A wireless local area network system with enhanced security

Abstract

The present invention discloses a security-enhanced wireless local area network system, comprising: a key management system, a gateway device, an access device and a field device; the key management system is connected to the gateway device through a switch, the gateway device is connected to the access device, and the access device is connected to the field device; the gateway device, the access device and the field device are integrated with an encryption chip. The key management system is connected to the gateway device through a switch, the gateway device is connected to the access device by wire, and the access device is connected to the field device wirelessly; the gateway device, the access device and the field device are integrated with an encryption chip; hardware and software dual encryption mechanisms are supported; the device first performs identity authentication before entering the network, and after passing the authentication, it performs key negotiation with the key management system based on the SM2 encryption algorithm to ensure network security and enhance the protection of the legitimacy of the devices in the network and the security of data transmission.

Description

Technical Field

[0001] The present invention relates to the technical field of network security, and in particular to a wireless local area network system with enhanced security. Background Art

[0002] In recent years, with the continuous development and widespread application of wireless technology, the requirements for the legitimacy of access devices and the security of wireless data transmission have become increasingly important. In a wireless LAN, there are three devices: gateway devices (GW), access devices (AD), and field devices (FD). Currently, the legitimacy of device access to the network is queried by MAC information, which poses a great risk. The encryption keys for wireless data of FD and AD mainly use preset keys, which not only poses a risk of being stolen, but is also not conducive to timely key updates. Therefore, it is necessary to propose a security-enhanced wireless LAN system to solve the above problems. Summary of the invention

[0003] The present invention provides a wireless local area network system with enhanced security, so as to enhance the protection of the legality of equipment in the network and the security of data transmission.

[0004] The present invention provides a security-enhanced wireless local area network system, comprising: a key management system, a gateway device, an access device and a field device; the key management system is connected to the gateway device via a switch, the gateway device is connected to the access device by wire, and the access device is connected to the field device by wireless; the gateway device, the access device and the field device are integrated with an encryption chip;

[0005] When the gateway device accesses the WIA-FA network, it first performs identity authentication with the key management system to verify the legitimacy of the gateway device; if the authentication is successful, access to the WIA-FA network is allowed; otherwise, access is prohibited; the legitimate gateway device negotiates keys with the key management system to generate a unicast key between the gateway device and the key management system, and the unicast key is used to encrypt data between the key management system and the gateway device; the gateway device is used to forward data between the access device, the field device and the key management system; store key information of the access device and the field device; perform traffic monitoring and special packet monitoring, and immediately trigger the device re-authentication function when traffic anomalies and special packets are detected;

[0006] When the access device accesses the WIA-FA network, it first performs identity authentication with the gateway device through the encryption chip; if the authentication is successful, the gateway device forwards its own and the access device's information to the key management system for secondary authentication, and if the authentication is successful, the access device is allowed to access the WIA-FA network; then the access device and the key management system negotiate a key based on the national secret SM2 encryption algorithm, and both parties generate a unicast key for the access device; the key management system sends the unicast key of the access device to the gateway device, so that encrypted data transmission can be performed between the access device and the gateway device; the access device and the gateway device support data encryption, and hardware encryption and software encryption support are optional; if the gateway device stores the unicast key of the field device, the gateway device encrypts the unicast key of the field device using the unicast keys of the gateway device and the access device and transmits it to the access device, so that the access device can perform encrypted data transmission with the field device;

[0007] When the field device accesses the WIA-FA network, it first performs identity authentication with the access device through the encryption chip; after the authentication is passed, the access device forwards its own and the field device's information to the key management system through the gateway device for secondary authentication. After the authentication is passed, the field device is allowed to access the WIA-FA network; then the field device and the key management system negotiate keys based on the SM2 encryption algorithm, and both parties generate a unicast key for the field device; the key management system sends the unicast key of the field device to the gateway device, and the gateway device encrypts the unicast key of the field device and sends it to the access device, so that the access device and the field device can perform encrypted communication; the field device and the access device support data encryption, and hardware encryption and software encryption support are optional.

[0008] Furthermore, the field device supports multicast keys, which are used to encrypt data sent by the access device to multiple field devices; the multicast keys are generated by the access device and the key management system using the SM2 encryption algorithm and stored in the gateway device; the access device uses the unicast key of the field device to encrypt and send it to the field device; when a new field device is connected, the access device encrypts the multicast key and sends it to the field device.

[0009] Furthermore, the authentication status and key of the gateway device, access device and field device are set with a valid period; when the authentication status of the gateway device, access device or field device exceeds the valid period, it will be automatically re-authenticated; when the key exceeds the valid period, it will be automatically renegotiated to generate a new key.

[0010] Furthermore, the gateway device is the WIA-FA network device manager and provides a management interface as a host computer; the host computer is used to configure the authentication validity period and key validity period of each device in the network; and specifies the devices in the network to re-initiate the identity authentication and key negotiation process.

[0011] Furthermore, the gateway device is used to manage and control the unicast keys negotiated between the field devices and the key management system, encrypt the unicast keys negotiated between the field devices and the key management system, and synchronize them to the effective access devices in the WIA-FA network, thereby realizing the fast roaming function of the field devices in the network.

