Wireless local area network switching authentication method and system

Abstract

The invention discloses a wireless local area network switching authentication method and system, and relates to the technical field of network communication. The switching efficiency of a wireless local area network switching process can be improved. The method is applied to a wireless local area network switching authentication system, the system further comprises a terminal, a base station and an authentication server, the authentication server stores switching keys of a plurality of terminals passing authentication of the authentication server, and the method comprises the following steps: after receiving a terminal authentication request sent by a target terminal, a target base station sends the terminal authentication request to the terminal; a first request is sent to the authentication server, the first request is used for requesting to obtain a target switching key of the target terminal, and the terminal authentication request is generated by the target terminal based on the local switching key; and after receiving the target switching key of the target terminal sent by the authentication server, the target base station generates verification information according to the target switching key, verifies the terminal authentication request according to the verification information, and performs data interaction with the target terminal after the verification is passed.

Description

Technical Field

[0001] The present application relates to the field of network communication technology, and in particular to a wireless local area network switching authentication method and system. Background Art

[0002] In many application scenarios of industrial Internet, such as business scenarios involving mobile terminals such as inspection robots, the terminals have data continuity requirements when roaming and switching between different base stations during movement. Whether it is high-definition video backhaul, information collection and detection, or remote control applications, there is a demand for short switching delay and uninterrupted data.

[0003] At present, the authentication method in wireless LAN switching is mainly based on the pre-authentication mechanism proposed by WAPI. The main idea of ​​pre-authentication is that the terminal performs a two-way authentication process between the terminal and the target access point through the wireless path between the terminal and the source access point, which is equivalent to having performed authentication with the target access point before switching to the target access point. This results in the current authentication method in the wireless LAN switching process, which cannot meet the demand for low switching service interruption delay while solving security problems. Summary of the invention

[0004] The present application provides an authentication method, apparatus, device and medium in wireless local area network switching, which can improve the switching efficiency of the wireless local area network switching process.

[0005] In order to achieve the above purpose, this application adopts the following technical solutions: In a first aspect of an embodiment of the present application, a wireless local area network handover authentication method is provided, which is applied to a wireless local area network handover authentication system, wherein the system further includes: a terminal, a base station, and an authentication server, wherein the authentication server stores handover keys of multiple terminals authenticated by the authentication server, and the method includes: After receiving the terminal authentication request sent by the target terminal, the target base station sends a first request to the authentication server, where the first request is used to request to obtain the target switching key of the target terminal, and the terminal authentication request is generated by the target terminal based on the local switching key; After receiving the target switching key of the target terminal sent by the authentication server, the target base station generates verification information according to the target switching key, verifies the terminal authentication request according to the verification information, and interacts with the target terminal after the verification is passed.

[0006] As a possible implementation manner, before the target base station receives the terminal authentication request sent by the target terminal, the method further includes: When the target terminal accesses the base station for the first time, the authentication server authenticates the identity information of the target terminal; After determining that the target terminal has passed authentication, the base station generates a session key for communicating with the target terminal and a handover key for the target terminal; The switching key is sent to the target terminal and the authentication server for storage.

[0007] As a possible implementation manner, before the target base station receives the terminal authentication request sent by the target terminal, the method further includes: When the authentication server detects that a base station accesses for the first time, it uses the digital certificate of the base station to authenticate the base station, and exchanges data with the base station after the authentication is successful.

[0008] As a possible implementation manner, after the target base station receives the target switching key of the target terminal sent by the authentication server, the method further includes: The target base station generates a session key according to the target switching key, and sends the session key to the target terminal. The session key is used for data encryption during data interaction between the target base station and the target terminal.

[0009] As a possible implementation manner, the verifying the terminal authentication request according to the verification information includes: After the verification is passed, the target base station sends a response message to the target terminal, where the response message includes the verification information; The target terminal verifies the verification information in the response information according to the local switching password, and exchanges data with the target base station based on the session key after the verification is passed.

[0010] As a possible implementation manner, when the target terminal accesses the base station for the first time, using the authentication server to authenticate the identity information of the target terminal includes: When the target terminal accesses the base station for the first time, the target terminal sends an access authentication request to the base station, wherein the access authentication request includes a terminal digital certificate; After receiving the access authentication request, the base station sends the terminal digital certificate to the authentication server; The authentication server verifies the terminal digital certificate.

