A cross-domain installation method of an Internet of Things WAPI terminal entity certificate browser

Abstract

A kind of Internet of Things WAPI terminal entity certificate browser cross-domain installation method, 1) certificate issuing system based on Internet of Things WAPI terminal, console and AS server;Console connects WAPI terminal and AS server by network;Console supports WEB browser, and console can access Internet of Things WAPI terminal and AS server by network by wired or wireless mode;2) console logs in and accesses AS server by WEB browser, and the address of WAPI terminal and user password are configured on page;3) when user equipment needs to be issued certificate, the AS certificate installation of terminal is realized by clicking the certificate issuing button on the console control page;4) after clicking the certificate issuing button on the console, installation is completed by the AJAX of browser and browser cross-domain access technology.

Description

Technical Field

[0001] This invention is a certificate installation method for IoT WAPI terminals. This method can solve the problem of issuing and installing IoT WAPI terminal certificates, and improve the ease of use of WAPI networks while ensuring security. Background Technology

[0002] WAPI is a wireless LAN authentication and security infrastructure and a mandatory wireless LAN security standard in China. Because WAPI employs two-way authentication encryption technology and uses elliptic curve cryptography (public-key scheme) and block cipher (secret-key scheme) algorithms approved by the State Cryptography Administration, it achieves device authentication, link verification, access control, and encrypted protection of user information during wireless transmission. Therefore, this technology effectively solves the problems of secure access and confidential communication.

[0003] In practical use, WAPI communication involves certificate issuance and installation processes, especially for systems with high security requirements. Certificate installation requires steps such as AS certificate installation, AUSE certificate application to the terminal, AS certificate issuance, and terminal certificate installation, making the process cumbersome. Furthermore, IoT WAPI terminals generally lack a user interface, further complicating certificate issuance and installation. This invention utilizes cross-domain access technology via a browser to achieve one-click certificate installation, significantly improving the efficiency of WAPI terminal activation and solving the problem of rapid deployment of IoT devices on WAPI networks.

[0004] CN200910021418.X relates to a method for implementing a convergent WAPI network architecture using a local MAC mode. The method includes the following steps: 1) Constructing a local MAC mode; separating the MAC function and WAPI function of the wireless access point onto the wireless terminal and the access controller, respectively; 2) In the local MAC mode, integrating the WAPI protocol with the convergent WLAN network architecture; 2.1) The association and connection process between the site, the wireless terminal, and the access controller; 2.2) The notification process between the access controller and the wireless terminal to announce the start of WAPI protocol execution; 2.3) The execution process of the WAPI protocol between the site and the access controller; 2.4) The notification process between the access controller and the wireless terminal to announce the end of WAPI protocol execution; 2.5) The process of secure communication between the wireless terminal and the site using WAPI. This invention not only meets the needs of large-scale WLAN deployment but also ensures the security of WLAN under a convergent architecture.

[0005] CN200710019092.8 relates to a WAPI unicast key negotiation method. The method comprises the following steps: 1. An authenticator entity adds a message integrity code to a unicast key negotiation request packet and sends it to an authenticator requester entity; 2. Upon receiving the unicast key negotiation request packet, the authenticator requester entity verifies it. If incorrect, the packet is discarded; if correct, further verification is performed. If successful, a unicast key negotiation response packet is sent to the authenticator entity; 3. Upon receiving the unicast key negotiation response packet, the authenticator entity verifies it. If successful, a unicast key negotiation confirmation packet is sent to the authenticator requester entity; 4. Upon receiving the unicast key negotiation confirmation packet, the authenticator requester entity verifies it. If successful, a consistent unicast session key is negotiated. This invention solves the DoS attack problem existing in the unicast key management protocol of the current WAPI security mechanism.

