Method and device for security authentication applied to WiFi

Abstract

The present application provides a method and device for security authentication applied to WiFi. Among them, the access point AP negotiates the pairing master key PMK with the first device based on the double-base cryptographic exponential key exchange TBPEKE protocol according to the password, wherein the password is the shared key between the AP and the first device; the AP performs a 4-way handshake with the first device according to the PMK. Therefore, in the embodiment of the present application, a PMK with a high entropy value can be generated by executing the TBPEKE process, so that the security authentication method provided by the embodiment of the present application can help resist offline dictionary attacks. And because TBPEKE can easily implement side channel attack protection, the embodiment of the present application generates PMK by executing TBPEKE, which can improve the ability of the AP and the first device to prevent side channel attacks during the WiFi security authentication process, and help the AP and the first device avoid side channel attacks during security authentication.

Description

Technical Field

[0001] The present application relates to the field of communications, and more specifically, to a method and device for security authentication applied to wireless fidelity (WiFi). Background Art

[0002] WiFi is a wireless local area network technology created based on the IEEE 80211 standard and is widely used in homes and public places (such as shopping malls, companies, etc.). Security protocols are the foundation of WiFi and control who can use the network. Specifically, the WiFi security protocol enables the supplicant and access point (AP) to authenticate each other and generate a session key and a group transient key (GTK). The session key can be used to protect subsequent unicast communications between the supplicant and the AP, and the group transient key is used to protect the AP's broadcast communications.

[0003] In the WiFi security protocol, the supplicant and AP share a password (pw). The supplicant and AP can derive the pairwise master key (PMK) based on their respective pws, and then the supplicant and AP can perform identity authentication and calculate the pairwise transient key (PTK) based on the PMK, and the AP can pass the multicast key to the supplicant. Among them, the PTK includes the temporary key TK, that is, the session key.

[0004] Currently, the latest WiFi security protocol is the third generation WiFi protected access 3 (WiFi protected access 3, WPA3). In the WPA3 version, both the supplicant and the AP can perform simultaneous authentication of equals (SAE), use a shared low-entropy password to achieve mutual identity authentication and generate a high-entropy shared key to avoid brute force cracking of the password. However, the current WPA3 version cannot effectively prevent side channel attacks or denial of service (DoS) attacks. Summary of the invention

[0005] The present application provides a method and apparatus for security authentication applied to WiFi, which can help an AP and a first device avoid side channel attacks during security authentication.

[0006] In a first aspect, a method for security authentication applied to WiFi is provided. The method can be applied to an access point AP, for example, executed by the AP, or a component (such as a chip or circuit, etc.) that can be configured in the AP.

[0007] In the method, the access point AP negotiates a pairing master key PMK with the first device based on a double-base cryptographic exponential key exchange TBPEKE protocol according to a password, wherein the password is a shared key between the AP and the first device. Then, the AP performs a 4-way handshake with the first device according to the PMK.

[0008] Therefore, in the embodiment of the present application, a PMK with a high entropy value can be generated by executing the TBPEKE process, so that the security authentication method provided in the embodiment of the present application can help resist offline dictionary attacks. And because TBPEKE can easily prevent side channel attacks, the embodiment of the present application generates PMK by executing TBPEKE, which can improve the ability of the AP and the first device to prevent side channel attacks during the WiFi security authentication process, and help the AP and the first device avoid side channel attacks during security authentication.

[0009] Among them, TBPEKE is also a PAKE protocol. In some embodiments, the SAE process in the existing WPA3 security protocol can be replaced with the TBPEKE process to generate a PMK with a high entropy value.

[0010] In combination with the first aspect, in some implementations of the first aspect, the PMK includes a first PMK1 and a second PMK2.

[0011] The AP negotiates the pairing master key PMK with the first device based on the password and the double-base cryptographic exponential key exchange TBPEKE protocol, which can be specifically implemented in the following manner:

[0012] The AP obtains a first parameter X from the first device, wherein the first parameter X is determined according to a hash to curve function g, which is used to convert the password into a point on an elliptic curve by a point multiplication operation, X=g x , where x is a random number. Then, the AP sends the second parameter Y to the first device to instruct the first device to calculate the first PMK1 based on the first parameter X and the second parameter Y, where the second parameter Y is determined based on the hash to curve function g, Y=g y , y is a random number. Afterwards, the AP calculates the second PMK2 according to the first parameter X and the second parameter Y.

[0013] Therefore, in the embodiment of the present application, the first device can send the first parameter X to the AP, and the AP can send the second parameter Y to the first device, wherein the first parameter X and the second parameter Y are respectively determined according to the hashtocurve function g, and then the first device can calculate PMK1 according to the first parameter X and the second parameter Y, and the AP can calculate PMK2 according to the first parameter X and the second parameter Y. In the embodiment of the present application, the first parameter X and the second parameter Y transmitted between the AP and the first device are generated based on the hashtocurve function g and random numbers, and do not involve the calculation of the password, so that it is difficult for an attacker to know the password, thereby improving the ability of the AP and the first device to prevent side channel attacks during the WiFi security authentication process, and helping the AP and the first device to avoid side channel attacks during security authentication.

[0014] In the prior art, when the SAE process is used to calculate PMK in the WPA3 protocol, a shared password is required for calculation. In this way, an attacker can obtain the password through channel testing combined with brute force cracking, thereby causing the password to be leaked.

[0015] In combination with the first aspect, in certain implementations of the first aspect, the access point AP may also associate with the first device to agree on a security suite to be used before negotiating a pairing master key PMK with the first device based on a double-base cryptographic exponential key exchange TBPEKE protocol according to a password, wherein the security suite is used to indicate the hash to curve function g.

[0016] When the first PMK1 and the second PMK2 are the same, the AP and the first device may perform a 4-way handshake based on the PMK.

[0017] In combination with the first aspect, in some implementations of the first aspect, the AP performs a 4-way handshake with the first device according to the PMK, which can be specifically implemented in the following manner:

[0018] The AP sends a first message to the first device, the first message is used to instruct the first device to generate a first pairing temporary key PTK1, the first message includes the AP's one-time random number, the first PTK1 is generated according to the first PMK1, the AP's one-time random number and the first device's one-time random number, the first PTK1 includes the first key confirmation key KCK1, the first key encryption key KEK1 and the first temporary key TK1. Then, the AP obtains a second message from the first device, the second message uses the first KCK1 to protect the integrity of the message, and the second message includes the one-time random number of the first device. The AP generates a second PTK2 according to the second PMK2, the AP's one-time random number and the one-time random number of the first device, the second PTK2 includes the second KCK2, the second KEK2 and the second TK2. Then, the AP sends a third message to the first device, the third message includes the multicast key GTK, the third message uses the second KEK2 to protect the privacy of the GTK, and the second KCK2 to protect the integrity of the message. The AP obtains a fourth message from the first device, the fourth message is used to respond to the third message, and the fourth message uses the second KCK2 to protect the integrity of the message.

[0019] Therefore, the AP and the first device perform a 4-way handshake process based on the PMK, can perform identity authentication, and generate a session key and a multicast key to protect the subsequent unicast communication between the requesting device and the AP, as well as the broadcast communication of the AP.

[0020] It should be noted that when the first PTK1 and the second PTK2 are the same, the AP and the first device can successfully perform a 4-way handshake.

[0021] Optionally, the AP and the first device may also perform an association before performing a 4-way handshake based on the PMK to negotiate a security suite to be used, which may be used to indicate an encryption algorithm used in the 4-way handshake process, as well as other related parameters. Specifically, the association and the 4-way handshake process may refer to the description in the prior art, and will not be described in detail.

[0022] In some embodiments, the requesting device may send a first connection request to the AP, including a first parameter X. Correspondingly, the AP receives the first connection request. In response to the first connection request, the AP may perform the above-mentioned security authentication process with the first device.

[0023] In combination with the first aspect, in some implementations of the first aspect, the AP calculates the second PMK2 based on the first parameter X and the second parameter Y. Specifically, the AP calculates the second PMK2 based on the first parameter X, the second parameter Y, the ID of the first device, and the ID of the AP.

[0024] As an example, the AP can calculate PMK2 according to the following formula:

[0025] PMK2=KDF(Z,id dev ||id AP ||X||Y);

[0026] Among them, for AP, Z = X y , id dev Indicates the ID of the first device, id AP Represents the ID of the AP. KDF() is a standard key derivation function.

[0027] As an example, the ID of the first device may be the MAC address of the first device, and the ID of the AP may be the MAC address of the AP, which is not limited in the present application.

[0028] In some optional embodiments, the AP may also send a broadcast message, wherein the broadcast message includes the ID of the AP. Correspondingly, the requesting device may receive the broadcast message and obtain the ID of the AP therefrom.

[0029] In combination with the first aspect, in some implementations of the first aspect, the hash-to-curve function g is expressed as:

[0030] g=U·V pw ;

[0031] Wherein, U and V are two independent random generators obtained from a cyclic group G whose order is a prime number p, and pw represents the password.

[0032] Here, the hashtocurve function g is the function obtained according to TBPEKE.

[0033] Optionally, the broadcast message may also include RSNEwithsupp.ciphers to notify the capabilities of the ciphers. Accordingly, the first device selects matching ciphers, that is, selects the cryptographic suite it supports, to obtain the above-mentioned g, or related parameters for obtaining g (such as U, V, etc.). After the first device selects the cryptographic suite, g, or U, V can be saved as system parameters on the first device side. Here, the AP broadcasts RSNEwithsupp ciphers, and the first device selects matching ciphers, which is an example of the AP and the first device associating and negotiating the security suite to be used.

[0034] In combination with the first aspect, in some implementations of the first aspect, the hash-to-curve function g is pre-stored locally in the AP.

[0035] That is, the AP can keep g = U·Vpw , rather than the password pw. Therefore, the embodiment of the present application directly stores g=U·V pw , instead of the password pw, can avoid the AP from calculating g in real time when authenticating the device, thereby reducing the amount of calculation on the AP side, and further helping to reduce or avoid denial of service (DoS) attacks on the AP.

[0036] In combination with the first aspect, in some implementations of the first aspect, the second parameter Y is generated by the AP according to the hash-to-curve function g. That is, when the AP receives the first parameter X sent by the first device, the AP can generate the second parameter Y according to the pre-saved hash-to-curve function g, without generating the hash-to-curve function g according to the password pw.

[0037] Alternatively, in some implementations, the second parameter Y is determined by the AP by reusing the second parameter Y sent to the second device. In addition, since Y=g y Therefore, the AP end reuses the second parameter Y, which is equivalent to the AP end reuses the random number y, and this application does not limit this.

[0038] Therefore, the embodiment of the present application can avoid the AP from calculating the second parameter Y in real time when authenticating the device by reusing the second parameter Y or the random number y on the AP side, thereby reducing the amount of calculation on the AP side, and further helping to reduce or avoid DoS attacks on the AP.

[0039] In combination with the first aspect, in some implementations of the first aspect, before the AP sends the second parameter Y to the first device, it may also obtain an identification ID of the first device from the first device, and then send a token for the anti-DoS service to the first device. The token is determined based on the ID of the first device and a key k. Then, the AP receives the token and the ID of the first device from the first device, and verifies the token based on the ID of the first device and the key k.

[0040] When the credential sent by the first device passes the verification, the AP processes the connection request of the first device. When the credential does not pass the verification, the AP does not process the connection request of the first device.

[0041] Therefore, in an embodiment of the present application, the AP can send an anti-DoS token bound to the ID of the first device to the first device, and the first device needs to send its ID and the token to the AP again, so that the AP can verify the received ID of the first device and the corresponding token, and only process the connection request of the first device when the token passes the verification, which can help avoid the AP from processing all connection requests, and further help reduce or avoid DoS attacks on the AP.

[0042] As an example, the first device may send a second connection request to the AP, which may include the first parameter X, the identification ID of the first device and the above-mentioned credential. Correspondingly, the AP receives the second connection request.

[0043] As an example, the identification ID of the first device may be a MAC address of the first device. The data frame format of the second connection request may include the MAC address of the first device.

[0044] In combination with the first aspect, in certain implementations of the first aspect, before sending the second parameter Y to the first device, it can also be determined that the ID of the first device is not included in the first list, wherein the first list includes the ID of at least one device connected to the network provided by the AP.

[0045] As an example, the first list may be a DEVinPROC list.

[0046] Therefore, in the embodiment of the present application, the AP will further process the connection request of the first device only when it determines that the ID of the first device is not in the first list. This can help avoid the AP from processing all connection requests, help reduce the amount of calculation on the AP side, and further help reduce or avoid DoS attacks on the AP.

