Security authentication method and device, electronic equipment and readable storage medium

Abstract

The embodiment of the invention provides a security authentication method and device, electronic equipment and a readable storage medium, and the method comprises the steps: carrying out the analysis of a network access application request based on a link access layer of a wireless network under the condition of receiving the network access application request sent by a terminal, and obtaining the network access information of the terminal; sending the network access information to an authentication server, and obtaining an authentication result returned by the authentication server; the authentication result is obtained by performing security authentication by the authentication server based on the network access information and authentication information pre-stored by the authentication server; and executing a target operation corresponding to the authentication result on the network access application request of the terminal according to the authentication result. Therefore, identity screening of the terminal equipment is carried out on the link access layer of the wireless network, and security authentication network access of the terminal is automatically completed without intervention of an application layer, so that the networking efficiency is improved, and the user experience is improved.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a security authentication method, device, electronic device and readable storage medium. Background Art

[0002] With the rapid development of science and technology, the access of in-vehicle wireless terminals to the Internet has become an inevitable trend and a significant feature of the modern automotive industry. In-vehicle wireless terminals integrate 4G / 5G mobile communication technology, Bluetooth, Wi-Fi and other wireless connection methods to achieve seamless connection between vehicles and the Internet, cloud services and other smart terminals.

[0003] In the related art, in the network access scheme of the vehicle-mounted wireless terminal, the authentication of the wireless device is often based on the application layer. Specifically, the vehicle-mounted wireless terminal to be connected to the network sends a "beacon request" to the authentication device. After receiving the "beacon request", the authentication device first allows the vehicle-mounted wireless terminal to join the network and assigns it a network address. At the same time, the association relationship of the device to be connected to the network is saved in the memory or FLASH of the authentication device, so that the wireless terminal to be connected to the network can obtain the network key. Furthermore, the decision to join the network by the terminal is usually made at the application layer. If the device is allowed to join at the application layer, or after the user authentication is successful, the device will be officially accepted. Otherwise, the authentication device will delete the relevant information of the vehicle-mounted wireless terminal to be connected to the network. However, such an authentication method will cause the device to be connected to the network to have access to key information of the network before the authentication is completed, which increases the risk of data leakage and illegal access, and has low security. Summary of the invention

[0004] In order to overcome the problems existing in the related art, the present invention provides a security authentication method, device, electronic device and readable storage medium.

[0005] In a first aspect, the present invention provides a security authentication method, the method comprising:

[0006] When receiving a network access application request sent by a terminal, parsing the network access application request based on a link access layer of the wireless network to obtain network access information of the terminal;

[0007] Sending the network access information to the authentication server, and obtaining the authentication result returned by the authentication server; the authentication result is obtained by the authentication server performing security authentication based on the network access information and the authentication information pre-stored by the authentication server;

[0008] According to the authentication result, a target operation corresponding to the authentication result is performed on the network access application request of the terminal.

[0009] Optionally, performing a target operation corresponding to the authentication result on the network access application request of the terminal according to the authentication result includes:

[0010] When the authentication result is successful, determining that the target operation is to transmit the network access application request to the data processing layer of the wireless network; the data processing layer is used to perform an address allocation operation and a key allocation operation based on the network access application request;

[0011] When the authentication result is authentication failure, determining the target operation is to reject the network access application request of the terminal.

[0012] Optionally, after transmitting the network access application request to the data processing layer of the wireless network, the method further comprises:

[0013] Acquire network information of the target network assigned by the data processing layer; the network information includes a network address and a key;

[0014] The network address and the key are sent to the terminal; the network address and the key are used for the terminal to access the target network.

[0015] Optionally, the network access information includes target identity information of the terminal; and the authentication server is used to:

[0016] Acquire authentication information pre-stored by the authentication server; the authentication information includes identity information of each authenticated terminal;

[0017] When the target identity information of the terminal matches the identity information of any authenticated terminal in the authentication information, determining that the authentication result is successful authentication;

[0018] In a case where the target identity information of the terminal does not match the identity information of any authenticated terminal in the authentication information, it is determined that the authentication result is an authentication failure.