[0012] The present invention has the following beneficial effects: the security-enhanced wireless local area network system of the present invention comprises: a key management system, a gateway device, an access device and a field device; the key management system is connected to the gateway device via a switch, the gateway device is wired to the access device, and the access device is wirelessly connected to the field device; the gateway device, the access device and the field device are integrated with encryption chips; hardware and software dual encryption mechanisms are supported; the device first performs identity authentication before accessing the network, and after passing the authentication, performs key negotiation with the key management system based on the SM2 encryption algorithm to ensure network security and enhance the protection of the legitimacy of the devices in the network and the security of data transmission. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] In order to more clearly illustrate the technical solution of the present invention, the drawings required for use in the embodiments are briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0014] Figure 1 This is an architectural diagram of the security-enhanced wireless local area network system provided by the present invention. DETAILED DESCRIPTION

[0015] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described in conjunction with the specific embodiments of the present invention and the corresponding drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention. The technical solutions provided by the embodiments of the present invention are described in detail below in conjunction with the drawings.

[0016] See also Figure 1, a security-enhanced wireless local area network system provided in an embodiment of the present invention, the system includes a key management system (Key Management System, KMS), a gateway device (Gateway Device, GW), an access device (Access Device, AD) and a field device (Field Device, FD). The key management system is connected to the gateway device through a switch, the gateway device is connected to the access device by wire, and the access device is connected to the field device wirelessly; all devices have integrated encryption chips and support hardware and software dual encryption mechanisms. The device first performs identity authentication before joining the network, and after passing the authentication, it negotiates keys with the KMS based on the national encryption algorithm to ensure network security. The overall encryption and authentication architecture is as follows Figure 1 ,In the figure, the solid line represents a wired connection, and the dotted line represents a wireless connection.

[0017] In this embodiment, when GW accesses the WIA-FA network, it first performs identity authentication with KMS to verify its legitimacy. If the authentication is successful, access to the network is allowed; otherwise, access is prohibited. The legitimate GW negotiates keys with KMS to generate a unicast key between GW and KMS for encrypting data between KMS and GW. GW has three functions: responsible for forwarding data between AD, FD and KMS; storing key information of AD and FD; performing traffic monitoring and special packet monitoring. When traffic anomalies and special packets are detected, the device re-authentication function is immediately triggered to prevent the network from being attacked by illegal devices.

[0018] In this embodiment, the access devices are numbered as AD1~ADn in the access order. When AD1 accesses the network, it first performs identity authentication with the GW through the encryption chip. After the authentication is successful, the GW forwards its own and AD1's information to the KMS for secondary authentication. If the authentication is successful, AD1 is allowed to access the network. After that, AD1 and KMS conduct a key negotiation based on the national secret SM2 algorithm, and both parties generate the same unicast key, namely the unicast key of AD1. KMS sends the key to the GW, so that encrypted data can be transmitted between AD and GW. AD and GW support data encryption, and can perform additional software encryption on the basis of hardware encryption to further improve the security of transmitted data. Hardware encryption and software encryption support are optional. If the unicast key of FD is stored in GW, GW will encrypt the unicast key of FD using the unicast keys of GW and AD1 and then pass it to AD1, so that it can perform encrypted data transmission with FD.

[0019] In this embodiment, after AD2 and ADn access the network, they execute the same process as AD1.

[0020] In this embodiment, the field devices are numbered as FD1~FDn in the order of access. When FD1 accesses the network, it first performs identity authentication with AD1 through the encryption chip. After the authentication is passed, AD1 forwards its own and FD1's information to KMS through GW for secondary authentication. After the authentication is passed, FD1 is allowed to access the network. After that, FD1 and KMS negotiate keys based on the SM2 algorithm, and both parties generate FD1's unicast key. KMS sends the unicast key to GW, and GW encrypts the unicast key and sends it to AD1. At this time, AD1 has FD1's unicast key, so that the two parties can communicate encrypted. FD1 and AD1 support data encryption. Software encryption can be added on the basis of hardware encryption and support is optional, which can further improve the security of wireless data transmission.

[0021] In this embodiment, FD supports multicast keys, which are used to encrypt data sent by AD1 to multiple FD groups. The multicast key is generated by AD1 and KMS using the SM2 encryption algorithm and stored in the GW. AD1 uses the FD's unicast key to encrypt and send it to the FD. When a new AD is connected, the GW will send the multicast key to the AD. When a new FD is connected, the AD will encrypt and send the multicast key to the FD.

[0022] In this embodiment, after FD2 and FDn access the network, they execute the same process as FD1.

[0023] In this embodiment, the authentication state of the device and the validity period of the key are as follows: when the authentication state of the device expires, it will automatically re-authenticate; when the key expires, it will automatically renegotiate to generate a new key.

[0024] In this embodiment, GW acts as a WIA-FA network device manager and provides a management interface for the management platform, i.e., the host computer. The host computer can configure the authentication validity period and key validity period of each device in the network; and can flexibly specify the devices in the network to re-initiate the identity authentication and key negotiation process.