[0011] As a possible implementation manner, after the base station receives the access authentication request, the method further includes: If the base station accesses the authentication server for the first time, sending the terminal digital certificate and the base station digital certificate of the base station to the authentication server; The authentication server verifies the terminal digital certificate and the base station digital certificate.

[0012] In a second aspect of the embodiment of the present application, a wireless local area network handover authentication system is provided, the system further comprising: a terminal, a base station and an authentication server, the authentication server storing handover keys of multiple terminals authenticated by the authentication server; The target base station is configured to send a first request to the authentication server after receiving a terminal authentication request sent by the target terminal, wherein the first request is used to request to obtain a target switching key of the target terminal, and the terminal authentication request is generated by the target terminal based on the local switching key; The target base station is also used to generate verification information according to the target switching key after receiving the target switching key of the target terminal sent by the authentication server, verify the terminal authentication request according to the verification information, and interact with the target terminal after the verification is passed.

[0013] As a possible implementation manner, the target terminal is used to authenticate the identity information of the target terminal using the authentication server when accessing the base station for the first time; The base station is further configured to generate a session key for communicating with the target terminal and a switching key of the target terminal after determining that the target terminal has passed the authentication, and send the switching key to the target terminal and the authentication server for storage.

[0014] As a possible implementation manner, the authentication server is further used to authenticate the base station using the digital certificate of the base station when detecting that the base station accesses for the first time, and to interact with the base station for data after the authentication is successful.

[0015] The beneficial effects brought by the technical solution provided by the embodiment of the present application include at least: The wireless local area network handover authentication method provided by the embodiment of the present application is applied to the wireless local area network handover authentication system. The system also includes: a terminal, a base station and an authentication server. The authentication server stores the handover keys of multiple terminals authenticated by the authentication server. During the authentication process, after receiving the terminal authentication request sent by the target terminal, the target base station sends a first request to the authentication server. The first request is used to request to obtain the target handover key of the target terminal. The terminal authentication request is generated by the target terminal based on the local handover key. After receiving the target handover key of the target terminal sent by the authentication server, the target base station generates verification information according to the target handover key, verifies the terminal authentication request according to the verification information, and interacts with the target terminal after the verification is passed. In the initial two-way authentication process, the terminal and the base station respectively derive the handover key of the terminal in the wireless local area network handover authentication method provided by the embodiment of the present application. The base station saves the handover key to the authentication server. The handover key can be used as one of the results of the initial authentication and authentication for subsequent terminal authentication. The authentication and authentication process does not need to be completely redone during the subsequent terminal authentication, which can improve the switching efficiency of the wireless local area network handover process. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 A structural diagram of a wireless local area network switching authentication system provided in an embodiment of the present application; Figure 2 A wireless local area network switching authentication method provided in the embodiment of the present application Figure 1 ; Figure 3 A wireless local area network switching authentication method provided in the embodiment of the present application Figure 2 . DETAILED DESCRIPTION

[0017] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0018] In the following, the terms "first" and "second" are used for descriptive purposes only and are not to be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of the features. In the description of the embodiments of the present disclosure, unless otherwise specified, "plurality" means two or more.

[0019] Additionally, the use of “based on” or “according to” is meant to be open and inclusive, as a process, step, calculation, or other action “based on” or “according to” one or more conditions or values ​​may, in practice, be based on additional conditions or beyond values.

[0020] In many application scenarios of industrial Internet, such as business scenarios involving mobile terminals such as inspection robots, the terminals have data continuity requirements when roaming and switching between different base stations during movement. Whether it is high-definition video backhaul, information collection and detection, or remote control applications, there is a demand for short switching delay and uninterrupted data.

[0021] At present, the authentication method in wireless LAN handover is mainly based on the pre-authentication mechanism proposed by WAPI. The main idea of ​​pre-authentication is that the terminal performs a two-way authentication process between the terminal and the target access point through the wireless path between the terminal and the source access point, which is equivalent to having performed authentication between the terminal and the target access point before switching to the target access point. The technical mechanism of pre-authentication still has obvious technical defects, mainly including the following points: First, the pre-authentication technology is highly dependent on the terminal's discovery mechanism of the target access point. Since the terminal's mobile path has a strong uncertainty, it is very likely that the candidate access point that interacts with the terminal in the pre-authentication process is not the access point that the terminal finally switches to. When switching to the real access point, it is still necessary to re-authenticate; second, the pre-authentication technology occupies the wireless link between the terminal and the source access point for transmission interaction, which affects the normal communication between the terminal and the source access point; third, it is necessary to add a new communication interface and protocol between the access points of the wireless LAN, making the network structure interaction of the wireless LAN more complicated; fourth, after pre-authentication, the terminal will generate relevant authentication information, which may cause the terminal to need to manage and maintain the authentication information of multiple access points in the network at the same time, increasing the complexity and burden of the terminal. That is to say, the current authentication method in the wireless LAN switching process can not meet the demand of short switching service interruption delay while solving the security problem.