[0019] Optionally, the link access layer based on the wireless network parses the network access application request to obtain the network access information of the terminal, including:

[0020] Based on the target function provided by the link access layer of the wireless network, the network access application request is parsed and the network access information of the terminal is obtained.

[0021] Optionally, the link access layer of the wireless network includes a media access control layer of a Zigbee protocol network or a bearer layer of a Bluetooth Mesh protocol network.

[0022] In a second aspect, the present invention provides a security authentication device, which is applied to a security authentication device, and the device includes:

[0023] A first parsing module is used to parse the network access application request sent by the terminal based on the link access layer of the wireless network to obtain the network access information of the terminal when receiving the network access application request sent by the terminal;

[0024] A first acquisition module is used to send the network access information to the authentication server and obtain the authentication result returned by the authentication server; the authentication result is obtained by the authentication server performing security authentication based on the network access information and the authentication information pre-stored by the authentication server;

[0025] The first processing module is used to perform a target operation corresponding to the authentication result on the network access application request of the terminal according to the authentication result.

[0026] Optionally, the first processing module includes:

[0027] A first determination module is used to determine, when the authentication result is successful authentication, that the target operation is to transmit the network access application request to the data processing layer of the wireless network; the data processing layer is used to perform an address allocation operation and a key allocation operation based on the network access application request;

[0028] The second determining module is used to determine that the target operation is to reject the network access application request of the terminal when the authentication result is authentication failure.

[0029] Optionally, the device further comprises:

[0030] A second acquisition module is used to acquire network information of the target network allocated by the data processing layer; the network information includes a network address and a key;

[0031] The first sending module is used to send the network address and the key to the terminal; the network address and the key are used for the terminal to access the target network.

[0032] Optionally, the network access information includes target identity information of the terminal; and the authentication server is used to:

[0033] Acquire authentication information pre-stored by the authentication server; the authentication information includes identity information of each authenticated terminal;

[0034] When the target identity information of the terminal matches the identity information of any authenticated terminal in the authentication information, determining that the authentication result is successful authentication;

[0035] In a case where the target identity information of the terminal does not match the identity information of any authenticated terminal in the authentication information, it is determined that the authentication result is an authentication failure.

[0036] Optionally, the first parsing module includes:

[0037] The first parsing submodule is used to perform data parsing on the network access application request based on the target function provided by the link access layer of the wireless network, and obtain the network access information of the terminal.

[0038] Optionally, the link access layer of the wireless network includes a media access control layer of a Zigbee protocol network or a bearer layer of a Bluetooth Mesh protocol network.

[0039] In a third aspect, the present invention provides an electronic device comprising: a processor, a memory, and a computer program stored in the memory and executable on the processor, wherein the processor implements the security authentication method described in any one of the first aspects when executing the program.

[0040] In a fourth aspect, the present invention provides a readable storage medium, which, when the instructions in the storage medium are executed by a processor of an electronic device, enables the electronic device to perform the steps in the security authentication method in any one of the embodiments of the first aspect above.

[0041] In an embodiment of the present invention, when a network access application request sent by a terminal is received, the network access application request is parsed based on the link access layer of the wireless network to obtain the network access information of the terminal; the network access information is sent to the authentication server, and the authentication result returned by the authentication server is obtained; the authentication result is obtained by the authentication server performing security authentication based on the network access information and the authentication information pre-stored by the authentication server; according to the authentication result, the target operation corresponding to the authentication result is performed on the network access application request of the terminal. In this way, by performing identity screening of the terminal device at the link access layer of the wireless network, the secure authentication and network access of the terminal are automatically completed without the intervention of the application layer, thereby improving the networking efficiency and enhancing the user experience. At the same time, illegal devices are prevented from obtaining further network resources, and the security of the wireless network can be effectively guaranteed at the link access layer of the wireless network. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0043] Figure 1 is a flowchart of a security authentication method provided by an embodiment of the present invention;

[0044] Figure 2 is a structural diagram of a security authentication device provided by an embodiment of the present invention;

[0045] Figure 3 It is a structural diagram of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0046] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0047] Figure 1 It is a flowchart of the steps of a security authentication method provided by an embodiment of the present invention, which is applied to a security authentication device.