[0025] In this embodiment, the GW device in the network can manage the unicast key negotiated between the FD and the KMS, encrypt the unicast key, and synchronize it to the valid AD device in the network, so as to realize the fast roaming function of the FD device in the network.

[0026] It can be seen from the above embodiments that in the security-enhanced wireless LAN system of the present invention, KMS is responsible for managing device certificates, authentication and key negotiation in the entire network. In addition to authentication with GW, AD will also authenticate with KMS. In addition to authentication with AD, FD will also authenticate with KMS to ensure the legitimacy of the device and prevent access and attacks by illegal devices. The key for wireless transmission is generated inside the device and will not be transmitted wirelessly, so it will not be intercepted, ensuring the security of the encryption key. GW can monitor traffic and identify special packets. When traffic anomalies are found and illegal data packets are detected, it will immediately trigger the device to re-initiate authentication to prevent the network from being attacked by illegal devices.

[0027] As a network manager, GW provides a management interface for the host computer, which can flexibly configure network device authentication and key validity period; manage WIA-FA network devices. The security-enhanced wireless local area network system of the present invention can enhance the protection of the legitimacy of devices in the network and the security of data transmission.

[0028] The above-described embodiments of the present invention do not limit the protection scope of the present invention.

Claims

1. A security-enhanced wireless local area network system, characterized in that: include: Key management systems, gateway devices, access devices, and field devices; The key management system is connected to the gateway device via a switch, the gateway device is connected to the access device via a wired connection, and the access device is connected to the field device via a wireless connection; the gateway device, the access device and the field device are integrated with an encryption chip; When the gateway device accesses the WIA-FA network, it first performs identity authentication with the key management system to verify the legitimacy of the gateway device; If the authentication is successful, access to the WIA-FA network is allowed; Otherwise, access is prohibited; The legitimate gateway device performs key negotiation with the key management system to generate a unicast key between the gateway device and the key management system, wherein the unicast key is used to encrypt data between the key management system and the gateway device; The gateway device is used to forward data between the access device, the field device and the key management system; store the key information of the access device and the field device; perform flow monitoring and special packet monitoring, and immediately trigger the device re-authentication function when abnormal flow and special packets are detected; When the access device accesses the WIA-FA network, it first performs identity authentication with the gateway device through the encryption chip; if the authentication is successful, the gateway device forwards its own and the access device's information to the key management system for secondary authentication, and if the authentication is successful, the access device is allowed to access the WIA-FA network; After that, the access device and the key management system conduct key negotiation based on the national secret SM2 encryption algorithm, and both parties generate the unicast key of the access device; The key management system sends the unicast key of the access device to the gateway device, so that encrypted data transmission can be carried out between the access device and the gateway device; Access devices and gateway devices support data encryption, with hardware encryption and software encryption optional; If the gateway device stores the unicast key of the field device, the gateway device encrypts the unicast key of the field device using the unicast keys of the gateway device and the access device and transmits the encrypted key to the access device, so that the access device can perform encrypted data transmission with the field device. When the field device accesses the WIA-FA network, it first performs identity authentication with the access device through the encryption chip; After passing the authentication, the access device forwards its own and the field device's information to the key management system through the gateway device for secondary authentication. After passing the authentication, the field device is allowed to access the WIA-FA network; Afterwards, the field device and the key management system negotiate a key based on the SM2 encryption algorithm, and both parties generate a unicast key for the field device; The key management system sends the unicast key of the field device to the gateway device, and the gateway device encrypts the unicast key of the field device and sends it to the access device, so that the access device and the field device can communicate encrypted; the field device and the access device support data encryption, and hardware encryption and software encryption support are optional.

2. A security-enhanced wireless local area network system as claimed in claim 1, characterized in that: The field devices support multicast keys, which are used to encrypt data sent by the access device to multiple field devices. The multicast keys are generated by the access device and the key management system using the SM2 encryption algorithm and stored in the gateway device. The access device uses the unicast key of the field device to encrypt and send it to the field device. When a new field device is connected, the access device encrypts the multicast key and sends it to the field device.

3. A security-enhanced wireless local area network system as claimed in claim 1, characterized in that: The authentication status and key setting validity period of the gateway device, access device and field device; when the authentication status of the gateway device, access device or field device exceeds the validity period, it will automatically re-authenticate; When the key expires, a new key will be automatically renegotiated.

4. A security-enhanced wireless local area network system as claimed in claim 1, characterized in that: The gateway device is the WIA-FA network device manager and provides a management interface as a host computer. The host computer is used to configure the authentication validity period and key validity period of each device in the network and to specify the devices in the network to re-initiate the identity authentication and key negotiation process.

5. The security-enhanced wireless local area network system according to claim 1, characterized in that: The gateway device is used to manage and control the unicast keys negotiated between the field devices and the key management system. After encrypting the unicast keys negotiated between the field devices and the key management system, it synchronizes them to the valid access devices in the WIA-FA network to realize the fast roaming function of the field devices in the network.

Images