[0047] In combination with the first aspect, in some implementations of the first aspect, the ID of the first device may be further added to the first list.

[0048] In this way, the first list can be updated. Further, when the AP receives the connection request containing the ID of the first device later, since the ID is already included in the first list, the AP may not process the connection request, thereby helping to reduce or avoid DoS attacks on the AP.

[0049] In a second aspect, a method for security authentication applied to WiFi is provided. The method can be applied to a first device, for example, executed by the first device, or a component (such as a chip or circuit, etc.) that can be configured in the first device.

[0050] In the method, the first device negotiates a pairing master key PMK with an access point AP based on a double-base cryptographic exponential key exchange (TBPEKE) protocol according to a password, wherein the password is a shared key between the AP and the first device. Then, the first device performs a 4-way handshake with the AP according to the PMK.

[0051] In combination with the second aspect, in some implementations of the second aspect, the PMK includes a first PMK1 and a second PMK2, and the first device negotiates a pairing master key PMK with the access point AP based on a double-base cryptographic exponential key exchange TBPEKE protocol according to a password, which can be specifically implemented in the following manner:

[0052] The first device sends a first parameter X to the AP, wherein the first parameter X is determined according to a hash-to-curve function g, and the hash-to-curve function g is used to convert the password into a point on an elliptic curve by a point multiplication operation, X=g x , where x is a random number; the first device obtains a second parameter Y from the AP, where the second parameter Y is determined according to the hash to curve function g, Y = g y , y is a random number, wherein the first parameter X and the second parameter Y are used by the AP to calculate the second PMK2; the first device calculates the first PMK1 according to the first parameter X and the second parameter Y.

[0053] In combination with the second aspect, in certain implementations of the second aspect, the first device may also associate with the AP to agree on a security suite to be used before negotiating a pairing master key PMK with the AP based on a double-base cryptographic exponential key exchange TBPEKE protocol according to a password, wherein the security suite is used to indicate the hash to curve function g.

[0054] In combination with the second aspect, in some implementations of the second aspect, the first device performs a 4-way handshake with the AP according to the PMK, which can be specifically implemented in the following manner:

[0055] The first device receives a first message from an AP, the first message including a one-time random number of the AP; the first device generates a first pairing temporary key PTK1 according to the first PMK1, the one-time random number of the AP, and the one-time random number of the first device, the first PTK1 including a first key confirmation key KCK1, a first key encryption key KEK1, and a first temporary key TK1. The first device sends a second message to the AP, the second message uses the first KCK1 to protect the integrity of the message, the second message includes the one-time random number of the first device, the second message is used to instruct the AP to generate a second PTK2, the second PTK2 is generated according to the second PMK2, the one-time random number of the AP, and the one-time random number of the first device, the second PTK2 includes a second KCK2, a second KEK2, and a second TK2; the first device obtains a third message from the AP, the third message includes a multicast key GTK, the third message uses the second KEK2 to protect the privacy of the GTK, and uses the second KCK2 to protect the integrity of the message; the first device sends a fourth message to the AP, the fourth message is used to respond to the third message, and the fourth message uses KCK to protect the integrity of the message.

[0056] In conjunction with the second aspect, in some implementations of the second aspect, the hash-to-curve function g is expressed as:

[0057] g=U·V pw ;

[0058] Wherein, U and V are two independent random generators obtained from a cyclic group G whose order is a prime number p, and pw represents the password.

[0059] In conjunction with the second aspect, in some implementations of the second aspect, before receiving the second parameter Y from the AP, the identification ID of the first device may be sent to the AP, and then a credential for anti-denial of service DoS service may be received from the AP, where the credential is generated based on the key k and the ID of the first device. Then, the credential and the ID of the requesting device may be sent to the AP.

[0060] In combination with the second aspect, in some implementations of the second aspect, the ID of the first device includes a MAC address of the first device.

[0061] In a third aspect, a device for security authentication applied to WiFi is provided, which is used to execute the method in the first aspect or any possible implementation of the first aspect. Specifically, the device includes a unit or module for executing the method in the first aspect or any possible implementation of the first aspect. For example, the device includes a processing unit and a transceiver unit.

[0062] The processing unit may negotiate a pairing master key PMK with the first device based on a double base cryptographic exponential key exchange TBPEKE protocol according to a password, wherein the password is a shared key between the AP and the first device. Exemplarily, the processing unit may negotiate with the first device through a transceiver unit.

[0063] The processing unit may also perform a 4-way handshake with the first device according to the PMK. Exemplarily, the processing unit may perform a 4-way handshake with the first device through a transceiver unit.

[0064] In combination with the third aspect, in some implementations of the third aspect, the PMK includes a first PMK1 and a second PMK2.

[0065] The transceiver unit is used to obtain a first parameter X from the first device, wherein the first parameter X is determined according to a hash to curve function g, and the hash to curve function g is used to convert the password into a point on an elliptic curve by a point multiplication operation, X=g x , where x is a random number.

[0066] The transceiver unit is further configured to send a second parameter Y to the first device to instruct the first device to calculate the first PMK1 according to the first parameter X and a second parameter Y, wherein the second parameter Y is determined according to the hash-to-curve function g, and Y=g y , y is a random number,

[0067] The processing unit is configured to calculate the second PMK2 according to the first parameter X and the second parameter Y acquired by the transceiver unit.

[0068] In combination with the third aspect, in some implementations of the third aspect, the processing unit is further used to associate with the first device to negotiate a security suite to be used, wherein the security suite is used to indicate the hash to curve function g.

[0069] In conjunction with the third aspect, in some implementations of the third aspect,

[0070] The transceiver unit is used to send a first message to the first device, where the first message is used to instruct the first device to generate a first pairing temporary key PTK1. The first message includes a one-time random number of the AP. The first PTK1 is generated based on the first PMK1, the one-time random number of the AP and the one-time random number of the first device. The first PTK1 includes a first key confirmation key KCK1, a first key encryption key KEK1 and a first temporary key TK1.

[0071] The transceiver unit is further used to obtain a second message from the first device, where the second message uses the first KCK1 to protect the integrity of the message, and the second message includes a one-time random number of the first device.

[0072] The processing unit is further configured to generate the second PTK2 according to the second PMK2, the one-time random number of the AP and the one-time random number of the first device, wherein the second PTK2 includes a second KCK2, a second KEK2 and a second TK2.

[0073] The transceiver unit is also used to send a third message to the first device, the third message includes the multicast key GTK, the third message uses the second KEK2 to protect the privacy of the GTK, and uses the second KCK2 to protect the integrity of the message.

[0074] The transceiver unit is also used to obtain a fourth message from the first device, where the fourth message is used to respond to the third message, and the fourth message uses the second KCK2 to protect the integrity of the message.

[0075] In conjunction with the third aspect, in some implementations of the third aspect, the hash-to-curve function g is expressed as:

[0076] g=U·V pw ;

[0077] Wherein, U and V are two independent random generators obtained from a cyclic group G whose order is a prime number p, and pw represents the password.

[0078] In combination with the third aspect, in some implementations of the third aspect, the hash-to-curve function g is pre-stored locally in the AP.

[0079] In combination with the third aspect, in some implementations of the third aspect, the second parameter Y is generated by the AP according to the hash to curve function g; or the second parameter Y is determined by the AP by reusing the second parameter Y sent to the second device.

[0080] In combination with the third aspect, in certain implementations of the third aspect, the transceiver unit is also used to obtain an identification ID of the first device from the first device, and to send a credential for anti-DoS service to the first device, wherein the credential is determined based on the identification ID and key k of the first device.

[0081] The transceiver unit is further configured to obtain the credential and the ID of the first device from the first device.

[0082] The processing unit is further configured to verify the credential according to the ID of the first device and the key k.

[0083] In combination with the third aspect, in some implementations of the third aspect, the processing unit is further used to determine that the ID of the first device is not included in the first list, wherein the first list includes the ID of at least one device connected to the network provided by the AP.

[0084] In combination with the third aspect, in some implementations of the third aspect, the processing unit is further used to add the ID of the first device to the first list.

[0085] In combination with the third aspect, in some implementations of the third aspect, the ID of the first device includes a MAC address of the first device.

[0086] In a fourth aspect, a device for security authentication applied to WiFi is provided, which is used to execute the method in the second aspect or any possible implementation of the second aspect. Specifically, the device includes a unit or module for executing the method in the second aspect or any possible implementation of the second aspect. For example, the device includes a processing unit and a transceiver unit.

[0087] The processing unit may negotiate a pairing master key PMK with the access point AP based on a double base cryptographic exponential key exchange TBPEKE protocol according to a password, wherein the password is a shared key between the AP and the first device. Exemplarily, the processing unit may negotiate with the AP through a transceiver unit.

[0088] The processing unit may also perform a 4-way handshake with the AP according to the PMK. Exemplarily, the processing unit may perform a 4-way handshake with the first device through a transceiver unit.

[0089] In combination with the fourth aspect, in some implementations of the fourth aspect, the PMK includes a first PMK1 and a second PMK2.

[0090] The transceiver unit is used to send a first parameter X to the AP, wherein the first parameter X is determined according to a hash to curve function g, and the hash to curve function g is used to convert the password into a point on an elliptic curve by a point multiplication operation, X=g x , where x is a random number.

[0091] The transceiver unit is also used to obtain a second parameter Y from the AP, wherein the second parameter Y is determined according to the hash to curve function g, Y = g y , y is a random number, wherein the first parameter X and the second parameter Y are used by the AP to calculate the second PMK2.

[0092] The processing unit is configured to calculate a first PMK1 according to the first parameter X and the second parameter Y.

[0093] In combination with the fourth aspect, in some implementations of the fourth aspect, the processing unit is further used to associate with the AP to negotiate a security suite to be used, wherein the security suite is used to indicate the hash to curve function g.

[0094] In conjunction with the fourth aspect, in some implementations of the fourth aspect,

[0095] The transceiver unit is further configured to receive a first message from the AP, where the first message includes a one-time random number of the AP.

[0096] The processing unit is also used for the first device to generate a first pairing temporary key PTK1 based on the first PMK1, the one-time random number of the AP, and the one-time random number of the first device. The first PTK1 includes a first key confirmation key KCK1, a first key encryption key KEK1 and a first temporary key TK1.

[0097] The transceiver unit is also used to send a second message to the AP, the second message uses the first KCK1 to protect the integrity of the message, the second message includes the one-time random number of the first device, the second message is used to instruct the AP to generate a second PTK2, the second PTK2 is generated based on the second PMK2, the one-time random number of the AP and the one-time random number of the first device, and the second PTK2 includes a second KCK2, a second KEK2 and a second TK2.

[0098] The transceiver unit is further used to obtain a third message from the AP, the third message includes a multicast key GTK, the third message uses the second KEK2 to protect the privacy of the GTK, and uses the second KCK2 to protect the integrity of the message.

[0099] The transceiver unit is also used to send a fourth message to the AP, where the fourth message is used to respond to the third message, and the fourth message uses KCK to protect the integrity of the message.

[0100] In conjunction with the fourth aspect, in some implementations of the fourth aspect, the hash-to-curve function g is expressed as:

[0101] g=U·V pw ;

[0102] Wherein, U and V are two independent random generators obtained from a cyclic group G whose order is a prime number p, and pw represents the password.

[0103] In combination with the fourth aspect, in some implementations of the fourth aspect, the transceiver unit is further used to send an identification ID of the first device to the AP.

[0104] The transceiver unit is further used to receive a certificate for anti-denial of service DoS service from the AP, where the certificate is generated according to the key k and the ID of the first device;

[0105] The transceiver unit is further configured to send the credential and the ID of the requesting device to the AP.

[0106] In combination with the fourth aspect, in some implementations of the fourth aspect, the ID of the first device includes a MAC address of the first device.

[0107] In a fifth aspect, a device for security authentication applied to WiFi is provided, comprising: a processor and a transceiver. Optionally, a memory may also be included. The memory is used to store instructions, and the processor is used to execute the instructions stored in the memory, and when the processor executes the instructions stored in the memory, the execution causes the processor to execute the method in the first aspect or any possible implementation of the first aspect.

[0108] The processor is coupled to the transceiver, and is used to negotiate a pairing master key PMK with the first device based on a double-base cryptographic exponential key exchange TBPEKE protocol according to a password, wherein the password is a shared key between the AP and the first device, and perform a 4-way handshake with the first device according to the PMK.