[0022] In order to solve the above problems, the present invention proposes an authentication method, device, equipment and medium in wireless local area network switching, which realizes that almost no additional delay is introduced for authentication during the switching process. In order to solve the problem that the authentication delay of the existing wireless local area network system during switching is large, which seriously affects the business, the present invention proposes a fast authentication scheme during the switching process, which can reduce the roaming and re-authentication delay of the wireless local area network during the switching process, and greatly improve the switching roaming efficiency of the wireless local area network.

[0023] The present application embodiment provides a wireless local area network switching authentication system, such as Figure 1As shown, the system includes: a terminal 10, a base station 20 and an authentication server 30, wherein the authentication server 30 stores the switching keys of multiple terminals 10 authenticated by the authentication server 30. There may be multiple terminals 10 and base stations 20. The wireless terminal 10 transmits and receives data with the base station 20 via wireless signals; the base station 20 transmits and receives data with the terminal via wireless signals on the one hand, and exchanges data with the authentication server 30 via wired connection on the other hand; the authentication server 30 is responsible for performing authentication functions on the terminals 10 and base stations 20 in the wireless network.

[0024] Based on the wireless local area network handover authentication system provided above, the present application embodiment provides a wireless local area network handover authentication method, such as Figure 2 As shown, the method comprises the following steps: Step 201: After receiving a terminal authentication request sent by a target terminal, the target base station sends a first request to the authentication server, where the first request is used to request to obtain a target switching key of the target terminal, and the terminal authentication request is generated by the target terminal based on a local switching key.

[0025] It should be noted that after the terminal passes the authentication of the authentication server for the first time, a switching key is generated, and the terminal and the corresponding switching key are stored in correspondence.

[0026] The first request includes the IP address of the terminal. After receiving the first request, the authentication server obtains the switching key of the target terminal from the storage address of the corresponding switching password according to the IP address in the first request.

[0027] Optionally, the terminal authentication request is generated by inputting a local switching key of the terminal into a key generation algorithm.

[0028] Step 202: After receiving the target switching key of the target terminal sent by the authentication server, the target base station generates verification information according to the target switching key, verifies the terminal authentication request according to the verification information, and interacts with the target terminal after the verification is passed.

[0029] The target base station includes a key generation algorithm that is the same as the terminal authentication algorithm, and the verification information is generated by inputting the target switching key into the key generation algorithm.

[0030] Optionally, the process of verifying the terminal authentication request according to the verification information may be: comparing the verification information and the terminal authentication request to see if they are consistent; if they are consistent, the target terminal authentication is passed; if they are inconsistent, the target terminal authentication is failed.

[0031] In the actual implementation process, when the terminal completes the first authentication and generates the handover password at other base stations, and performs secure data transmission, the handover process is triggered as the terminal moves. After the terminal completes the random access process with the target base station, it generates a new session key based on the handover key and the key derivation algorithm, generates a terminal authentication request based on the handover key, and sends it to the target base station.

[0032] After receiving the terminal authentication request, the target base station initiates a switching key information query process to the authentication server. If the switching key information query is successful, the target base station uses the switching key to generate verification information through the key derivation algorithm. At the same time, the target base station authenticates the terminal in response to the terminal authentication request sent by the terminal. This is because the challenge information of the terminal is generated based on the switching key. If the terminal authentication passes, a capability negotiation response message is constructed and sent to the terminal. The capability negotiation response message includes verification information. After receiving the capability negotiation response message, the terminal authenticates the base station based on the verification information carried in the message. After the verification passes, the new session key takes effect. Both parties use the new session key for secure data transmission on the wireless interface.