[0048] In the embodiment of the present invention, the security authentication device may be a network authentication device, and the security authentication device may be deployed in a vehicle.

[0049] like Figure 1 As shown, the method may include:

[0050] Step 101: When a network access application request sent by a terminal is received, the network access application request is parsed based on a link access layer of a wireless network to obtain network access information of the terminal.

[0051] In an embodiment of the present invention, when a terminal needs to access the network, it sends a network access application request to a security authentication device. The terminal may be a vehicle-mounted wireless terminal to be networked, such as a vehicle-mounted video device, an LCD touch screen, etc. When the security authentication device receives the network access request sent by the terminal, it will directly intercept the network access application request at the link access layer of the wireless network (wireless communication protocol), and first parse the network access application request based on the link access layer to obtain the network access information of the terminal. The wireless network may be a wireless communication protocol that needs to be authenticated, and the link access layer of the wireless network may be at the lower layer of the wireless network, that is, at the system level below the layer that specifically performs network address allocation (such as the network layer). The link access layer of the wireless network can be used for data transmission and data parsing and other processing and provide services to the data processing layer, such as the network layer. Usually, the link access layer is immediately above the physical layer and is responsible for converting the original data stream transmitted by the physical layer into a structured data frame that can be further processed by the network layer. The core functions of the link access layer include media access control, frame synchronization, error detection and correction, flow control, and channel access management. The link access layer is used to ensure efficient and reliable transmission of data on the wireless medium, while providing necessary data transmission services for the upper layer protocols. In different wireless communication protocols, the link access layer may be concretized as a specific sublayer, such as the Media Access Control Layer (MAC) in the Zigbee protocol and the Bearer Layer in the Bluetooth Mesh protocol. It can be understood that no matter how it is implemented, the link access layer plays a key role in bridging the physical layer and the network layer, providing a structured and reliable transmission mechanism for the data link of the wireless network.

[0052] In the embodiment of the present invention, different types of wireless networks may correspond to different link access layers. For example, when the wireless network is a Zigbee protocol network, the link access layer may be a media access control (MAC) layer; when the wireless network is a Bluetooth Mesh protocol network, the link access layer may be a bearer layer. It is understandable that for different wireless networks, the security authentication device will intercept and process the network access application request at the link access layer corresponding to the wireless network.

[0053] The network access information may include target identity information corresponding to the terminal and other custom information, and the target identity information is used to characterize the unique identifier corresponding to the terminal, that is, based on the target identity information, the unique corresponding terminal can be determined. For example, the target identity information may be the MAC address of the terminal.

[0054] For example, the terminal can send a Beacon request to the security authentication device. The Beacon Request is a broadcast message broadcast to all networks in the channel. Therefore, all authentication devices within the radio frequency range of the same channel can receive the Beacon Request information. The Beacon Request frame contains the MAC address of the terminal. At this time, the network access information will then be passed to the MAC layer of the security authentication device network. The security authentication device will intercept the Beacon request at the MAC layer and parse the Beacon request to obtain the terminal's network access information.

[0055] Accordingly, step 101 may include the following steps:

[0056] Step 1011: Based on the target function provided by the link access layer of the wireless network, perform data analysis on the network access application request and obtain the network access information of the terminal.

[0057] In the embodiment of the present invention, based on the target function provided by the link access layer of the wireless network, the network access application request is parsed, for example, the network access application request is decomposed into data packets and frames, and the network access information of the terminal is obtained according to the parsed content. The target function may be a callback function, for example, when the wireless network is a Zigbee protocol network, the target function may be a callback function provided by the MAC layer.