[0109] In combination with the fifth aspect, in some implementations of the fifth aspect, the PMK includes a first PMK1 and a second PMK2, wherein the processor is specifically used to instruct the transceiver to obtain a first parameter X from the first device, wherein the first parameter X is determined according to a hash to curve function g, and the hash to curve function g is used to convert the password into a point on an elliptic curve through a point multiplication operation, X=g x , wherein x is a random number; and instructing the transceiver to send a second parameter Y to the first device to instruct the first device to calculate the first PMK1 according to the first parameter X and the second parameter Y, wherein the second parameter Y is determined according to the hash to curve function g, Y=g y , y is a random number; and according to the first parameter X and the second parameter Y, the second PMK2 is calculated.

[0110] In combination with the fifth aspect, in some implementations of the fifth aspect, the processor is further used to associate with the first device to negotiate a security suite to be used, wherein the security suite is used to indicate the hash to curve function g.

[0111] In combination with the fifth aspect, in certain implementations of the fifth aspect, the processor is also used to instruct the transceiver to send a first message to the first device, the first message being used to instruct the first device to generate a first pairing temporary key PTK1, the first message including a one-time random number of the AP, the first PTK1 being generated based on the first PMK1, the one-time random number of the AP and the one-time random number of the first device, the first PTK1 including a first key confirmation key KCK1, a first key encryption key KEK1 and a first temporary key TK1.

[0112] The processor is also used to instruct the transceiver to obtain a second message from the first device, the second message uses the first KCK1 to protect the integrity of the message, and the second message includes a one-time random number of the first device; the second PTK2 is generated according to the second PMK2, the one-time random number of the AP and the one-time random number of the first device, and the second PTK2 includes a second KCK2, a second KEK2 and a second TK2.

[0113] The processor is also used to instruct the transceiver to send a third message to the first device, where the third message includes a multicast key GTK, and the third message uses the second KEK2 to protect the privacy of the GTK and uses the second KCK2 to protect the integrity of the message.

[0114] The processor is also used to instruct the transceiver to obtain a fourth message from the first device, where the fourth message is used to respond to the third message, and the fourth message uses the second KCK2 to protect the integrity of the message.

[0115] In conjunction with the fifth aspect, in some implementations of the fifth aspect, the hash-to-curve function g is expressed as:

[0116] g=U·V pw ;

[0117] Wherein, U and V are two independent random generators obtained from a cyclic group G whose order is a prime number p, and pw represents the password.

[0118] In combination with the fifth aspect, in some implementations of the fifth aspect, the hash-to-curve function g is pre-stored locally in the AP.

[0119] In combination with the fifth aspect, in certain implementations of the fifth aspect, the second parameter Y is generated by the AP according to the hash to curve function g; or the second parameter Y is determined by the AP by reusing the second parameter Y sent to the second device.

[0120] In combination with the fifth aspect, in certain implementations of the fifth aspect, the processor is also used to instruct the transceiver to obtain an identification ID of the first device from the first device, and to instruct the transceiver to send a credential for anti-DoS service to the first device, wherein the credential is determined based on the identification ID and key k of the first device.

[0121] The processor is further configured to instruct the transceiver to obtain the credential and the ID of the first device from the first device, and verify the credential according to the ID of the first device and the key k.

[0122] In combination with the fifth aspect, in certain implementations of the fifth aspect, the processor is further used to determine that the ID of the first device is not included in the first list, wherein the first list includes the ID of at least one device connected to the network provided by the AP.

[0123] In combination with the fifth aspect, in certain implementations of the fifth aspect, the processor is further used to add an ID of the first device to the first list.

[0124] In combination with the fifth aspect, in certain implementations of the fifth aspect, the ID of the first device includes a MAC address of the first device.

[0125] In a sixth aspect, a device for security authentication applied to WiFi is provided, comprising: a processor and a transceiver. Optionally, a memory may also be included. The memory is used to store instructions, and the processor is used to execute the instructions stored in the memory, and when the processor executes the instructions stored in the memory, the execution causes the processor to execute the method in the second aspect or any possible implementation of the second aspect.

[0126] The processor is coupled to the transceiver, and is used to negotiate a pairing master key PMK with an access point AP based on a double-base cryptographic exponential key exchange TBPEKE protocol according to a password, wherein the password is a shared key between the AP and the first device; and perform a 4-way handshake with the AP according to the PMK.

[0127] In combination with the sixth aspect, in some implementations of the sixth aspect, the PMK includes a first PMK1 and a second PMK2.

[0128] The processor is specifically used to instruct the transceiver to send a first parameter X to the AP, wherein the first parameter X is determined according to a hash to curve function g, and the hash to curve function g is used to convert the password into a point on an elliptic curve through a point multiplication operation, X=g x , where x is a random number.

[0129] The processor is further configured to instruct the transceiver to obtain a second parameter Y from the AP, wherein the second parameter Y is determined according to the hash-to-curve function g, where Y=g y , y is a random number, wherein the first parameter X and the second parameter Y are used by the AP to calculate the second PMK2.

[0130] The processor is further configured to calculate a first PMK1 according to the first parameter X and the second parameter Y.

[0131] In combination with the sixth aspect, in some implementations of the sixth aspect, the processor is further used to associate with the AP to negotiate a security suite to be used, wherein the security suite is used to indicate the hash to curve function g.

[0132] In combination with the sixth aspect, in certain implementations of the sixth aspect, the processor is also used to instruct the transceiver to receive a first message from the AP, the first message including a one-time random number of the AP; generate a first pairing temporary key PTK1 based on the first PMK1, the one-time random number of the AP, and the one-time random number of the first device, the first PTK1 including a first key confirmation key KCK1, a first key encryption key KEK1 and a first temporary key TK1.

[0133] The processor is also used to instruct the transceiver to send a second message to the AP, the second message uses the first KCK1 to protect the integrity of the message, the second message includes the one-time random number of the first device, the second message is used to instruct the AP to generate a second PTK2, the second PTK2 is generated based on the second PMK2, the one-time random number of the AP and the one-time random number of the first device, and the second PTK2 includes a second KCK2, a second KEK2 and a second TK2.

[0134] The processor is also used to instruct the transceiver to obtain a third message from the AP, where the third message includes a multicast key GTK, and the third message uses the second KEK2 to protect the privacy of the GTK and uses the second KCK2 to protect the integrity of the message.

[0135] The processor is also used to instruct the transceiver to send a fourth message to the AP, where the fourth message is used to respond to the third message, and the fourth message uses KCK to protect the integrity of the message.

[0136] In conjunction with the sixth aspect, in some implementations of the sixth aspect, the hash-to-curve function g is expressed as:

[0137] g=U·V pw ;

[0138] Wherein, U and V are two independent random generators obtained from a cyclic group G whose order is a prime number p, and pw represents the password.

[0139] In combination with the sixth aspect, in some implementations of the sixth aspect, the processor is further used to instruct the transceiver to send an identification ID of the first device to the AP.

[0140] The processor is further configured to instruct the transceiver to receive a credential for an anti-denial of service (DoS) service from the AP, where the credential is generated based on a key k and the ID of the first device.

[0141] The processor is further configured to instruct the transceiver to send the credential and the ID of the requesting device to the AP.

[0142] In combination with the sixth aspect, in certain implementations of the sixth aspect, the ID of the first device includes a MAC address of the first device.

[0143] In the seventh aspect, a chip for security authentication applied to WiFi is provided, comprising a processor and a communication interface, wherein the processor is used to call and run instructions from the communication interface, and when the processor executes the instructions, the method of any aspect of the first to second aspects or any possible implementation of any aspect is implemented.

[0144] Optionally, the chip may further include a memory, in which instructions are stored, and the processor is used to execute the instructions stored in the memory or instructions from other sources. When the instructions are executed, the processor is used to implement the method in any aspect of the first to second aspects or any possible implementation of any aspect.

[0145] In an eighth aspect, a computer-readable medium is provided for storing a computer program, wherein the computer program includes instructions for executing the method in any one of the first to second aspects or any possible implementation of any one of the aspects.

[0146] In a ninth aspect, an embodiment of the present application further provides a computer program product comprising instructions, which, when executed on a computer, enables the computer to execute a method in any one of the first to second aspects or any possible implementation of any one of the aspects.

[0147] In the tenth aspect, a communication system is provided, which includes a device having functions for implementing the methods and various possible designs of the first aspect, and the device having functions for implementing the methods and various possible designs of the second aspect.

[0148] It should be understood that the beneficial effects achieved by the second to tenth aspects of the present application and the corresponding implementation methods refer to the beneficial effects achieved by the first aspect of the present application and the corresponding implementation methods, and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0149] Figure 1 It is a schematic flow chart of a method for WiFi-based security authentication;

[0150] Figure 2 is a schematic flow chart of a method for security authentication based on WPA3;

[0151] Figure 3 It is a schematic diagram of an application scenario of an embodiment of the present application;

[0152] Figure 4 is a schematic flow chart of a method for security authentication applied to WiFi provided in an embodiment of the present application;

[0153] Figure 5 is an example of TBPEKE’s process;

[0154] Figure 6 is a schematic flow chart of a method for security authentication applied to WiFi provided in an embodiment of the present application;

[0155] Figure 7 is a schematic flow chart of another method for security authentication applied to WiFi provided in an embodiment of the present application;

[0156] Figure 8 is a schematic flow chart of another method for security authentication applied to WiFi provided in an embodiment of the present application;

[0157] Fig. 9 is a schematic flow chart of another method for security authentication applied to WiFi provided in an embodiment of the present application;

[0158] Fig.10 A schematic diagram of a device for security authentication applied to WiFi provided in an embodiment of the present application. DETAILED DESCRIPTION

[0159] The technical solution in this application will be described below in conjunction with the accompanying drawings.

[0160] Figure 1 FIG. 1 is a schematic flow chart of a method 100 for WiFi-based security authentication. Figure 1In the present invention, the WiFi security protocol can be the second generation WiFi protected access 2 (WiFi protected access 2, WPA2) version, or a version before WPA2, such as wired equivalent privacy (wired equivalent privacy, WEP), second generation WEP (WEP2), WPA, etc., without limitation.

[0161] Figure 1 The process shown in can also be called a security protocol process. Figure 1 As shown, method 100 is performed by a requesting device (which may also be replaced by a supplicant) and an AP. The AP may provide a network based on a WiFi protocol, and the requesting device is a terminal device that requests to use the network provided by the AP. The AP and the requesting device share a password pw. Figure 1 The method 100 may include steps 101 to 109. Steps 104 to 109 may be referred to as a 4-way handshake process.

[0162] 101, the requesting device and the AP are associated. Here, the requesting device and the AP may negotiate a security suite to be used through association. Exemplarily, the security suite may indicate the relevant encryption algorithms used between the requesting device and the AP, as well as other relevant parameters.

[0163] 102, the requesting device generates a PMK. Exemplarily, the requesting device may derive the PMK based on the pw shared by the requesting device and the AP. Optionally, the requesting device may also obtain the PMK based on the media access control (MAC) addresses of the requesting device and the AP, which is not limited in this application.

[0164] 103, AP generates PMK. Exemplarily, AP can derive PMK based on the pw shared by both the requesting device and AP. Optionally, AP can also obtain PMK based on the MAC addresses of both the requesting device and AP, which is not limited in this application.

[0165] In some embodiments, when the PMK generated by the requesting device is the same as the PMK generated by the AP, the AP and the first device may perform a 4-way handshake based on the PMK.

[0166] 104. The AP sends Msg1 (r, anonce) to the requesting device. Correspondingly, the requesting device receives the Msg1 (r, anonce). Here, Msg1 represents message 1, anonce represents a one-time random number of the AP, and r represents the count of the counter.

[0167] 105, request the device to derive PTK.

[0168] Exemplarily, the requesting device may select a one-time random number (expressed as snonce) and generate a PTK based on PMK, anonce, and snonce. Optionally, the requesting device may also generate a PTK based on PMK, anonce, snonce, and the MAC addresses of both the requesting device and the AP, which is not limited in this application.

[0169] Exemplarily, PTK includes three parts, namely key confirmation key (KCK), key encryption key (KEK) and transient key (TK). KCK is used to protect the privacy of messages during the 4-way handshake process, KEK is used to protect the integrity of messages during the 4-way handshake process, and TK is the real session key, which is used to protect the subsequent communication between the requesting device and the AP.

[0170] 106, the requesting device sends Msg2 ({r, snonce} KCK Correspondingly, the AP receives the Msg2({r, snonce} KCK Here, Msg2 represents message 2, where Msg2 uses KCK to protect the integrity of the message.

[0171] 107,AP derivePTK.

[0172] Exemplarily, the AP may generate the PTK based on the PMK, anonce, and snonce. Optionally, the AP may also generate the PTK based on the PMK, anonce, snonce, and the MAC addresses of both the requesting device and the AP, which is not limited in this application.

[0173] In some embodiments, the PTK generated by the requesting device is the same as the PTK generated by the AP. When the PTK generated by the requesting device is the same as the PTK generated by the AP, the following process is performed.