[0033] The wireless local area network switching authentication method provided by the embodiment of the present application is applied to the wireless local area network switching authentication system. The system also includes: a terminal, a base station and an authentication server. The authentication server stores the switching keys of multiple terminals authenticated by the authentication server. During the authentication process, after receiving the terminal authentication request sent by the target terminal, the target base station sends a first request to the authentication server. The first request is used to request to obtain the target switching key of the target terminal. The terminal authentication request is generated by the target terminal based on the local switching key. After receiving the target switching key of the target terminal sent by the authentication server, the target base station generates verification information according to the target switching key, verifies the terminal authentication request according to the verification information, and interacts with the target terminal after the verification is passed. In the initial two-way authentication process, the terminal and the base station respectively derive the switching key of the terminal in the wireless local area network switching authentication method provided by the embodiment of the present application. The base station saves the switching key to the authentication server. The switching key is one of the results of the initial authentication and can be applied to subsequent terminal authentications. There is no need to completely redo the authentication and authentication process for subsequent terminal authentications.

[0034] Optionally, before executing step 201, the target base station receives the terminal authentication request sent by the target terminal, as follows: Figure 3 As shown, the method also includes: Step 301: When the target terminal accesses a base station for the first time, the authentication server is used to authenticate the identity information of the target terminal.

[0035] Specifically, when the target terminal accesses a base station for the first time, the process of authenticating the identity information of the target terminal by using the authentication server may be: When the target terminal accesses the base station for the first time, it sends an access authentication request to the base station, wherein the access authentication request includes a terminal digital certificate; after receiving the access authentication request, the base station sends the terminal digital certificate to the authentication server; the authentication server verifies the terminal digital certificate.

[0036] Optionally, before the target base station receives the terminal authentication request sent by the target terminal in step 201, the method further includes: When the authentication server detects that a base station accesses for the first time, it uses the digital certificate of the base station to authenticate the base station, and exchanges data with the base station after the authentication is successful.

[0037] Step 302: After determining that the target terminal has passed authentication, the base station generates a session key for communicating with the target terminal and a handover key for the target terminal; Step 303: Send the switching key to the target terminal and the authentication server for storage.

[0038] In the actual implementation process, when the terminal accesses the base station through the air interface, the base station sends an "Authentication Activation Request" message to the terminal to start the entire authentication process. After receiving the message, the terminal sends an "Access Authentication Request" message to the base station, which includes information such as the terminal identity, terminal digital certificate, and key exchange parameters; after receiving the "Access Authentication Request" message from the terminal, the base station sends a "Certificate Authentication Request" message to the authentication server, which includes information such as the terminal certificate and the base station certificate. After receiving the "Certificate Authentication Request", the authentication server verifies the base station certificate and the terminal certificate. After the verification is completed, the authentication server forms a "Certificate Authentication Response" message with the terminal certificate authentication result information and the base station certificate authentication result information, and sends it to the base station. After receiving the message, the base station verifies the terminal certificate authentication result and sends an "Access Authentication Response" message to the terminal. After receiving the "Access Authentication Response" message, the terminal verifies the base station certificate authentication result information and generates relevant keys, including information such as session keys (keys used for data encryption and decryption), and generates switching keys (used for subsequent switching). And sends an "Authentication Activation Response" message to the base station. After receiving the "Authentication Activation Response", the base station generates relevant keys, including session keys (keys used for data encryption and decryption) and other information, and also generates handover keys (for subsequent handovers), and sends a "Key Information Update" message to the authentication server, which contains the generated handover keys. The authentication server will store the handover keys for use when the terminal subsequently switches to roaming authentication. Data between the terminal and the base station is encrypted and transmitted using the session keys generated during authentication.

[0039] Optionally, after the target base station receives the target switching key of the target terminal sent by the authentication server, the method further includes: The target base station generates a session key according to the target switching key, and sends the session key to the target terminal. The session key is used for data encryption during data interaction between the target base station and the target terminal.

[0040] Optionally, the verifying the terminal authentication request according to the verification information includes: After the verification is successful, the target base station sends a response message to the target terminal, wherein the response message includes the verification information; the target terminal verifies the verification information in the response message according to the local switching password, and after the verification is successful, performs data interaction with the target base station based on the session key.