[0058] Exemplarily, after receiving the Beacon Request information sent by the terminal, the security authentication device passes it to the MAC layer for processing. Specifically, the MAC layer can further decompose the Beacon Request into data packets and frames, and obtain the terminal's 64-bit ExtendedAddress (64-bit extended address, also known as MAC address) based on the relevant callback function provided by the MAC layer.

[0059] Step 102: Send the network access information to the authentication server, and obtain the authentication result returned by the authentication server; the authentication result is obtained by the authentication server performing security authentication based on the network access information and authentication information pre-stored by the authentication server.

[0060] In an embodiment of the present invention, the network access information is sent to the authentication server according to a preset communication protocol, and the authentication result returned by the authentication server after performing security authentication based on the network access information is obtained. The authentication result is obtained by the authentication server performing security authentication based on the network access information and the authentication information pre-stored in the authentication server, and the authentication result may include authentication success and authentication failure. In this way, the network access information is synchronized to the authentication server using a secure preset communication protocol, which ensures the security of the terminal's identity information during transmission, avoids the possibility of information being intercepted or tampered with during transmission, and enhances the security of the entire authentication process.

[0061] Specifically, the steps of performing security authentication by the authentication server may include:

[0062] Step 201: Acquire authentication information pre-stored by the authentication server; the authentication information includes identity information of each authenticated terminal.

[0063] In an embodiment of the present invention, for authenticated terminals that are allowed to access the network safely, terminal-related information such as authenticated terminal identity information can be pre-stored in an authentication server as authentication information required for security authentication. When the authentication server receives the network access information sent by the security authentication device, the authentication information pre-stored in the authentication server is obtained, wherein the authentication information includes the authentication information of each authenticated terminal. Exemplarily, before the wireless terminal device leaves the factory, the MAC address of the device can be read in batches through an automated production line system and recorded, and the read MAC address will be synchronized to the authentication server through a secure communication protocol. The authentication server is responsible for storing all authenticated MAC addresses of authenticated devices for use in subsequent authentication processes. Among them, the MAC address is a unique identifier of the device and can be used in subsequent authentication processes. In this way, by automatically reading and pre-storing the MAC address of the terminal to the authentication server before the device leaves the factory, the identity of the terminal device is quickly pre-identified, the efficiency of network access authentication is significantly improved, and the risk of identity authentication failure due to manual input errors is reduced.

[0064] Step 202: When the target identity information of the terminal matches the identity information of any authenticated terminal in the authentication information, determine that the authentication result is successful.

[0065] Step 203: When the target identity information of the terminal does not match the identity information of any authenticated terminal in the authentication information, determine that the authentication result is authentication failure.

[0066] In the embodiment of the present invention, the target identity information of the terminal is matched with the identity information in the authentication information one by one. When the target identity information of the terminal matches the identity information of any authenticated terminal in the authentication information, it indicates that the terminal is an authenticated terminal, and the authentication result can be determined to be successful authentication; when the target identity information of the terminal does not match the identity information of any authenticated terminal in the authentication information, it indicates that the terminal is not an authenticated terminal, and the authentication result can be determined to be failed authentication. After performing security authentication and obtaining the authentication result, the authentication server returns the authentication result to the security authentication device.

[0067] Exemplarily, the authentication server compares the MAC address of the terminal in the received network access information with multiple pre-stored MAC addresses. If the MAC address of the terminal matches any MAC address, it means that the terminal is an authenticated terminal, that is, a legal device. The authentication server can return a pass response to the security authentication device; otherwise, it can return a rejection response to the security authentication device.

[0068] In the embodiment of the present invention, the terminal is securely authenticated in real time by the authentication server, so that the authentication server can quickly respond to the terminal's request to access the network. At the same time, by pre-storing the identity information of the authenticated terminal in the authentication server, the pre-stored identity information can be directly compared with the target identity information, thereby shortening the authentication waiting time and improving the network's response speed and user experience.