[0174] 108, AP sends Msg3({r+1, anonce, {GTK} KEK} KCK Correspondingly, the AP receives the Msg3({r+1, anonce, {GTK} KEK} KCKHere, Msg3 represents message 3, and GTK represents the multicast key. Msg3 uses KEK to protect the privacy of GTK, and uses KCK to protect the integrity of the entire message of Msg3.

[0175] 108, the requesting device sends Msg4({r+1} KCK ). Correspondingly, the AP receives the Msg4({r+1} KCK Here, Msg4 represents message 4. Msg4 uses KCK to protect the integrity of the message.

[0176] Specifically, the steps 101 to 108 may refer to the description in the prior art and will not be described in detail.

[0177] As can be seen from the above description, the AP and the requesting device can perform identity authentication and generate session keys and multicast keys through the 4-way handshake process to protect the subsequent unicast communication between the requesting device and the AP, as well as the broadcast communication of the AP.

[0178] In the above method 100, PMK is calculated from the password pw (or the MAC addresses of both parties), and a significant feature of the password pw is that it is short, i.e., has a low entropy value. Therefore, if an attacker intercepts the 4-way handshake message during the key generation process, the attacker may obtain the password by brute force, thereby threatening network security.

[0179] In order to solve the hidden danger that attackers may brute-force crack the password pw in WPA2 and previous WiFi security protocol versions, the WPA3 version executes the SAE process to generate a high-entropy PMK before the traditional security protocol process (such as association and 4-way handshake process), which helps to avoid brute-force cracking of the password. Among them, SAE is a password-based password authentication and key exchange (PAKE) protocol.

[0180] Figure 2 A schematic flow chart of a method 200 for security authentication based on WPA3 is shown. The method 200 may include a requesting device and an AP generating a PMK, an association, and a 4-way handshake process. Figure 2 In the example, a high entropy PMK is generated by executing the SAE process (i.e., step 210), wherein the SAE is implemented on an elliptic curve. Figure 2 In the description, Alice (e.g., a client) and Bob (e.g., an AP) perform the SAE process as an example. Figure 2As shown, step 210 includes steps 211 to 220 .

[0181] 211, Alice picks a random number r A and m A , calculate s A =(r A +m A )modq,E A =-m A ·P.

[0182] 212, Bob picks a random number r B and m B , calculate s B =(r B +m B )modq,E B =-m B ·P.

[0183] Wherein, P is a point on the corresponding elliptic curve, and can be derived from the password pw, and the MAC addresses of the supplicant and the AP. Here, the calculation process of generating P from the password pw can be called a hash-to-curve function.

[0184] 213, Alice submits auth-commit to Bob (s A , E A ).

[0185] 214, Bob submits auth-commit to Alice (s B , E B ).

[0186] 215, Alice verifies B and E B , calculate K = r A (s B ·P+E B ),κ=hash(K),tr=(s A , E A ,s B , E B ), c A =HMAC(κ, tr). Among them, κ=hash(K) can be used as PMK.

[0187] 216, Bob verifies A and E A , calculate K = r B (sA ·P+E A ),κ=hash(K),tr=(s B , E B ,s A , E A ), c B =HMAC(κ, tr). Among them, κ=hash(K) can be used as PMK.

[0188] 217, Alice submits c to Bob for verification A .

[0189] 218, Bob submits c to Alice for verification B .

[0190] 219, Alice verifies c B .

[0191] 220, Bob verifies c A .

[0192] When c B and c A After both pass the verification, Alice and Bob can use their respective calculated κ values ​​as PMK.

[0193] However, in the above SAE process, since the shared password pw is required to be used in the process of calculating P, an attacker can obtain pw through channel testing combined with brute force cracking and other means, thereby causing password leakage. In view of this, an embodiment of the present application provides a communication scheme, in which the AP and the first device (e.g., the requesting device) negotiate the pairing master key PMK based on the double-base cryptographic exponential key exchange TBPEKE protocol according to the password, and perform a 4-way handshake based on the PMK. Since TBPEKE can easily prevent side channel attacks, the embodiment of the present application generates PMK by executing TBPEKE, which can improve the ability of the AP and the first device to prevent side channel attacks during the WiFi security authentication process, thereby helping the AP and the first device to avoid side channel attacks during security authentication.

[0194] Figure 3 A schematic diagram of an application scenario of the embodiment of the present application is shown. Figure 3 As shown, multiple requesting devices (e.g., requesting device 1, requesting device 2, and requesting device 3) can be securely connected to the AP and use WiFi network resources through the AP. Each requesting device executes a security protocol with the AP, performs mutual authentication, and negotiates a key to protect the communication channel between the two. Here, different requesting devices can use the same password to execute a security protocol with the AP. Here, the requesting device can be, for example, the first device.

[0195] It should be understood that Figure 3 An example of a system applied to an embodiment of the present application is shown, but the present application is not limited thereto. For example, one, two, four or more requesting devices may be connected to the AP, which are all within the protection scope of the embodiment of the present application.

[0196] The method and device for security authentication applied to WiFi provided by the present application will be described in detail below with reference to the accompanying drawings.

[0197] The technical solution of the present application can be applied to WiFi communication systems, for example, Figure 3 The communication system shown in . Devices in the WiFi communication system may have a wireless communication connection relationship. One of the devices may be, for example, an AP, or a chip configured in the AP, and the other device may be, for example, a first device, or a chip configured in the first device. The embodiments of the present application are not limited to this.

[0198] The following will take the security authentication process of the AP and the first device as an example to explain the embodiments of the present application in detail. It can be understood that the chip configured in the AP and the chip configured in the first device can perform security authentication based on the same method. This application does not limit this.

[0199] Figure 4 A schematic flow chart of a method 400 for security authentication applied to WiFi provided by an embodiment of the present application is shown. The method 400 may include steps 410 to 430.

[0200] 410, the AP and the first device may negotiate the PMK (i.e., generate the PMK) based on the twin base password encrypted key exchange (TBPEKE) protocol according to the password. The password is a shared key between the AP and the first device. Figure 4 In WPA3, the TBPEKE protocol can be used to replace the SAE protocol in WPA3.

[0201] 420. The AP associates with the first device according to the PMK.

[0202] 430. The AP performs a 4-way handshake with the first device.

[0203] Here, steps 420 and 430 can refer to Figure 1 The description in will not be repeated here.

[0204] Therefore, in the embodiment of the present application, a PMK with a high entropy value can be generated by executing the TBPEKE process, so that the security authentication method provided in the embodiment of the present application can help resist offline dictionary attacks. And because TBPEKE can easily prevent side channel attacks, the embodiment of the present application generates PMK by executing TBPEKE, which can improve the ability of the AP and the first device to prevent side channel attacks during the WiFi security authentication process, and help the AP and the first device avoid side channel attacks during security authentication.

[0205] Among them, TBPEKE is also a PAKE protocol. Figure 5 An example of the TBPEKE process is shown. Figure 5 As shown in Figure 1, the public parameters of the two communicating parties A and B in TBPEKE include: a cyclic group G of prime order p, two independent random generators U and V in the group (denoted as U, ), and output {0, 1} l The hash function H(ahash function onto {0, 1} l , represented by H:{0,1}*→{0,1} l ). Wherein, H:{0,1}*→{0,1} is a secure hash function, such as SHA256.

[0206] In TBPEKE, A and B share a password pw. Based on the public parameters and the password pw, A can calculate:

[0207] g←U·V pw , X←g x

[0208] Then, A sends A||X to B.

[0209] B can also calculate based on the public parameters and password pw:

[0210] g←U·V pw , Y←g y

[0211] Then, B sends Y to A.

[0212] After receiving Y, A can calculate: Z←Y x .

[0213] After receiving A||X, B can calculate: Z←X y .

[0214] Then, A and B can respectively calculate the key sk according to A, B, g, X, Y, and Z. Exemplarily, sk can be calculated according to the following formula:

[0215] sk←H(A||B||g||X||Y||Z).

[0216] It should be noted that when G represents an elliptic curve group, then g = U·V pw It can be regarded as a hash-to-curve function that converts the password pw into a point on the elliptic curve. In the hash-to-curve function g, for pw, a point multiplication operation is involved. Among them, the point multiplication operation can effectively resist side channel attacks.

[0217] In the embodiment of the present application, the first parameter X and the second parameter Y transmitted between the AP and the first device are generated based on the hashtocurve function g and a random number, and do not involve the calculation of the password pw, so that it is difficult for an attacker to know the password pw, thereby improving the ability of the AP and the first device to prevent side channel attacks during the WiFi security authentication process.

[0218] In the prior art, when the SAE process is used to calculate PMK in the WPA3 protocol, a shared password is required for calculation. In this way, an attacker can obtain the password through channel testing combined with brute force cracking, thereby causing the password to be leaked.

[0219] Optionally, during the execution of step 410, the above Figure 5 The TBPEKE process shown in is modified with some modifications. For example, when B acts as AP, B can keep g = U·V pw , instead of pw. For another example, when multiple A need to be authenticated, B can reuse Y and y, without using different Y and y for each A.

[0220] Figure 6 A schematic flow chart of a method 600 for security authentication applied to WiFi provided by an embodiment of the present application is shown. As an example, the method 600 can be performed by a first device and an AP. In the method 600, the first device and the AP share a password pw, and use a double-base cryptographic exponential key exchange TBPEKE protocol to negotiate a pairing master key PMK, and perform a 4-way handshake based on the PMK. Figure 6 As shown, method 600 includes steps 610 to 650 .

[0221] 610, the first device sends X to the access point AP. Correspondingly, the AP receives X from the first device. The first parameter X is determined according to a hash to curve function g.

[0222] In some embodiments, the first device may determine the first parameter X according to a hash to curve function g. The hash to curve function g is used to convert the password pw into a point on an elliptic curve by a point multiplication operation, X=g x , where x is a random number. As an example, x is The random number selected in

[0223] In some embodiments, the first device may also send an ID of the first device to the access point AP, where the ID of the first device is used to uniquely identify the first device. Exemplarily, the first device may send a connection request to the AP, where the connection request may include the first parameter X and the ID of the first device, which is not limited in this application.

[0224] As an example, the ID of the first device may be a MAC address of the first device, which is not limited in this application. At this time, the frame format of the message (eg, connection request) sent by the first device to the AP may include the MAC address, which is not limited in this application.

[0225] As an example, according to the TBPEKE protocol above, g can be expressed as follows:

[0226] g=U·V pw ,

[0227] Among them, U and V are two independent random generators obtained from the cyclic group G with an order of prime number p.

[0228] Before some optional embodiments, the AP may also send a broadcast message, and the broadcast message may also include RSNEwithsupp.ciphers to notify the capabilities of the ciphers. Accordingly, the first device selects matching ciphers, that is, selects the cryptographic suite it supports, to obtain the above-mentioned g, or the related parameters for obtaining g (such as the above-mentioned U, V). Here, the AP broadcasts RSNEwithsupp.ciphers, and the first device selects matching ciphers, which is an example of the AP and the first device associating and negotiating the security suite to be used. As an example, after the first device selects the cryptographic suite, g, or U, V can be saved as system parameters on the first device side.

[0229] As an example, the broadcast message may be a beacon frame, and the beacon frame may be sent before step 610, which is not limited in the present application.

[0230] In some embodiments, before executing step 610, ie, sending the first parameter X to the AP, the first device may determine the hashtocurve function g according to the system parameters U and V, and the password pw.

[0231] In some embodiments, the broadcast message may also include an AP ID. Correspondingly, the requesting device may receive the broadcast message and obtain the AP ID therefrom. As an example, the AP ID may be the AP's MAC address.

[0232] 620. AP sends Y to the first device.

[0233] In some embodiments, the AP may determine a second parameter Y. The second parameter Y is determined according to a hashtocurve function g, where Y=g y , y is a random number. As an example, y is The random number selected in Here, the hashtocurve function g can refer to the description in step 610 and will not be repeated here.

[0234] As a possible implementation method, the AP can keep g = U·V pw , instead of the password pw. That is, g = U·V pw It can be stored in the AP in advance, while the password pw does not need to be stored in the AP in advance. In this way, when the AP receives the first parameter sent by the first device and the MAC address of the first device, it can directly select the random number y and calculate Y based on the random number y and the pre-stored g, without having to calculate g based on pw.

[0235] It should be noted that in step 610, the g determined by the first device side is the same as the g kept by the AP side. For example, this can be achieved by presetting codes in the first device and the AP respectively, and this application does not limit this.