[0041] The wireless local area network switching authentication method provided in the embodiment of the present application requires a switching key to be derived and generated during the initial two-way authentication process when the terminal and the base station derive the keys. After the initial authentication process is completed, the base station will send the switching key to the authentication server for storage. When the terminal roams and switches to a new target base station, the target base station obtains the switching key through a switching key query process with the authentication server. The authentication when the terminal switches roaming is equivalent to the terminal and the base station respectively using the switching key as a reference, each calculating an authentication information based on the switching key, and both parties use the authentication information they have calculated to carry in the existing network access signaling message and send it to the other party for verification. After the verification is passed, the fast authentication is completed.

[0042] The wireless LAN switching authentication method provided in the embodiment of the present application is used in scenarios such as substations, converter stations, and switchgear stations. As equipment detection becomes more refined, more and more information needs to be collected, and more and more mobile inspection equipment (i.e., terminals) are used. Inspections of substations, converter stations, switchgear stations, and other scenarios are carried out by inspection personnel using visual helmets, inspection robots, inspection drones, mobile operations, etc., which can greatly improve inspection efficiency and personnel safety, and are of great significance in promoting the intelligent upgrade of power systems. Since mobile inspection equipment uses local wireless LANs for wireless data transmission, it is inevitable that the problem of switching across wireless access points will be encountered during the movement process. Therefore, through the method and system for rapid authentication, the delay problem in the switching process can be effectively reduced, and the problem of data communication interruption in the mobile inspection equipment during the switching process can be reduced.

[0043] The wireless local area network switching authentication system provided in the embodiment of the present application is as follows: Figure 1 As shown, the system includes: a terminal 10, a base station 20 and an authentication server 30, wherein the authentication server 30 stores the switching keys of multiple terminals 10 authenticated by the authentication server 30; The target base station 20 is configured to send a first request to the authentication server 30 after receiving the terminal 10 authentication request sent by the target terminal 10, wherein the first request is used to request to obtain a target switching key of the target terminal 10, and the terminal 10 authentication request is generated by the target terminal 10 based on the local switching key; The target base station 20 is also used to generate verification information according to the target switching key after receiving the target switching key of the target terminal 10 sent by the authentication server 30, verify the authentication request of the terminal 10 according to the verification information, and interact with the target terminal 10 after the verification is passed.

[0044] In one embodiment, the target terminal 10 is used to authenticate the identity information of the target terminal 10 using the authentication server 30 when accessing the base station 20 for the first time; The base station 20 is further configured to generate a session key for communicating with the target terminal 10 and a switching key of the target terminal 10 after determining that the target terminal 10 has passed the authentication, and send the switching key to the target terminal 10 and the authentication server 30 for storage.

[0045] In one embodiment, the authentication server 30 is further configured to authenticate the base station 20 using the digital certificate of the base station 20 when detecting that the base station 20 accesses for the first time, and to interact with the base station 20 for data after the authentication is successful.

[0046] In one embodiment, the target base station 20 is further used to generate a session key based on the target switching key and send the session key to the target terminal 10. The session key is used for data encryption during data interaction between the target base station 20 and the target terminal 10.

[0047] In one embodiment, after the verification is passed, the target base station 20 is further configured to send a response message to the target terminal 10, wherein the response message includes the verification information; The target terminal 10 is further configured to verify the verification information in the response information according to the local switching password, and to perform data exchange with the target base station 20 based on the session key after the verification is passed.

[0048] In one embodiment, the target terminal 10 is specifically configured to send an access authentication request to the base station 20 when accessing the base station 20 for the first time, wherein the access authentication request includes a digital certificate of the terminal 10; The base station 20 is specifically configured to send the digital certificate of the terminal 10 to the authentication server 30 after receiving the access authentication request; The authentication server 30 is specifically used to verify the digital certificate of the terminal 10.

[0049] In one embodiment, the base station 20 is also used to send the digital certificate of the terminal 10 and the base station 20 digital certificate of the base station 20 to the authentication server 30 if the base station 20 accesses the authentication server 30 for the first time; the authentication server 30 verifies the digital certificate of the terminal 10 and the digital certificate of the base station 20.

[0050] The specific limitations of the wireless LAN handover authentication system may refer to the limitations of the wireless LAN handover authentication method mentioned above, which will not be described in detail here.

[0051] In another embodiment of the present application, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps of the wireless local area network switching authentication method in the embodiment of the present application are implemented.