[0069] Step 103: According to the authentication result, a target operation corresponding to the authentication result is performed on the network access application request of the terminal.

[0070] In the embodiment of the present invention, after receiving the authentication result returned by the authentication server, the target operation corresponding to the authentication result is performed on the network access application request of the terminal according to the authentication result. The target operation may include further transmitting the network access application request from the link access layer to the data processing layer, and rejecting the network access application request of the terminal.

[0071] Optionally, step 103 may include the following steps:

[0072] Step 301: When the authentication result is successful, determine that the target operation is to transmit the network access application request to the data processing layer of the wireless network; the data processing layer is used to perform address allocation operations and key allocation operations based on the network access application request.

[0073] In an embodiment of the present invention, when the authentication result is successful authentication, it is characterized that the terminal is an authenticated terminal and can legally and securely access the network. Therefore, it can be determined that the target operation corresponding to the authentication result is to pass the network access application request to the data processing layer of the wireless network. Among them, the data processing layer can be a subsequent processing layer of the link access layer in the wireless network protocol (for example, a higher layer of the wireless network protocol), and the data processing layer can be used to perform address allocation operations and key allocation operations based on the network access application request. For example, the data processing layer may include a network layer, an application layer, etc. It can be understood that for different types of wireless networks, the data processing layer needs to be determined according to the actual protocol model architecture of the wireless network, and different wireless networks may correspond to different data processing layers.

[0074] Exemplarily, when the authentication result received by the security authentication device is successful, the network access application request of the terminal is passed at the MAC layer, and the wireless network protocol is allowed to be further transmitted to the NWK (network layer).

[0075] Step 302: When the authentication result is authentication failure, determine that the target operation is to reject the network access application request of the terminal.

[0076] In the embodiment of the present invention, when the authentication result is authentication failure, it indicates that the terminal is an unsafe terminal and cannot be allowed to access the network. Therefore, it can be determined that the target operation corresponding to the authentication result is to reject the network access application request of the terminal. Exemplarily, the security authentication device can send a rejection message to the terminal, or the security authentication device can directly ignore the network access application request of the terminal.

[0077] Exemplarily, when the authentication result received by the security authentication device is authentication failure, the security authentication device will directly ignore the network access application request of the terminal.

[0078] In summary, in an embodiment of the present invention, when a network access application request sent by a terminal is received, the network access application request is parsed based on the link access layer of the wireless network to obtain the network access information of the terminal; the network access information is sent to the authentication server, and the authentication result returned by the authentication server is obtained; the authentication result is obtained by the authentication server performing security authentication based on the network access information and the authentication information pre-stored by the authentication server; according to the authentication result, the target operation corresponding to the authentication result is performed on the network access application request of the terminal. In this way, by performing identity screening of terminal devices at the link access layer of the wireless network, the secure authentication and network access of the terminal are automatically completed without the intervention of the application layer, thereby improving networking efficiency and enhancing user experience. At the same time, illegal devices are prevented from obtaining further network resources, and the security of the wireless network can be effectively guaranteed at the link access layer of the wireless network.

[0079] Furthermore, in the embodiment of the present invention, compared with the security authentication method of performing identity authentication on the terminal at the application layer after the terminal joins the wireless network, the embodiment of the present invention can effectively prevent saturation attacks by performing identity authentication on the terminal based on the link access layer when the terminal sends a network access application request, thereby improving the security level of the terminal network access security authentication and ensuring the security of the wireless network.

[0080] Optionally, after step 301, the embodiment of the present invention may further include the following steps:

[0081] Step 401: Obtain network information of the target network allocated by the data processing layer; the network information includes a network address and a key.