[0236] Therefore, in the embodiment of the present application, the AP directly stores g=U·V pw , instead of the password pw, can avoid the AP from calculating g in real time when authenticating the device, thereby reducing the amount of calculation on the AP side, and further helping to reduce or avoid denial of service (DoS) attacks on the AP.

[0237] As another possible implementation, the AP can reuse the second parameter Y. As an example, when the AP performs device authentication with multiple first devices, and these first devices can use the same password pw to perform a security protocol with the AP, the AP can reuse the second parameter Y. For example, after the AP sends the second parameter Y to the second first device, the AP receives the first parameter X sent by the first device and the ID of the first device, then the AP does not need to use Y=g y Instead of calculating a new second parameter, the second parameter previously sent to the second first device may be directly sent to the first device.

[0238] It can be understood that since Y = g y Therefore, the AP end reuses the second parameter Y, which is equivalent to the AP end reuses the random number y, and this application does not limit this.

[0239] Therefore, the embodiment of the present application can avoid the AP from calculating the second parameter Y in real time when authenticating the device by reusing the second parameter Y or the random number y on the AP side, thereby reducing the amount of calculation on the AP side, and further helping to reduce or avoid DoS attacks on the AP.

[0240] In other possible implementations, the AP can save the above two independent random generators U and V as system parameters, and determine the hashtocurve function g according to U and V, as well as the password pw, and further select a random number y, according to Y=g y , to determine the second parameter Y, which is not limited in this application.

[0241] In some embodiments, in step 620, the AP may send a response message corresponding to the connection request to the first device, which may include Y, and this application does not limit this.

[0242] 630. The first device determines PMK1.

[0243] Specifically, the first device may determine the pairing master key PMK1 according to the first parameter X and the second parameter Y.

[0244] Exemplarily, the first device may calculate PMK1 according to the first parameter X, the second parameter Y, the ID of the first device, and the ID of the AP. As an example, the first device may calculate PMK1 according to the following formula:

[0245] PMK1=KDF(Z,id dev ||id AP ||X||Y),

[0246] Where Z = Y x , id dev Indicates the ID of the first device, idAP Represents the ID of the AP. KDF() is a standard key derivation function.

[0247] 640, the AP determines PMK2.

[0248] Exemplarily, the AP may determine the pairing master key PMK2 according to the first parameter X and the second parameter Y.

[0249] Exemplarily, the AP may calculate PMK2 according to the first parameter X, the second parameter Y, the ID of the first device, and the ID of the AP. As an example, the AP may calculate PMK2 according to the following formula:

[0250] PMK2=KDF(Z,id dev ||id AP ||X||Y),

[0251] Where Z = X y , id dev Indicates the ID of the first device, id AP Represents the ID of the AP. KDF() is a standard key derivation function.

[0252] At 650 , the first device and the AP perform association and 4-way handshake.

[0253] Here, through the association and 4-way handshake process, the AP and the first device can perform mutual identity authentication and generate session keys and multicast keys to protect the subsequent unicast communication between the requesting device and the AP, as well as the AP's broadcast communication. Exemplarily, in the subsequent association and 4-way handshake process, the first device and the AP can comply with the WPA3 specification. As an example, see Figure 1 The description in will not be repeated here.

[0254] Therefore, in the embodiment of the present application, the first device can send the first parameter X to the AP, and the AP can send the second parameter Y to the first device, wherein the first parameter X and the second parameter Y are respectively determined according to the hashtocurve function g, and then the first device can calculate PMK1 according to the first parameter X and the second parameter Y, and the AP can calculate PMK2 according to the first parameter X and the second parameter Y. In the embodiment of the present application, the first parameter X and the second parameter Y transmitted between the AP and the first device are generated based on the hashtocurve function g and random numbers, and do not involve the calculation of the password, so that it is difficult for an attacker to know the password, thereby improving the ability of the AP and the first device to prevent side channel attacks during the WiFi security authentication process, and helping the AP and the first device to avoid side channel attacks during security authentication.

[0255] In the prior art, when the SAE process is used to calculate PMK in the WPA3 protocol, a shared password is required for calculation. In this way, an attacker can obtain the password through channel testing combined with brute force cracking, thereby causing the password to be leaked.

[0256] Figure 7 The schematic flow chart of a method 700 for secure authentication applied to WiFi provided by an embodiment of the present application is shown. As an example, the method 700 can be executed by a first device and an AP. In the method 700, the first device and the AP share a password pw, and the AP keeps g=U·V pw Specifically, the first device or AP may refer to the above description.

[0257] It should be understood that Figure 7 The steps or operations of the method for security authentication applied to WiFi are shown, but these steps or operations are only examples. The embodiment of the present application may also perform other operations or Figure 7 In addition, Figure 7 The steps in Figure 7 , and may not be executed in the order presented in Figure 7 All operations in .

[0258] like Figure 7 As shown, method 700 includes steps 701 to 708 .

[0259] 701, AP broadcasts a beacon frame. The beacon frame may include the MAC address of the AP (which may be represented as MAC AP ). Optionally, the beacon frame may also include RSNEwithsupp.ciphers (robust security network element with supported ciphers) to notify the capabilities of the ciphers, which is not limited in this application.

[0260] Accordingly, a terminal device within the coverage of the AP's WiFi network can receive the beacon frame and obtain the information in the beacon frame. As an example, Figure 7 The first device shown in can receive the beacon frame and determine that it needs to connect to the WiFi network provided by the AP.

[0261] 702, the first device selects a password (selectcipher) and a random number Determine X=(U·V pw ) x .

[0262] Exemplarily, the first device selects a password, which may refer to the first device selecting a password suite that it supports to obtain the hashtocurve function g, or to obtain related parameters of g (such as U, V, etc.), which is not limited in this application. After the first device selects the password suite, g, or U, V can be saved as system parameters on the first device side.

[0263] As an example, the first device selects a random number Determine X=(U·V pw ) x Specifically, U and V are two independent random generators obtained from a cyclic group G with a prime number p, which can be stored as system parameters on the first device side. The first device can determine the hashtocurve function g=U·V according to the system parameter elements U and V and the password pw. pw Here, the hashtocurve function g multiplication operation converts the password pw into a point on the elliptic curve. Then, the first device can select a random number And according to the hashtocurve function g and the random number x, determine the first parameter X=(U·V pw )x. Specifically, the process of determining the first parameter X can be referred to Figure 6 The description of step 610 in the above description will not be repeated here.

[0264] 703, the first device sends X and MAC to the AP dev .

[0265] Exemplarily, the first device may send a connection request to the AP, which includes the first parameter X and the MAC address MAC of the first device. dev , this application does not limit this.

[0266] It should be noted that the embodiment of the present application is described by taking the identification of the first device as the MAC address of the first device and the identification of the AP as the MAC address of the AP as an example, but the embodiment of the present application is not limited to this. For example, in other embodiments, the first device may also send other unique identifications for identifying the first device to the AP, and the present application does not limit this.

[0267] 704, AP selects a random number Y=(U·V pw ) y .

[0268] Here, as an implementation method, the AP can keep g = U·V pw , instead of the password pw, so the AP can receive the first parameter X and MAC dev After that, a random number y is selected and the pre-stored hashtocurve function g = U·Vpw and random number y, determine the second parameter Y = (U·V pw ) y .

[0269] It should be noted that in step 702, the g determined by the first device side is the same as the g kept by the AP side. For example, this can be achieved by presetting codes in the first device and the AP respectively, and this application does not limit this.

[0270] Therefore, in the embodiment of the present application, the AP directly stores g=U·V pw , instead of the password pw, can avoid the AP from calculating g in real time when authenticating the device, thereby reducing the amount of calculation on the AP side, and further helping to reduce or avoid DoS attacks.

[0271] In some optional embodiments, when the AP receives connection requests sent by multiple (i.e., two or more) first devices, the AP may reuse y and Y. In this way, the AP can avoid calculating the second parameter Y in real time when authenticating the device, thereby reducing the amount of calculation on the AP side, and further helping to reduce or avoid DoS attacks.

[0272] 705. The AP sends Y to the first device.

[0273] 706, the first device calculates Z=Y x , PMK=KDF(Z,MAC dev ||MAC AP ||X||Y).

[0274] 707, AP calculates Z = X y , PMK=KDF(Z,MAC dev ||MAC AP ||X||Y).

[0275] Specifically, steps 706 and 707 can be found in Figure 6 The description of steps 630 and 640 is omitted here.

[0276] 708 , the first device associates with the AP and performs a 4-way handshake.

[0277] Here, through the association and 4-way handshake process, the AP and the first device can perform mutual identity authentication and generate a session key and a multicast key to protect the subsequent unicast communication between the requesting device and the AP, as well as the broadcast communication of the AP. Figure 1 The description in will not be repeated here.

[0278] Therefore, in the embodiment of the present application, the first device can send the first parameter X to the AP, and the AP can send the second parameter Y to the first device, wherein the first parameter X and the second parameter Y are respectively determined according to the hashtocurve function g, and then the first device can calculate PMK1 according to the first parameter X and the second parameter Y, and the AP can calculate PMK2 according to the first parameter X and the second parameter Y. In the embodiment of the present application, the first parameter X and the second parameter Y transmitted between the AP and the first device are generated based on the hashtocurve function g and random numbers, and do not involve the calculation of the password, so that it is difficult for an attacker to know the password, thereby improving the ability of the AP and the first device to prevent side channel attacks during the WiFi security authentication process, and helping the AP and the first device to avoid side channel attacks during security authentication.

[0279] In the prior art, when the SAE process is used to calculate PMK in the WPA3 protocol, a shared password is required for calculation. In this way, an attacker can obtain the password through channel testing combined with brute force cracking, thereby causing the password to be leaked.

[0280] Figure 8 The schematic flow chart of a method 800 for security authentication applied to WiFi provided by an embodiment of the present application is shown. In the method 800, the AP can send an anti-DoS credential token to the first device and verify the token sent again by the first device to further enhance the ability to resist DoS attacks. In the method 800, the first device and the AP share the password pw, and the AP keeps g=U·V pw , and additionally set the key k, which is used to generate the anti-DoS credential token.

[0281] It should be understood that Figure 8 The steps or operations of the method for security authentication applied to WiFi are shown, but these steps or operations are only examples. The embodiment of the present application may also perform other operations or Figure 8 In addition, Figure 8 The steps in Figure 8 , and may not be executed in the order presented in Figure 8 All operations in .

[0282] like Figure 8 As shown, method 800 includes steps 801 to 812 .

[0283] Optionally, in an embodiment of the present application, it may be set whether to enable an anti-DoS mechanism. As an example, a label may be pre-set, and when the anti-DoS mechanism is enabled, the label value may be set to 1, and otherwise the label may be set to 0. When the anti-DoS mechanism is enabled, the token sent by the first device may be verified, and / or Y and y may be reused, which is not limited in the present application.

[0284] 801, the AP broadcasts a beacon frame. Accordingly, the first device may receive the beacon frame and determine that it needs to connect to the WiFi network provided by the AP.

[0285] 802, the first device selects a password and a random number Determine X=(U·V pw ) x .

[0286] 803, the first device sends X and MAC to the AP dev Correspondingly, AP receives X and MAC dev .

[0287] Specifically, steps 801 to 803 can be found in Figure 7 The descriptions of steps 701 to 703 are not repeated here.

[0288] 804, AP calculates token = h(k, MAC dev ).

[0289] As an example, when the AP receives a connection request sent by the first device, it can use the stored key k and the MAC address MAC of the first device in the connection request to obtain the connection request. dev , generate a binding to MAC dev The token of the address. h() is a secure hash function.

[0290] 805, the AP sends a token to the first device. That is, the AP generates a token bound to the above MAC. dev After receiving the token of the address, the token is returned to the first device. Correspondingly, the first device receives the token.

[0291] 806, the first device sends token, X and MAC to the AP dev Correspondingly, AP receives token, X and MAC dev .

[0292] As an example, the first device submits a connection request and a token to the AP again. For example, the token may be carried in the connection request, which is not limited in this application. For example, the token may also be encapsulated in a message together with the connection request and sent to the AP.

[0293] Exemplarily, in step 803, the first device may send a first connection request to the AP, which may include X and MAC dev In step 806, the first device may send a second connection request to the AP, which may include token, X and MAC dev .

[0294] 807, AP check token? = h(k, MAC dev ). That is, the AP checks whether the token received in step 806 is equal to the token calculated in step 804.

[0295] When token = h(k, MAC dev ), that is, when the token received by the AP in step 806 is equal to the token calculated by the AP in step 804, the token passes the verification, and the AP can further process the connection request of the first device.

[0296] When token≠h(k, MACdev), that is, the token received by the AP in step 806 is not equal to the token calculated by the AP in step 804, the token fails to pass the verification, and the AP may not process the connection request of the first device.