[0006] CN200910000198.2 discloses a security management method and system for WAPI terminals accessing an IMS network. The method includes: when the access point and the WAPI terminal are authenticated by the Access Sockets Unit (ASU), the ASU sends a security information request message to the Access Server Segregation Controller (HSS), wherein the security information request message carries the IMS (IP Multimedia Subsystem) account information of the WAPI terminal; upon receiving the security information request message from the ASU, the HSS sets the security information corresponding to the WAPI terminal's IMS account information to access layer security; the P-CSCF receives an IMS registration request message from the WAPI terminal, queries the WAPI terminal's security information through the HSS, and allows the WAPI terminal to execute IMS service processes if the WAPI terminal's security information is access layer security. This invention can reduce the power consumption of WAPI terminals and improve user experience while ensuring the security of the IMS system. Summary of the Invention

[0007] The installation method described in this invention requires IoT WAPI terminals, an operator console, and an AS server. The operator console is typically a regular computer or a mobile phone / tablet that supports a web browser. The IoT WAPI terminal is used for WAPI communication, and the AS server is used to issue certificates to the WAPI terminal.

[0008] The technical solution of this invention is: a cross-domain installation method for an IoT WAPI terminal entity certificate browser, characterized by comprising the following steps:

[0009] First, the certificate issuance system consists of an IoT WAPI terminal, a console, and an AS server. The console supports a web browser and can access the IoT WAPI terminal and AS server via a network through wired or wireless means.

[0010] Second, the console allows users to log in and access the AS server via a web browser, configuring the WAPI terminal address, user password, and certificate issuance policy on the page.

[0011] Third, after clicking "Issue Certificate" in the console web browser, the entire process from certificate application, certificate issuance, and certificate installation is automatically completed through the browser's AJAX and cross-domain access technology, realizing one-click installation of WAPI physical terminal certificates.

[0012] Beneficial Effects: This invention's console requires no additional software installation. It rapidly installs WAPI terminal entity certificates using browser AJAX and cross-domain access technologies, thereby improving the efficiency of WAPI network deployment. This invention utilizes browser AJAX and Cross-Domain Access (CORS) technologies, allowing users to install certificates for IoT WAPI terminals with a single click using a regular computer and a browser, without installing any other software. This significantly improves the efficiency of WAPI terminal deployment. It is an excellent solution for the construction and widespread adoption of WAPI networks and has promising application prospects. Attached Figure Description

[0013] Figure 1 This is the system network topology diagram in this invention.

[0014] Figure 2 This is a flowchart of the cross-domain installation process of the IoT WAPI terminal entity certificate browser in this invention. Detailed Implementation

[0015] The present invention will be further described below with reference to the accompanying drawings and embodiments.

[0016] The method for cross-domain installation of an IoT WAPI terminal entity certificate browser as described in this invention, i.e., the cross-domain installation process of the IoT WAPI terminal entity certificate browser used in this invention, includes the following steps:

[0017] First, the present invention describes the system network topology as follows: Figure 1 As shown, the system consists of IoT WAPI terminals, a control console, and an AS server. The IoT WAPI terminals connect to the control console via wired or wireless means, and the control console connects to the AS server via wired or wireless means. The control console has general-purpose browser software that supports Cross-Origin Access Restriction (CORS) technology and asynchronous JavaScript and XML (AJAX) technology.

[0018] Secondly, install the web service on the AS server and embed the web service into the IoT WAPI terminal. The relevant web service can be accessed by a browser through the console and data can be processed according to the following procedure.

[0019] Third, the cross-domain installation process for the IoT WAPI terminal entity certificate browser is attached. Figure 2 (1) The user enters the AS server URL in the browser and logs in to the AS server with the administrator account; (2) Enter the certificate issuance page and configure the device address and device user password and other parameters; (3) The user clicks the "Issue Certificate" button on the page to trigger the certificate issuance JavaScript program of the webpage; (4) The JS program uses AJAX to initiate a cross-domain request, and sends the AS server domain name and user password to the device in the URL format using SHA1 or MD5, etc. After receiving the request, the device verifies the user password and sets the cross-domain access header to "Access-Control-Allow-Origin: AS URL address", and then returns the verification result and access token; (5) After the JS program receives the verification result correctly, it uses AJAX to send an HTTP GET request to the AS. After receiving the request, the AS returns the AS root certificate data through the HTTP protocol. The JS program obtains the AS root certificate data in the callback interface of the AJAX program; (6) The JS program initiates an AJAX cross-domain request, merges the token obtained by login into the URL of the HTTP POST request in the URL format, and sends the certificate data to the terminal using the HTTP POST protocol. The terminal receives the HTTP POST request. After the POST request, the POST data is parsed to obtain the AS certificate data. Then, a certificate file is generated and installed on the terminal to complete the AS certificate installation. The installation result is then returned via the HTTP protocol and fed back to the AJAX callback interface of the JS program through the browser. (7) The JS program initiates an AJAX cross-domain HTTP GET request to obtain the certificate application file. After receiving the HTTP GET request, the device generates the application file and returns it to the JS program running in the browser via the HTTP protocol. (8) The JS program will send an HTTP GET request to the AS server using AJAX. After receiving the request, the AS server returns the AS certificate data using the HTTP protocol, obtains the certificate issued by AS, and then installs the AS certificate on the device through the AJAX cross-domain access method described above. (9) After receiving the installation result, the user is prompted that the installation is complete. (10) After the installation is completed, the user can change the device and click the "Issue Certificate" button to realize the quick issuance and installation of the certificate.