[0082] In an embodiment of the present invention, after the network access application request is passed to the data processing layer, the data processing layer will process the network access application request in turn, and the data processing layer will allocate network information of the target network based on the network access application request. Among them, the network information may include a network address and a key. The network address may include an IP address, and the IP address is used to uniquely identify a device or a network interface on the Internet. Exemplarily, the network address may also be statically allocated, and the network address may also be dynamically allocated to the terminal by the network layer in the data processing layer through a DHCP server, for example: the network layer will request the DHCP server to allocate an IP address based on the network access application request. The DHCP server will respond with a DHCP offer message containing information such as an IP address, a subnet mask, a default gateway, and a DNS server. The key may be allocated based on a key distribution center (KDC) or a Kerberos protocol, for example: the KDC will generate a temporary session key and encrypt it and allocate it to the requester, i.e., the terminal.

[0083] Step 402: Send the network address and the key to the terminal; the network address and the key are used for the terminal to access the target network.

[0084] In the embodiment of the present invention, the network address and the key are sent to the terminal. After receiving the network address and the key, the terminal accesses the target network based on the network address and the key to complete joining the target network.

[0085] In the embodiment of the present invention, since the network access application request is intercepted at the link access layer of the wireless network, the allocation of network addresses, keys and other resources to the terminal before the authentication is completed is avoided, which not only reduces the occupation of resources such as memory, but also reduces the security risks caused by the terminal pre-acquisition of key network information due to early allocation of resources.

[0086] Figure 3 is a schematic diagram of the structure of a security authentication device provided by an embodiment of the present invention, such as Figure 3As shown, the device may specifically include:

[0087] The first parsing module 501 is used to parse the network access application request sent by the terminal based on the link access layer of the wireless network to obtain the network access information of the terminal when receiving the network access application request sent by the terminal;

[0088] The first acquisition module 502 is used to send the network access information to the authentication server and obtain the authentication result returned by the authentication server; the authentication result is obtained by the authentication server performing security authentication based on the network access information and the authentication information pre-stored by the authentication server;

[0089] The first processing module 503 is used to perform a target operation corresponding to the authentication result on the network access application request of the terminal according to the authentication result.

[0090] The embodiment of the present invention provides a security authentication device. When receiving a network access application request sent by a terminal, the network access application request is parsed based on the link access layer of the wireless network to obtain the network access information of the terminal; the network access information is sent to the authentication server, and the authentication result returned by the authentication server is obtained; the authentication result is obtained by the authentication server performing security authentication based on the network access information and the authentication information pre-stored by the authentication server; according to the authentication result, the target operation corresponding to the authentication result is performed on the network access application request of the terminal. In this way, by performing identity screening of the terminal device at the link access layer of the wireless network, the terminal's security authentication and network access are automatically completed without the intervention of the application layer, thereby improving the networking efficiency and enhancing the user experience. At the same time, illegal devices are prevented from obtaining further network resources, and the security of the wireless network can be effectively guaranteed at the link access layer of the wireless network.

[0091] Optionally, the first processing module 503 includes:

[0092] A first determination module is used to determine, when the authentication result is successful authentication, that the target operation is to transmit the network access application request to the data processing layer of the wireless network; the data processing layer is used to perform an address allocation operation and a key allocation operation based on the network access application request;

[0093] The second determining module is used to determine that the target operation is to reject the network access application request of the terminal when the authentication result is authentication failure.

[0094] The device also includes:

[0095] A second acquisition module is used to acquire network information of the target network allocated by the data processing layer; the network information includes a network address and a key;

[0096] The first sending module is used to send the network address and the key to the terminal; the network address and the key are used for the terminal to access the target network.

[0097] Optionally, the network access information includes target identity information of the terminal; and the authentication server is used to:

[0098] Acquire authentication information pre-stored by the authentication server; the authentication information includes identity information of each authenticated terminal;

[0099] When the target identity information of the terminal matches the identity information of any authenticated terminal in the authentication information, determining that the authentication result is successful authentication;

[0100] In a case where the target identity information of the terminal does not match the identity information of any authenticated terminal in the authentication information, it is determined that the authentication result is an authentication failure.