[0297] It is understandable that when the token fails to pass the verification, it means that the token does not match the MAC address bound to the token, so the first device may use a false MAC address to maliciously attack the AP, and the first device may be an attacker. Therefore, the AP may not process the connection request of the first device to reduce or avoid DoS attacks.

[0298] In some optional embodiments, when the value of the set label is 1, the above steps 804 to 807 may be executed, and when the value of the set label is 0, the above steps 804 to 807 may not be executed. This application does not limit this.

[0299] In some other optional embodiments, when the label value is not set and the AP supports calculating and verifying the above token, the AP can always execute steps 804 to 807 after receiving the connection request, that is, step 803, and this application does not limit this.

[0300] 808, AP selects a random number Y=(U·V pw ) y .

[0301] Specifically, step 808 can refer to Figure 7 The description of step 704 in will not be repeated here.

[0302] In some optional embodiments, when the value of the set label is 1 and the AP receives multiple connection requests, the AP may reuse Y and y. When the value of the set label is 0, when the AP receives multiple connection requests, the AP does not reuse Y and y, that is, selects y for different first devices respectively and calculates Y.

[0303] In some other optional embodiments, when the label value is not set, the AP may always reuse Y and y when receiving multiple connection requests, which is not limited in the present application.

[0304] 809. The AP sends Y to the first device.

[0305] 810, the first device calculates Z=Y x , PMK=KDF(Z,MAC dev ||MAC AP ||X||Y).

[0306] 811, AP calculates Z = X y , PMK=KDF(Z,MAC dev ||MAC AP ||X||Y).

[0307] 812 , the first device associates with the AP and performs a 4-way handshake.

[0308] Specifically, steps 809 to 812 can be found in Figure 7 The description of steps 705 to 708 in the above description will not be repeated here.

[0309] Therefore, in an embodiment of the present application, the AP can generate an anti-DoS token bound to the MAC address of the first device based on the MAC address of the first device and the key stored on the AP side, and return the token to the first device. The first device needs to send its MAC address and token to the AP again, so that the AP can verify its MAC address and the corresponding token, and only process the connection request of the first device when the token passes the verification, which can help avoid the AP from processing all connection requests, thereby helping to reduce or avoid DoS attacks on the AP.

[0310] Fig. 9The schematic flow chart of a method 900 for security authentication applied to WiFi provided by an embodiment of the present application is shown. In the method 900, the AP can maintain a list of connected devices (device in processing, DEV in PROC). When the first device is not in the list of connected devices, the AP will further process the connection request of the first device. In the method 900, the first device and the AP share the password pw, and the AP can keep g = U·V pw , and additionally set the key k.

[0311] It should be understood that Fig. 9 The steps or operations of the method for security authentication applied to WiFi are shown, but these steps or operations are only examples. The embodiment of the present application may also perform other operations or Fig. 9 In addition, Fig. 9 The steps in Fig. 9 , and may not be executed in the order presented in Fig. 9 All operations in .

[0312] like Fig. 9 As shown, method 900 includes steps 901 to 914 .

[0313] Optionally, in the embodiment of the present application, a label may be set. When the anti-DoS mechanism is enabled, the label value may be set to 1, otherwise the label value may be set to 0. For details, see Figure 8 The description in will not be repeated here.

[0314] 901, the AP broadcasts a beacon frame. Accordingly, the first device may receive the beacon frame and determine that it needs to connect to the WiFi network provided by the AP.

[0315] 902, the first device selects a password and a random number Determine X=(U·V pw ) x .

[0316] 903, the first device sends X and MAC to the AP dev Correspondingly, AP receives X and MAC dev .

[0317] Specifically, steps 901 to 903 can be found in Figure 8 The descriptions of steps 801 to 803 are not repeated here.

[0318] 904, AP inspection Calculate token = h(k, MAC dev ).

[0319] Specifically, AP When calculating token=h(k, MAC dev ), on MAC dev ∈DEVinPROC, token=h(k,MAC dev ).

[0320] As an example, the list of connected devices maintained by the AP (which can be represented as DEVinPROC) may include the MAC address of at least one terminal device (i.e., connected device) connected to the network provided by the AP. ), the AP will further process the connection request of the first device, that is, calculate token=h(k, MAC dev ). When the MAC address of the first device is in DEVinPROC (MAC dev ∈DEVinPROC), it means that the first device has been able to connect to the network provided by the AP. It can be inferred that the first device uses a false MAC address to maliciously attack the AP, and the first device may be an attacker. At this time, the AP may not process the connection request of the first device, that is, it will not calculate a token for the first device, so as to reduce or avoid DoS attacks on the AP.

[0321] 905, the AP sends a token to the first device. That is, the AP generates a token bound to the above MAC. dev After receiving the token of the address, the token is returned to the first device. Correspondingly, the first device receives the token.

[0322] 906, the first device sends token, X and MAC to the AP dev .

[0323] As an example, the first device submits a connection request and a token to the AP again. For example, the token may be carried in the connection request, which is not limited in this application. For example, the token may also be encapsulated in a message together with the connection request and sent to the AP.

[0324] Correspondingly, AP receives token, X and MAC dev .

[0325] 907, AP inspection Check token? = h(k, MAC dev ). That is, the AP checks the MAC address received in step 906. devIs it in the DEVinPROC list, and check whether token is equal to the token calculated in step 904.

[0326] As an example, the AP can dev Not in the DEVinPROC list, i.e. Afterwards, it is further checked whether the token is equal to the token calculated in step 904 .

[0327] when And token = h(k, MAC dev ), that is, when the first device is not a connected device and the token received by the AP in step 906 is equal to the token calculated by the AP in step 904, the AP can further process the connection request of the first device.

[0328] when And token≠h(k, MAC dev ), that is, the first device is not a connecting device, but when the token received by the AP in step 906 is not equal to the token calculated by the AP in step 904, the AP may not process the connection request of the first device.

[0329] When MAC dev ∈DEVinPROC, the AP may not verify the token, that is, may not process the connection request of the first device.

[0330] 908, DEVinPROC=DEVinPROCv{MAC dev}.

[0331] Specifically, DEVinPROC = DEVinPROCv{MAC dev} indicates that the MAC address of the first device can be added to the existing DEVinPROC list to update DEVinPROC. dev When a connection request is made, the MAC dev It is already included in DEVinPROC, and the AP does not need to process the connection request, thereby helping to reduce or avoid DoS attacks on the AP.

[0332] 909, select a random number Y=(U·V pw ) y .

[0333] 910. AP sends Y to the first device.

[0334] 911, the first device calculates Z=Yx , PMK=KDF(Z,MAC dev ||MAC AP ||X||Y).

[0335] 912, AP calculates Z = X y , PMK=KDF(Z,MAC dev ||MAC AP ||X||Y).

[0336] 913, the first device associates with the AP and performs a 4-way handshake.

[0337] Specifically, steps 909 to 913 can be found in Figure 8 The description of steps 808 to 812 will not be repeated here.

[0338] 914, if failed, DEVinPROC = DEVinPROC - {MAC dev}.

[0339] Specifically, if the identity authentication or key generation between the first device and the AP fails, that is, the first device is not a connected device of the AP at this time, then the MAC address of the first device can be deleted from the current DEVinPROC list. In this way, the first device can still send a connection request to the AP later, and because the MAC address of the first device is not in the DEVinPROC, the AP can process the connection request of the first device accordingly.

[0340] Therefore, in the embodiment of the present application, the AP will further process the connection request of the first device only when it determines that the MAC address of the first device is not in the list of its DEVinPROC. This can help avoid the AP from processing all connection requests, help reduce the amount of calculation on the AP side, and further help reduce or avoid DoS attacks on the AP.

[0341] It can be understood that in the above-mentioned embodiments of the present application, the method implemented by the AP can also be implemented by components that can be used for the AP (such as chips or circuits), and the method implemented by the first device can also be implemented by components that can be used for the first device (such as chips or circuits).

[0342] According to the above method, Fig.10 A schematic diagram of a device 1000 for WiFi security authentication provided in an embodiment of the present application.

[0343] In some embodiments, the apparatus 1000 may be an AP, or a chip or circuit, such as a chip or circuit that can be set in an AP. In some embodiments, the apparatus 1000 may be a first device, or a chip or circuit, such as a chip or circuit that can be set in a first device.

[0344] The apparatus 1000 may include a processing unit 1010 (ie, an example of a processor) and a transceiver unit 1030 .

[0345] Optionally, the transceiver unit 1030 may be implemented by a transceiver or a transceiver-related circuit or an interface circuit.

[0346] Optionally, the device may further include a storage unit 1020. In one possible manner, the storage unit 1020 is used to store instructions. Optionally, the storage unit may also be used to store data or information. The storage unit 1020 may be implemented by a memory.

[0347] In one possible design, the processing unit 1010 can be used to execute instructions stored in the storage unit 1020 so that the device 1000 implements the steps performed by the AP in the above method.

[0348] Furthermore, the processing unit 1010, the storage unit 1020, and the transceiver unit 1030 can communicate with each other through the internal connection path to transmit control and / or data signals. For example, the storage unit 1020 is used to store a computer program, and the processing unit 1010 can be used to call and run the computer program from the storage unit 1020 to control the transceiver unit 1030 to receive signals and / or send signals, thereby completing the AP step in the above method.

[0349] Exemplarily, when the processing unit 1010 is a processor and the transceiver unit 1030 is a transceiver, the processor can be coupled to the transceiver, for example, sending instructions to the transceiver to instruct (or control) the transceiver unit to receive signals and / or send signals, thereby completing the AP steps in the above method.

[0350] In one possible design, the processing unit 1010 can be used to execute instructions stored in the storage unit 1020 so that the apparatus 1000 implements the steps performed by the first device in the above method.

[0351] Furthermore, the processing unit 1010, the storage unit 1020, and the transceiver unit 1030 can communicate with each other through the internal connection path to transmit control and / or data signals. For example, the storage unit 1020 is used to store a computer program, and the processing unit 1010 can be used to call and run the computer program from the storage unit 1020 to control the transceiver unit 1030 to receive signals and / or send signals, thereby completing the steps of the first device in the above method.

[0352] Exemplarily, when the processing unit 1010 is a processor and the transceiver unit 1030 is a transceiver, the processor can be coupled to the transceiver, for example, sending instructions to the transceiver to instruct (or control) the transceiver unit to receive signals and / or send signals, thereby completing the steps of the first device in the above method.

[0353] The storage unit 1020 may be integrated into the processing unit 1010 or may be provided separately from the processing unit 1010. The transceiver unit 1030 may be integrated into the processing unit 1010 or may be provided separately from the processing unit 1010.

[0354] Optionally, if the apparatus 1000 is a communication device, the transceiver unit 1030 may include a receiver and a transmitter. The receiver and the transmitter may be the same or different physical entities. When they are the same physical entity, they may be collectively referred to as a transceiver.

[0355] Optionally, if the device 1000 is a chip or a circuit, the transceiver unit 1030 may include an input interface and an output interface.

[0356] As an implementation, the function of the transceiver unit 1030 may be implemented by a transceiver circuit or a dedicated chip for transceiver. The processing unit 1010 may be implemented by a dedicated processing chip, a processing circuit, a processing unit or a general chip.

[0357] As another implementation, it is possible to use a general-purpose computer to implement the communication device (e.g., AP or first device) provided in the embodiment of the present application. That is, the program code that implements the functions of the processing unit 1010 and the transceiver unit 1030 is stored in the storage unit 1020, and the general-purpose processing unit implements the functions of the processing unit 1010 and the transceiver unit 1030 by executing the code in the storage unit 1020.

[0358] In some implementations, when the device 1000 is an AP or a chip or circuit disposed in an AP,

[0359] The processing unit 1010 may negotiate a pairing master key PMK with the first device based on a double-base cryptographic exponential key exchange TBPEKE protocol according to a password, wherein the password is a shared key between the AP and the first device. Exemplarily, the processing unit 1010 may negotiate with the first device through the transceiver unit 1030.

[0360] The processing unit 1010 may also perform a 4-way handshake with the first device according to the PMK. Exemplarily, the processing unit 1010 may perform a 4-way handshake with the first device through the transceiver unit 1030 .

[0361] Exemplarily, the processing unit 1010 may negotiate with the first device through the transceiver unit 1030 , and the processing unit 1010 may perform a 4-way handshake with the first device through the transceiver unit 1030 .

[0362] In some possible implementations, the PMK includes a first PMK1 and a second PMK2.

[0363] The transceiver unit 1030 is used to obtain a first parameter X from the first device, wherein the first parameter X is determined according to a hash-to-curve function g, and the hash-to-curve function g is used to convert the password into a point on an elliptic curve by a point multiplication operation, X=g x , where x is a random number.