[0020] The above are merely preferred embodiments of the present invention. For those skilled in the art, various modifications and refinements can be made without departing from the principles of the present invention, and these modifications and refinements should also be considered within the scope of protection of the present invention.

Claims

1. A method for cross-domain installation of an IoT WAPI terminal entity certificate browser, characterized in that, Including the following step: First, the certificate issuance system is based on IoT WAPI terminals, consoles, and AS servers; the consoles connect to the WAPI terminals and AS servers via a network; the consoles support web browsers and can access the IoT WAPI terminals and AS servers via a network through wired or wireless means. Second, the console allows users to log in and access the AS server via a web browser, configure the WAPI terminal address and user password, as well as the certificate issuance policy on the page; the console has a web browser that supports AJAX and cross-domain browsing (CORS) technologies, and users can log in and access the AS server through the web browser to complete relevant controls; Third, when a user device needs to be issued a certificate, after logging into the AS server in the browser, the user can click the certificate issuance button on the console control page to perform functions such as AS certificate installation, terminal certificate application, terminal certificate issuance and certificate installation on the terminal with one click. Fourth, after clicking "Issue Certificate" in the console, the browser's AJAX and cross-domain access technology are used to initiate cross-domain access to the user's device through the JavaScript program in the web browser webpage via AJAX. The program then logs into the user's device, and uses AJAX to request and download the AS certificate, install the AS certificate, obtain the application documents, issue the terminal certificate, and send the terminal certificate for installation. Finally, the WAPI certificate is installed on the user's device. It automates the entire process from certificate application, certificate issuance, and certificate installation, enabling one-click installation of WAPI physical terminal certificates; The console has a universal browser program that supports Cross-Domain Access (CORS) technology and Asynchronous JavaScript and XML (AJAX) technology; Secondly, a web browser is installed on the AS server, and the web browser service is embedded in the IoT WAPI terminal; the relevant web browser service is accessed by the console using a browser, and data can be processed according to the following procedure. Third, the cross-domain installation process of IoT WAPI terminal entity certificate browser: (1) The user enters the AS server URL in the browser and logs in to the AS server with the administrator account; (2) Enter the issuance page and configure the device address and device user password and other parameters. (3) The user clicks the certificate issuance button on the page, triggering the certificate issuance JavaScript program of the webpage; (4) The JavaScript program uses AJAX to initiate a cross-domain request, and sends the AS server domain name and user password to the user's required device in the form of URL using SHA1 or MD5. After receiving the request, the user's required device verifies the user's password and sets the cross-domain access header to Access-Control-Allow-Origin: AS URL address, and then returns the verification result and access token; (5) After the JS program receives the verification result and it is correct, it uses AJAX to send a request to AS to obtain the AS root certificate; (6) The JS program initiates an AJAX cross-domain request, merges the token obtained by login into the request URL in the form of URL, sends the certificate data to the IoT WAPI terminal, and completes the installation of the IoT WAPI terminal AS certificate; (7) The JS program initiates an AJAX cross-domain request to obtain the certificate application file. The user's device generates the application file and sends it to the JS program running in the browser. (8) The JS program sends the request to the AS server, obtains the certificate issued by AS, and then installs it on the user's device through AJAX cross-domain access. (9) After receiving the installation result, the user is prompted that the installation is complete.

2. The method as described in claim 1, characterized in that, After installation, users can switch to other IoT terminal devices and then click the "Issue Certificate" button to quickly issue and install the certificate.

Images