the smart device can verify the second authentication data using the specified encryption suite.

5. A method for smart devices to access the network, characterized in that, The method includes: The smart device establishes its first connection with the smart terminal; The smart device determines a specified encryption suite with the smart terminal through the first connection, and performs two-way authentication with the smart terminal through the first connection. If the smart device determines that the two-way authentication is successful, it establishes a second connection with the smart terminal, and the second connection is a TLS connection; The smart terminal uses the specified encryption suite to encrypt the network access data and sends the encrypted network access data to the smart device. The smart device uses the specified encryption suite to decrypt the encrypted network access data and then enters the network based on the network access data; The smart device determines a specified encryption suite with the smart terminal through the first connection, including: The smart device sends multiple encryption packages to the smart terminal through the first connection; The smart terminal determines the specified encryption suite from the plurality of encryption suites; The smart terminal sends the specified encryption suite to the smart device through the first connection; The step of performing two-way authentication with the smart terminal through the first connection includes: The smart device sends first authentication data to the smart terminal through the first connection; The smart terminal uses the specified encryption suite to verify the first authentication data; If the smart terminal determines that the verification is successful, it sends the second authentication data to the smart device through the first connection. The smart device uses the specified encryption suite to verify the second authentication data.

6. A smart device network access device, characterized in that, The device includes: The first connection module is used to establish a first connection with the smart terminal; The first authentication module is used to determine a specified encryption suite with the smart terminal through the first connection, and to perform two-way authentication with the smart terminal through the first connection. The second connection module is used to establish a second connection with the smart terminal if the two-way authentication is successful. The second connection is a TLS connection. The module also receives network access data encrypted with a specified encryption suite from the smart terminal through the second connection. The first network access module is used to decrypt the encrypted network access data using the specified encryption suite and to access the network based on the network access data; The step of determining the specified encryption suite through the first connection with the smart terminal includes: Multiple encryption kits are sent to the smart terminal through the first connection; Receive a specified encryption suite sent by the smart terminal through the first connection, wherein the specified encryption suite is determined from the plurality of encryption suites; The step of performing two-way authentication with the smart terminal through the first connection includes: Send first authentication data to the smart terminal through the first connection, so that the smart terminal can verify the first authentication data using the specified encryption suite; Receive the second authentication data sent through the first connection after the smart terminal has passed verification; The second authentication data is verified using the specified encryption suite.

Images