[0364] The transceiver unit 1030 is further configured to send a second parameter Y to the first device to instruct the first device to calculate the first PMK1 according to the first parameter X and the second parameter Y, wherein the second parameter Y is determined according to the hash-to-curve function g, Y=g y , y is a random number,

[0365] The processing unit 1010 is further configured to calculate the second PMK2 according to the first parameter X and the second parameter Y acquired by the transceiver unit.

[0366] In some possible implementations, the processing unit 1010 is further configured to associate with the first device to negotiate a security suite to be used, wherein the security suite is used to indicate the hash-to-curve function g.

[0367] In some possible implementations, the transceiver unit 1030 is used to send a first message to the first device, the first message is used to instruct the first device to generate a first pairing temporary key PTK1, the first message includes a one-time random number of the AP, the first PTK1 is generated based on the first PMK1, the one-time random number of the AP and the one-time random number of the first device, the first PTK1 includes a first key confirmation key KCK1, a first key encryption key KEK1 and a first temporary key TK1.

[0368] The transceiver unit 1030 is further used to obtain a second message from the first device, where the second message uses the first KCK1 to protect the integrity of the message, and the second message includes a one-time random number of the first device.

[0369] The processing unit 1010 is further configured to generate the second PTK2 according to the second PMK2, the one-time random number of the AP and the one-time random number of the first device, wherein the second PTK2 includes a second KCK2, a second KEK2 and a second TK2.

[0370] The transceiver unit 1030 is further used to send a third message to the first device, where the third message includes a multicast key GTK, and the third message uses the second KEK2 to protect the privacy of the GTK and uses the second KCK2 to protect the integrity of the message.

[0371] The transceiver unit 1030 is further used to obtain a fourth message from the first device, where the fourth message is used to respond to the third message, and the fourth message uses the second KCK2 to protect the integrity of the message.

[0372] In some possible implementations, the hash-to-curve function g is expressed as:

[0373] g=U·V pw ;

[0374] Wherein, U and V are two independent random generators obtained from a cyclic group G whose order is a prime number p, and pw represents the password.

[0375] In some possible implementations, the hash-to-curve function g is pre-stored locally in the AP.

[0376] In some possible implementations, the second parameter Y is generated by the AP according to the hash-to-curve function g; or the second parameter Y is determined by the AP by reusing the second parameter Y sent to the second device.

[0377] In some possible implementations, the transceiver unit 1030 is further used to obtain an identification ID of the first device from the first device, and to send a credential for an anti-DoS service to the first device, wherein the credential is determined based on the identification ID and key k of the first device.

[0378] The transceiver unit 1030 is further configured to obtain the credential and the ID of the first device from the first device.

[0379] The processing unit 1010 is further configured to verify the credential according to the ID of the first device and the key k.

[0380] In some possible implementations, the processing unit 1010 is further configured to determine that the ID of the first device is not included in a first list, wherein the first list includes an ID of at least one device connected to a network provided by the AP.

[0381] In some possible implementations, the processing unit 1010 is further configured to add an ID of the first device to the first list.

[0382] In some possible implementations, the ID of the first device includes a MAC address of the first device.

[0383] In some embodiments, when the apparatus 1000 is a first device or a chip or circuit disposed in a first device,

[0384] The processing unit 1010 may negotiate a pairing master key PMK with the access point AP based on a double base cryptographic exponential key exchange TBPEKE protocol according to a password, wherein the password is a shared key between the AP and the first device. Exemplarily, the processing unit may negotiate with the AP through a transceiver unit.

[0385] The processing unit 1010 may also perform a 4-way handshake with the AP according to the PMK. Exemplarily, the processing unit may perform a 4-way handshake with the first device through a transceiver unit.

[0386] Exemplarily, the processing unit 1010 may negotiate with the Ap through the transceiver unit 1030 , and the processing unit 1010 may perform a 4-way handshake with the AP through the transceiver unit 1030 .

[0387] In some possible implementations, the PMK includes a first PMK1 and a second PMK2.

[0388] The transceiver unit 1030 is used to send a first parameter X to the AP, wherein the first parameter X is determined according to a hash-to-curve function g, and the hash-to-curve function g is used to convert the password into a point on an elliptic curve by a point multiplication operation, X=g x , where x is a random number.

[0389] The transceiver unit 1030 is further configured to obtain a second parameter Y from the AP, wherein the second parameter Y is determined according to the hash-to-curve function g, where Y=g y , y is a random number, wherein the first parameter X and the second parameter Y are used by the AP to calculate the second PMK2.

[0390] The processing unit 1010 is configured to calculate a first PMK1 according to the first parameter X and the second parameter Y.

[0391] In some possible implementations, the processing unit 1010 is further configured to associate with the AP to negotiate a security suite to be used, wherein the security suite is used to indicate the hash-to-curve function g.

[0392] In some possible implementations, the transceiver unit 1030 is further configured to receive a first message from the AP, where the first message includes a one-time random number of the AP.

[0393] The processing unit 1010 is also used for the first device to generate a first pairing temporary key PTK1 based on the first PMK1, the one-time random number of the AP, and the one-time random number of the first device. The first PTK1 includes a first key confirmation key KCK1, a first key encryption key KEK1 and a first temporary key TK1.

[0394] The transceiver unit 1030 is also used to send a second message to the AP, the second message uses the first KCK1 to protect the integrity of the message, the second message includes a one-time random number of the first device, the second message is used to instruct the AP to generate a second PTK2, the second PTK2 is generated based on the second PMK2, the one-time random number of the AP and the one-time random number of the first device, and the second PTK2 includes a second KCK2, a second KEK2 and a second TK2.

[0395] The transceiver unit 1030 is further used to obtain a third message from the AP, where the third message includes a multicast key GTK. The third message uses the second KEK2 to protect the privacy of the GTK and uses the second KCK2 to protect the integrity of the message.

[0396] The transceiver unit 1030 is further used to send a fourth message to the AP, where the fourth message is used to respond to the third message, and the fourth message uses KCK to protect the integrity of the message.

[0397] In some possible implementations, the hash-to-curve function g is expressed as:

[0398] g=U·V pw ;

[0399] Wherein, U and V are two independent random generators obtained from a cyclic group G whose order is a prime number p, and pw represents the password.

[0400] In some possible implementations, the transceiver unit 1030 is further configured to send an identification ID of the first device to the AP. The transceiver unit 1030 is further configured to receive a credential for an anti-denial of service DoS service from the AP, the credential being generated based on a key k and the ID of the first device. The transceiver unit 1030 is further configured to send the credential and the ID of the requesting device to the AP.

[0401] In some possible implementations, the ID of the first device includes a MAC address of the first device.

[0402] Each unit in the above embodiments may also be referred to as a module, a circuit, or a component.

[0403] The functions and actions of the modules or units in the apparatus 1000 listed above are only exemplary. When the apparatus 1000 is configured in or is itself an AP, the modules or units in the apparatus 1000 can be used to perform the actions or processing procedures performed by the AP in the above method embodiment. When the apparatus 1000 is configured in or is itself a first device, the modules or units in the apparatus 1000 can be used to perform the actions or processing procedures performed by the first device in the above method embodiment.

[0404] For the concepts, explanations, detailed descriptions and other steps involved in the device 1000 and related to the technical solutions provided in the embodiments of the present application, please refer to the descriptions of these contents in the aforementioned methods or other embodiments, which are not repeated here.

[0405] According to the method provided in the embodiment of the present application, the embodiment of the present application also provides a communication system, which includes the aforementioned AP and a first device.

[0406] It should be understood that in the embodiments of the present application, the processor may be a central processing unit (CPU), and the processor may also be other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC), field programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc.

[0407] It should also be understood that the memory in the embodiments of the present application may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memories. Among them, the non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of random access memory (RAM) are available, such as static RAM (SRAM), dynamic random access memory (DRAM), synchronous DRAM (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM), and direct rambus RAM (DR RAM).

[0408] The above embodiments can be implemented in whole or in part by software, hardware, firmware or any other combination. When implemented by software, the above embodiments can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer programs are loaded or executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from one website site, computer, server or data center to another website site, computer, server or data center by wired (e.g., infrared, wireless, microwave, etc.). The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that contains one or more available media sets. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium. The semiconductor medium can be a solid-state hard disk.

[0409] An embodiment of the present application further provides a computer-readable medium on which a computer program is stored. When the computer program is executed by a computer, the steps performed by the AP in any of the above embodiments, or the steps performed by the first device, are implemented.

[0410] An embodiment of the present application also provides a computer program product, which, when executed by a computer, implements the steps performed by the AP in any of the above embodiments, or the steps performed by the first device.

[0411] The embodiment of the present application also provides a system chip, which includes: a communication unit and a processing unit. The processing unit may be, for example, a processor. The communication unit may be, for example, an input / output interface, a pin, or a circuit. The processing unit may execute computer instructions to enable the chip in the communication device to execute the steps performed by the AP provided in the embodiment of the present application, or the steps performed by the first device.

[0412] Optionally, the computer instructions are stored in a storage unit.

[0413] In addition, various aspects or features of the present application can be implemented as methods, devices or products using standard programming and / or engineering techniques. The term "product" used in this application covers computer programs that can be accessed from any computer-readable device, carrier or medium. For example, computer-readable media may include, but are not limited to: magnetic storage devices (e.g., hard disks, floppy disks or tapes, etc.), optical disks (e.g., compact discs (CDs), digital versatile discs (DVDs), etc.), smart cards and flash memory devices (e.g., erasable programmable read-only memory (EPROM), cards, sticks or key drives, etc.). In addition, the various storage media described herein may represent one or more devices and / or other machine-readable media for storing information. The term "machine-readable medium" may include, but is not limited to, wireless channels and various other media capable of storing, containing and / or carrying instructions and / or data.

[0414] It should be noted that in the various embodiments provided in the present application, there is no time limit relationship between the various steps, and each step can be used as a scheme, or can be combined with one or more other steps to form a scheme, and the present application does not limit this.

[0415] The various embodiments in the present application may be used independently or in combination. For example, any one or more steps in the different embodiments may be combined to constitute an embodiment independently, which is not limited here.

[0416] It should be understood that in the embodiments shown above, the first and the second are only used to distinguish different objects and should not constitute any limitation to the present application.

[0417] It should also be understood that in the embodiments of the present application, the size of the serial numbers of the above processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0418] It should also be understood that "and / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can represent three situations: A exists alone, A and B exist at the same time, and B exists alone. The character " / " generally indicates that the previously associated objects are in an "or" relationship. "At least one" means one or more; "at least one of A and B" is similar to "A and / or B", describing the association relationship of associated objects, indicating that three relationships may exist. For example, at least one of A and B can represent three situations: A exists alone, A and B exist at the same time, and B exists alone.

[0419] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0420] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0421] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0422] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0423] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0424] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in the various embodiments of the present application. The aforementioned storage media include: various media that can store program codes, such as USB flash drives, mobile hard disks, read-only memories (ROM), random access memories (RAM), magnetic disks or optical disks.

[0425] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A method for security authentication applied to wireless fidelity WiFi, characterized in that: include: The access point AP negotiates a pairing master key PMK with the first device based on a double-base cryptographic exponential key exchange TBPEKE protocol according to a password, wherein the password is a shared key between the AP and the first device; The AP performs a 4-way handshake with the first device according to the PMK; The PMK includes a first PMK1 and a second PMK2, wherein the access point AP negotiates a pairing master key PMK with the first device based on a double-base cryptographic exponential key exchange TBPEKE protocol according to a password, including: The AP obtains a first parameter X from the first device, wherein the first parameter X is determined according to a hash-to-curve function g, and the hash-to-curve function g is used to convert the password into a point on an elliptic curve through a point multiplication operation, X=g x , where x is a random number; The AP sends a second parameter Y to the first device to instruct the first device to calculate the first PMK1 according to the first parameter X and a second parameter Y, wherein the second parameter Y is determined according to the hash to curve function g, Y=g y , y is a random number; The AP calculates the second PMK2 according to the first parameter X and the second parameter Y; The hash-to-curve function g is pre-stored locally in the AP.

2. The method according to claim 1, characterized in that Before the access point AP negotiates the pairing master key PMK with the first device based on the double base cryptographic exponential key exchange TBPEKE protocol according to the password, the method further includes: The AP associates with the first device to negotiate a security suite to be used, wherein the security suite is used to indicate the hash-to-curve function g.