[0101] Optionally, the first parsing module 501 includes:

[0102] The first parsing submodule is used to perform data parsing on the network access application request based on the target function provided by the link access layer of the wireless network, and obtain the network access information of the terminal.

[0103] Optionally, the link access layer of the wireless network includes a media access control layer of a Zigbee protocol network or a bearer layer of a Bluetooth Mesh protocol network.

[0104] The present invention also provides an electronic device, see Figure 3 , including: a processor 601, a memory 602, and a computer program 6021 stored in the memory and executable on the processor, wherein the processor implements the security authentication method of the aforementioned embodiment when executing the program.

[0105] The present invention also provides a readable storage medium, when the instructions in the storage medium are executed by the processor of the electronic device, the electronic device can execute the security authentication method of the aforementioned embodiment.

[0106] As for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0107] The algorithm and display provided herein are not inherently related to any particular computer, virtual system or other device. Various general purpose systems can also be used together with the teachings based on this. According to the above description, it is obvious that the structure required for constructing such systems. In addition, the present invention is not directed to any specific programming language either. It should be understood that various programming languages ​​can be utilized to realize the content of the present invention described herein, and the description of the above specific languages ​​is for disclosing the best mode of the present invention.

[0108] In the description provided herein, a large number of specific details are described. However, it is understood that embodiments of the present invention can be practiced without these specific details. In some instances, well-known methods, structures and techniques are not shown in detail so as not to obscure the understanding of this description.

[0109] Similarly, it should be understood that in order to streamline the present invention and aid in understanding one or more of the various inventive aspects, in the above description of exemplary embodiments of the present invention, the various features of the present invention are sometimes grouped together into a single embodiment, figure, or description thereof. However, this disclosed method should not be interpreted as reflecting the following intention: that the claimed invention requires more features than the features explicitly recited in each claim. More specifically, as reflected in the claims below, inventive aspects lie in less than all the features of the individual embodiments disclosed above. Therefore, the claims that follow the specific embodiment are hereby expressly incorporated into the specific embodiment, with each claim itself serving as a separate embodiment of the present invention.

[0110] Those skilled in the art will appreciate that the modules in the devices in the embodiments may be adaptively changed and arranged in one or more devices different from the embodiments. The modules or units or components in the embodiments may be combined into one module or unit or component, and in addition they may be divided into a plurality of submodules or subunits or subcomponents. Except that at least some of such features and / or processes or units are mutually exclusive, all features disclosed in this specification (including the accompanying claims, abstracts and drawings) and all processes or units of any method or device disclosed in this manner may be combined in any combination. Unless otherwise expressly stated, each feature disclosed in this specification (including the accompanying claims, abstracts and drawings) may be replaced by an alternative feature providing the same, equivalent or similar purpose.

[0111] The various component embodiments of the present invention may be implemented in hardware, or in software modules running on one or more processors, or in a combination thereof. It should be understood by those skilled in the art that a microprocessor or digital signal processor (DSP) may be used in practice to implement some or all of the functions of some or all of the components in the sorting device according to the present invention. The present invention may also be implemented as a device or apparatus program for executing part or all of the methods described herein. Such a program for implementing the present invention may be stored on a computer-readable medium, or may be in the form of one or more signals. Such a signal may be downloaded from an Internet website, or provided on a carrier signal, or provided in any other form.

[0112] It should be noted that the above embodiments illustrate the present invention rather than limit it, and that those skilled in the art may devise alternative embodiments without departing from the scope of the appended claims. In the claims, any reference symbol between brackets shall not be construed as a limitation on the claims. The word "comprising" does not exclude the presence of elements or steps not listed in the claims. The word "one" or "an" preceding an element does not exclude the presence of a plurality of such elements. The present invention may be implemented by means of hardware comprising a number of different elements and by means of a suitably programmed computer. In a unit claim enumerating a number of devices, several of these devices may be embodied by the same hardware item. The use of the words first, second, and third, etc., does not indicate any order. These words may be interpreted as names.