[0052] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using a software program, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer execution instruction is loaded and executed on the computer, the process or function according to the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instruction can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instruction can be transmitted from a website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (digital subscriber line, DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server or data center. The computer-readable storage medium can be any available medium that can be accessed by the computer or a data storage device such as a server, data center, etc. that contains one or more servers that can be integrated with the medium. The available medium may be a magnetic medium (eg, a floppy disk, a hard disk, a magnetic tape), an optical medium (eg, a DVD), or a semiconductor medium (eg, a solid state disk (SSD)).

[0053] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0054] The above embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the invention patent. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the patent of the present application shall be subject to the attached claims.

Claims

1. A wireless local area network handover authentication method, characterized in that: Applied to a wireless local area network handover authentication system, the system further includes: a terminal, a base station and an authentication server, the authentication server stores handover keys of multiple terminals authenticated by the authentication server, and the method includes: After receiving the terminal authentication request sent by the target terminal, the target base station sends a first request to the authentication server, where the first request is used to request to obtain the target switching key of the target terminal, and the terminal authentication request is generated by the target terminal based on the local switching key; After receiving the target switching key of the target terminal sent by the authentication server, the target base station generates verification information according to the target switching key, verifies the terminal authentication request according to the verification information, and interacts with the target terminal after the verification is passed.

2. The method according to claim 1, characterized in that Before the target base station receives the terminal authentication request sent by the target terminal, the method further includes: When the target terminal accesses the base station for the first time, the authentication server authenticates the identity information of the target terminal; After determining that the target terminal has passed authentication, the base station generates a session key for communicating with the target terminal and a handover key for the target terminal; The switching key is sent to the target terminal and the authentication server for storage.

3. The method according to claim 1, characterized in that Before the target base station receives the terminal authentication request sent by the target terminal, the method further includes: When the authentication server detects that a base station accesses for the first time, it uses the digital certificate of the base station to authenticate the base station, and exchanges data with the base station after the authentication is successful.

4. The method according to claim 1, characterized in that After the target base station receives the target switching key of the target terminal sent by the authentication server, the method further includes: The target base station generates a session key according to the target switching key, and sends the session key to the target terminal. The session key is used for data encryption during data interaction between the target base station and the target terminal.

5. The method according to claim 4, characterized in that The verifying the terminal authentication request according to the verification information includes: After the verification is passed, the target base station sends a response message to the target terminal, where the response message includes the verification information; The target terminal verifies the verification information in the response information according to the local switching key, and exchanges data with the target base station based on the session key after the verification is passed.

6. The method according to claim 2, characterized in that When the target terminal accesses the base station for the first time, the authentication server is used to authenticate the identity information of the target terminal, including: When the target terminal accesses the base station for the first time, the target terminal sends an access authentication request to the base station, wherein the access authentication request includes a terminal digital certificate; After receiving the access authentication request, the base station sends the terminal digital certificate to the authentication server; The authentication server verifies the terminal digital certificate.

7. The method according to claim 6, characterized in that After the base station receives the access authentication request, the method further includes: If the base station accesses the authentication server for the first time, sending the terminal digital certificate and the base station digital certificate of the base station to the authentication server; The authentication server verifies the terminal digital certificate and the base station digital certificate.

8. A wireless local area network switching authentication system, characterized in that: The system further comprises: a terminal, a base station and an authentication server, wherein the authentication server stores switching keys of a plurality of terminals authenticated by the authentication server; The target base station is configured to send a first request to the authentication server after receiving a terminal authentication request sent by the target terminal, wherein the first request is used to request to obtain a target switching key of the target terminal, and the terminal authentication request is generated by the target terminal based on the local switching key; The target base station is also used to generate verification information according to the target switching key after receiving the target switching key of the target terminal sent by the authentication server, verify the terminal authentication request according to the verification information, and interact with the target terminal after the verification is passed.

9. The system according to claim 8, characterized in that The target terminal is used to authenticate the identity information of the target terminal using the authentication server when accessing the base station for the first time; The base station is further configured to generate a session key for communicating with the target terminal and a switching key of the target terminal after determining that the target terminal has passed the authentication, and send the switching key to the target terminal and the authentication server for storage.

10. The system according to claim 8, characterized in that The authentication server is further used to authenticate the base station using the digital certificate of the base station when detecting that the base station accesses for the first time, and to interact with the base station for data after the authentication is passed.

Images