3. The method according to claim 1 or 2, characterized in that: The AP performs a 4-way handshake with the first device according to the PMK, including: The AP sends a first message to the first device, where the first message is used to instruct the first device to generate a first pairing temporary key PTK1, the first message includes a one-time random number of the AP, the first PTK1 is generated according to the first PMK1, the one-time random number of the AP and the one-time random number of the first device, and the first PTK1 includes a first key confirmation key KCK1, a first key encryption key KEK1 and a first temporary key TK1; Acquire a second message from the first device, where the second message uses the first KCK1 to protect the integrity of the message, and the second message includes a one-time random number of the first device; The AP generates the second PTK2 according to the second PMK2, the one-time random number of the AP and the one-time random number of the first device, where the second PTK2 includes a second KCK2, a second KEK2 and a second TK2; The AP sends a third message to the first device, where the third message includes a multicast key GTK, and the third message uses the second KEK2 to protect the privacy of the GTK and uses the second KCK2 to protect the integrity of the message; A fourth message is obtained from the first device, where the fourth message is used to respond to the third message, and the fourth message uses the second KCK2 to protect the integrity of the message.

4. The method according to claim 1 or 2, characterized in that: The hash-to-curve function g is expressed as: g=U·V pw ; Wherein, U and V are two independent random generators obtained from a cyclic group G whose order is a prime number p, and pw represents the password.

5. The method according to claim 1 or 2, characterized in that: The second parameter Y is generated by the AP according to the hash-to-curve function g; or The second parameter Y is determined by the AP by reusing the second parameter Y sent to the second device.

6. The method according to claim 1 or 2, characterized in that: Before the AP sends the second parameter Y to the first device, the method further includes: Acquire an identification ID of the first device from the first device; Sending a credential for an anti-DoS service to the first device, wherein the credential is determined according to an identification ID and a key k of the first device; obtaining the credential and the ID of the first device from the first device; The credential is verified based on the ID of the first device and the secret key k.

7. The method according to claim 1 or 2, characterized in that: Before sending the second parameter Y to the first device, the method further includes: It is determined that the ID of the first device is not included in a first list, wherein the first list includes an ID of at least one device connected to a network provided by the AP.

8. The method according to claim 7, characterized in that Also includes: The ID of the first device is added to the first list.

9. The method according to claim 6, characterized in that The ID of the first device includes a MAC address of the first device.

10. A method for security authentication applied to wireless fidelity WiFi, characterized in that: include: The first device negotiates a pairing master key PMK with the access point AP based on a double-base cryptographic exponential key exchange TBPEKE protocol according to a password, wherein the password is a shared key between the AP and the first device; The first device performs a 4-way handshake with the AP according to the PMK; The PMK includes a first PMK1 and a second PMK2. The first device negotiates a pairing master key PMK with the access point AP based on a double-base cryptographic exponential key exchange TBPEKE protocol according to a password, including: The first device sends a first parameter X to the AP, wherein the first parameter X is determined according to a hash-to-curve function g, and the hash-to-curve function g is used to convert the password into a point on an elliptic curve through a point multiplication operation, X=g x , where x is a random number; The first device obtains a second parameter Y from the AP, wherein the second parameter Y is determined according to the hash-to-curve function g, Y=g y , y is a random number, wherein the first parameter X and the second parameter Y are used by the AP to calculate the second PMK2, and the hash-to-curve function g is pre-stored locally in the AP; The first device calculates the first PMK1 according to the first parameter X and the second parameter Y.

11. The method according to claim 10, characterized in that Before the first device negotiates the pairing master key PMK with the AP based on the double-base cryptographic exponential key exchange TBPEKE protocol according to the password, the method further includes: The first device associates with the AP to negotiate a security suite to be used, wherein the security suite is used to indicate the hash-to-curve function g.

12. The method according to claim 10 or 11, characterized in that: The first device performs a 4-way handshake with the AP according to the PMK, including: The first device receives a first message from the AP, where the first message includes a one-time random number of the AP; The first device generates a first pairing temporary key PTK1 according to the first PMK1, the one-time random number of the AP, and the one-time random number of the first device, wherein the first PTK1 includes a first key confirmation key KCK1, a first key encryption key KEK1, and a first temporary key TK1; Sending a second message to the AP, where the second message uses the first KCK1 to protect the integrity of the message, the second message includes the one-time random number of the first device, the second message is used to instruct the AP to generate a second PTK2, the second PTK2 is generated according to the second PMK2, the one-time random number of the AP and the one-time random number of the first device, and the second PTK2 includes a second KCK2, a second KEK2 and a second TK2; Acquire a third message from the AP, the third message including a multicast key GTK, the third message using the second KEK2 to protect the privacy of the GTK, and using the second KCK2 to protect the integrity of the message; A fourth message is sent to the AP, where the fourth message is used to respond to the third message, and the fourth message uses the second KCK2 to protect the integrity of the message.

13. The method according to claim 10 or 11, characterized in that: The hash-to-curve function g is expressed as: g=U·V pw ; Wherein, U and V are two independent random generators obtained from a cyclic group G whose order is a prime number p, and pw represents the password.

14. The method according to claim 10 or 11, characterized in that: Before receiving the second parameter Y from the AP, the method further includes: Sending an identification ID of the first device to the AP; receiving a credential for an anti-denial of service (DoS) service from the AP, the credential being generated based on a key k and an ID of the first device; The credentials and the ID of the requesting device are sent to the AP.

15. The method according to claim 14, characterized in that The ID of the first device includes a MAC address of the first device.

16. A device for security authentication of wireless fidelity WiFi, characterized in that: include: processor and transceiver, The processor is coupled to the transceiver, and is configured to negotiate a pairing master key PMK with the first device based on a double base cryptographic exponential key exchange TBPEKE protocol according to a password, wherein the password is a shared key between the AP and the first device; Perform a 4-way handshake with the first device according to the PMK; The PMK includes a first PMK1 and a second PMK2, and the processor is specifically configured to: Instructing the transceiver to obtain a first parameter X from the first device, wherein the first parameter X is determined according to a hash-to-curve function g, and the hash-to-curve function g is used to convert the password into a point on an elliptic curve by a point multiplication operation, X=g x , where x is a random number; Instructing the transceiver to send a second parameter Y to the first device to instruct the first device to calculate the first PMK1 based on the first parameter X and a second parameter Y, wherein the second parameter Y is determined based on the hash-to-curve function g, Y=g y , y is a random number; Calculate the second PMK2 according to the first parameter X and the second parameter Y; The hash-to-curve function g is pre-stored locally in the AP.

17. The device according to claim 16, characterized in that The processor is further configured to: associate with the first device to negotiate a security suite to be used, wherein the security suite is used to indicate the hash-to-curve function g.

18. The device according to claim 16 or 17, characterized in that The processor is specifically used for: Instruct the transceiver to send a first message to the first device, where the first message is used to instruct the first device to generate a first pairing temporary key PTK1, where the first message includes a one-time random number of the AP, where the first PTK1 is generated according to the first PMK1, the one-time random number of the AP, and the one-time random number of the first device, where the first PTK1 includes a first key confirmation key KCK1, a first key encryption key KEK1, and a first temporary key TK1; Instruct the transceiver to obtain a second message from the first device, where the second message uses the first KCK1 to protect the integrity of the message, and the second message includes a one-time random number of the first device; Generate the second PTK2 according to the second PMK2, the one-time random number of the AP and the one-time random number of the first device, where the second PTK2 includes a second KCK2, a second KEK2 and a second TK2; instructing the transceiver to send a third message to the first device, wherein the third message includes a multicast key GTK, and the third message uses the second KEK2 to protect the privacy of the GTK and uses the second KCK2 to protect the integrity of the message; Instruct the transceiver to obtain a fourth message from the first device, where the fourth message is used to respond to the third message, and the fourth message uses the second KCK2 to protect the integrity of the message.

19. The device according to claim 16 or 17, characterized in that The hash-to-curve function g is expressed as: g=U·V pw ; Wherein, U and V are two independent random generators obtained from a cyclic group G whose order is a prime number p, and pw represents the password.

20. The device according to claim 16 or 17, characterized in that The second parameter Y is generated by the AP according to the hash-to-curve function g; or The second parameter Y is determined by the AP by reusing the second parameter Y sent to the second device.

21. The device according to claim 16 or 17, characterized in that The processor is further configured to: Instructing the transceiver to obtain an identification ID of the first device from the first device; Instructing the transceiver to send a credential for an anti-DoS service to the first device, wherein the credential is determined based on an identification ID and a key k of the first device; instructing the transceiver to obtain the credential and the ID of the first device from the first device; The credential is verified based on the ID of the first device and the secret key k.

22. The device according to claim 16 or 17, characterized in that The processor is further configured to: It is determined that the ID of the first device is not included in a first list, wherein the first list includes an ID of at least one device connected to a network provided by the AP.

23. The device according to claim 22, characterized in that The processor is further configured to: The ID of the first device is added to the first list.

24. The device according to claim 21, characterized in that The ID of the first device includes a MAC address of the first device.

25. A device for security authentication of wireless fidelity WiFi, characterized in that: include: processor and transceiver, The processor is coupled to the transceiver, and is configured to negotiate a pairing master key PMK with an access point AP based on a double base cryptographic exponential key exchange TBPEKE protocol according to a password, wherein the password is a shared key between the AP and the first device; Perform a 4-way handshake with the AP according to the PMK; The PMK includes a first PMK1 and a second PMK2, and the processor is specifically configured to: Instructing the transceiver to send a first parameter X to the AP, wherein the first parameter X is determined according to a hash-to-curve function g, and the hash-to-curve function g is used to convert the password into a point on an elliptic curve by a point multiplication operation, X=g x , where x is a random number; Instructing the transceiver to obtain a second parameter Y from the AP, wherein the second parameter Y is determined according to the hash-to-curve function g, Y=g y , y is a random number, wherein the first parameter X and the second parameter Y are used by the AP to calculate the second PMK2, and the hash-to-curve function g is pre-stored locally in the AP; The first PMK1 is calculated according to the first parameter X and the second parameter Y.

26. The device according to claim 25, characterized in that The processor is further configured to: Associating with the AP to negotiate a security suite to be used, wherein the security suite is used to indicate the hash-to-curve function g.

27. The device according to claim 25 or 26, characterized in that The processor is specifically used for: Instructing the transceiver to receive a first message from the AP, the first message including a one-time random number of the AP; Generate a first pairing temporary key PTK1 according to the first PMK1, the one-time random number of the AP, and the one-time random number of the first device, wherein the first PTK1 includes a first key confirmation key KCK1, a first key encryption key KEK1, and a first temporary key TK1; instructing the transceiver to send a second message to the AP, the second message using the first KCK1 to protect the integrity of the message, the second message including the one-time random number of the first device, the second message being used to instruct the AP to generate a second PTK2, the second PTK2 being generated according to the second PMK2, the one-time random number of the AP and the one-time random number of the first device, the second PTK2 including a second KCK2, a second KEK2 and a second TK2; Instructing the transceiver to obtain a third message from the AP, where the third message includes a multicast key GTK, and the third message uses the second KEK2 to protect the privacy of the GTK and uses the second KCK2 to protect the integrity of the message; Instruct the transceiver to send a fourth message to the AP, where the fourth message is used to respond to the third message, and the fourth message uses the second KCK2 to protect the integrity of the message.

28. The device according to claim 25 or 26, characterized in that The hash-to-curve function g is expressed as: g=U·V pw ; Wherein, U and V are two independent random generators obtained from a cyclic group G whose order is a prime number p, and pw represents the password.

29. The device according to claim 25 or 26, characterized in that The processor is further configured to: Instructing the transceiver to send an identification ID of the first device to the AP; Instructing the transceiver to receive a credential for an anti-denial of service (DoS) service from the AP, wherein the credential is generated based on a key k and an ID of the first device; The transceiver is instructed to send the credentials and an ID of a requesting device to the AP.

30. The device according to claim 29, characterized in that The ID of the first device includes a MAC address of the first device.

31. A device for security authentication of wireless fidelity WiFi, characterized in that: include: A unit for performing the method according to any one of claims 1 to 9.

32. A device for security authentication of wireless fidelity WiFi, characterized in that: include: Unit for performing the method according to any one of claims 10-15.

33. A communication chip, characterized in that: The chip comprises: A processor and a communication interface, wherein the processor is used to call and run instructions from the communication interface, and when the processor executes the instructions, the method according to any one of claims 1 to 9 is implemented.

34. A communication chip, characterized in that: The chip comprises: A processor and a communication interface, wherein the processor is used to call and run instructions from the communication interface, and when the processor executes the instructions, the method according to any one of claims 10-15 is implemented.

35. A communication system, characterized in that: include: The device as claimed in any one of claims 16 to 24, and the device as claimed in any one of claims 25 to 30.

Images