[0113] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0114] It should be noted that all actions of acquiring signals, information or data in this application are carried out in compliance with the relevant data protection laws and policies of the country where they are located and with the authorization given by the owner of the corresponding device.

[0115] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

[0116] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any person skilled in the art can easily think of changes or substitutions within the technical scope disclosed by the present invention, which should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

Claims

1. A security authentication method, It is characterized in that Applied to a security authentication device, the method comprises: When receiving a network access application request sent by a terminal, parsing the network access application request based on a link access layer of the wireless network to obtain network access information of the terminal; Sending the network access information to the authentication server, and obtaining the authentication result returned by the authentication server; the authentication result is obtained by the authentication server performing security authentication based on the network access information and the authentication information pre-stored by the authentication server; According to the authentication result, a target operation corresponding to the authentication result is performed on the network access application request of the terminal.

2. The method according to claim 1, It is characterized in that The performing, according to the authentication result, a target operation corresponding to the authentication result on the network access application request of the terminal includes: When the authentication result is successful, determining that the target operation is to transmit the network access application request to the data processing layer of the wireless network; the data processing layer is used to perform an address allocation operation and a key allocation operation based on the network access application request; When the authentication result is authentication failure, determining the target operation is to reject the network access application request of the terminal.

3. The method according to claim 2, It is characterized in that After the network access application request is transmitted to the data processing layer of the wireless network, the method further comprises: Acquire network information of the target network assigned by the data processing layer; the network information includes a network address and a key; The network address and the key are sent to the terminal; the network address and the key are used for the terminal to access the target network.

4. The method according to claim 1, It is characterized in that The network access information includes the target identity information of the terminal; the authentication server is used to: Acquire authentication information pre-stored by the authentication server; the authentication information includes identity information of each authenticated terminal; When the target identity information of the terminal matches the identity information of any authenticated terminal in the authentication information, determining that the authentication result is successful authentication; In a case where the target identity information of the terminal does not match the identity information of any authenticated terminal in the authentication information, it is determined that the authentication result is an authentication failure.

5. The method according to claim 1, It is characterized in that The link access layer based on the wireless network parses the network access application request to obtain the network access information of the terminal, including: Based on the target function provided by the link access layer of the wireless network, the network access application request is parsed and the network access information of the terminal is obtained.

6. The method according to claim 1, It is characterized in that The link access layer of the wireless network includes the media access control layer of the Zigbee protocol network or the bearer layer of the Bluetooth Mesh protocol network.

7. A security authentication device, It is characterized in that Applied to security authentication equipment, the device comprises: A first parsing module is used to parse the network access application request sent by the terminal based on the link access layer of the wireless network to obtain the network access information of the terminal when receiving the network access application request sent by the terminal; A first acquisition module is used to send the network access information to the authentication server and obtain the authentication result returned by the authentication server; the authentication result is obtained by the authentication server performing security authentication based on the network access information and the authentication information pre-stored by the authentication server; The first processing module is used to perform a target operation corresponding to the authentication result on the network access application request of the terminal according to the authentication result.

8. The device according to claim 7, It is characterized in that The first processing module comprises: A first determination module is used to determine, when the authentication result is successful authentication, that the target operation is to transmit the network access application request to the data processing layer of the wireless network; the data processing layer is used to perform an address allocation operation and a key allocation operation based on the network access application request; The second determining module is used to determine that the target operation is to reject the network access application request of the terminal when the authentication result is authentication failure.

9. An electronic device, It is characterized in that include: A processor, a memory, and a computer program stored in the memory and executable on the processor, wherein the processor implements the security authentication method as described in any one of claims 1 to 6 when executing the program.

10. A readable storage medium, It is characterized in that When the instructions in the storage medium are executed by a processor of an electronic device, the electronic device is enabled to execute the security authentication method described in any one of claims 1-6.

Images