Terminal authentication test method and device and electronic equipment

Abstract

The invention provides a terminal authentication test method and device and electronic equipment, and the method comprises the steps: obtaining EAP-SIM configuration information of WIFI terminal authentication, and transmitting a first authentication packet comprising the EAP-SIM configuration information to an authentication subsystem through a wireless access point; receiving a second authentication packet sent by the authentication subsystem based on the first authentication packet through the wireless access point, wherein the second authentication packet comprises a random number and an attribute message authentication code; performing EAP authentication on the authentication subsystem based on the random number and the message authentication code of the attribute, and generating a message authentication code of signature response under the condition that the authentication is passed; sending a message authentication code of the signature response to the authentication subsystem through the wireless access point; and receiving WIFI terminal authentication success information sent by the authentication subsystem through the wireless access point. The EAP-SIM authentication test method and system are easy to implement, cost is saved, the test efficiency of EAP-SIM authentication is improved, and high expansibility is achieved.

Description

Technical Field

[0001] The present invention relates to the field of mobile communications, and in particular to a terminal authentication testing method, device and electronic equipment. Background Art

[0002] Open source Hongmeng is an open source project incubated and operated by the Open Atom Open Source Foundation. It aims to build a framework and platform for an operating system for smart terminal devices to promote the prosperity and development of the Internet of Things industry.

[0003] Extensible Authentication Protocol-Subscriber Identity Module (EAP-SIM) is an authentication and authorization protocol based on SIM cards. It is widely used for authentication in wireless fidelity (WIFI) networks and is a basic function of terminal WIFI. Open source Hongmeng terminals need to support WIFI functions in development, and also need to support EAP-SIM authentication to meet customer security needs.

[0004] In the related art, the test of EAP-SIM user authentication is very complicated, and it is necessary to build a wireless station (STA), a wireless access point (AP, Access Point), a wireless controller (AC, Access Control), an authentication, authorization and accounting (AAA, Authentication, Authorization, and Accounting) server and a home location register (HLR, Home Location Register) to work together, which is costly. When setting up the environment, R&D personnel need to master the A3 (calculating the signature response sres from the key identifier Ki and the random number RAND) and A8 (calculating the confidentiality key kc from Ki and RAND) algorithms, and configure them in the home location register (HLR, Home Location Register). The technical difficulty is relatively large, and a large amount of manpower and material resources are required, thereby increasing the cost.

[0005] Therefore, how to simplify the construction environment of EAP-SIM user authentication test, reduce costs, and meet the needs of EAP-SIM authentication test of various WIFI terminals in different systems under limited resources is a problem to be solved. Summary of the invention

[0006] The present invention provides a terminal authentication test method, device and electronic device to at least solve the problem in the related art that the environment construction in the EAP-SIM user authentication test is relatively complex, requiring a lot of manpower and material resources, resulting in increased costs. The technical solution of the present invention is as follows:

[0007] According to a first aspect of an embodiment of the present invention, a terminal authentication test method is provided, the method being applied to a WIFI terminal subsystem, comprising:

[0008] Get the Extensible Authentication Protocol-Subscriber Identity Module (EAP-SIM) configuration information for Wi-Fi terminal authentication;

[0009] Sending a first authentication packet including the EAP-SIM configuration information to the authentication subsystem through a wireless access point;

[0010] Receiving, through the wireless access point, a second authentication packet sent by the authentication subsystem based on the first authentication packet, the second authentication packet including: a message authentication code of a random number and an attribute;

[0011] Performing EAP authentication on the authentication subsystem based on the random number and the attributed message authentication code, and generating a message authentication code for a signed response if the authentication passes;

[0012] Sending the message authentication code of the signature response to the authentication subsystem through the wireless access point;

[0013] The wireless access point receives information indicating successful authentication of the WIFI terminal sent by the authentication subsystem.

[0014] Optionally, the obtaining of EAP-SIM configuration information for WIFI terminal authentication includes:

[0015] Obtaining EAP-SIM configuration information for WIFI terminal authentication through a Wi-Fi command line interface, wherein the EAP-SIM configuration information includes: a confidentiality key and a signature response;

[0016] The secret key is stored in an internal secret key variable, and the signed response is stored in an internal signed response variable.

[0017] Optionally, before receiving, through the wireless access point, a second authentication packet sent by the authentication subsystem based on the first authentication packet, the method further includes:

[0018] An EAP-SIM internal response function is added in advance to the network request function so as to authenticate the type of EAP, wherein the EAP-SIM internal response function is provided with an external SIM response variable including a confidentiality key and a signature response.

[0019] Optionally, performing EAP authentication on the authentication subsystem based on the random number and the message authentication code of the attribute, and generating a message authentication code of a signed response when the authentication passes, includes:

[0020] When determining that the type of EAP authentication is EAP-SIM by using the network request function based on the second authentication packet, obtaining a confidentiality key and a signature response in an EAP-SIM internal response function;

[0021] Based on the secret key and the random number, a message authentication code of the attribute is calculated using a control response function;

[0022] When the calculated message authentication code of the attribute is the same as the value of the message authentication code of the attribute included in the second authentication package, it is confirmed that the authentication of the authentication subsystem is passed, and the message authentication code MAC_SRES of the signature response is calculated according to the signature response.

[0023] According to a second aspect of an embodiment of the present invention, a terminal authentication test method is provided, the method being applied to an authentication subsystem, comprising:

[0024] Receiving, through a wireless access point, a first authentication packet including EAP-SIM configuration information sent by a WIFI terminal; processing the EAP-SIM configuration information in the first authentication packet to generate a message authentication code with attributes;

[0025] Sending a second authentication packet to the WIFI terminal through the wireless access point, wherein the second authentication packet includes: a message authentication code of a random number and an attribute;

[0026] A message authentication code of a signed response sent by the WIFI terminal is received through the wireless access point;

[0027] Authenticating the WIFI terminal based on the message authentication code of the signature response;

[0028] When the authentication is successful, the wireless access point sends authentication success information to the WIFI terminal.

[0029] Optionally, the processing the EAP-SIM configuration information in the first authentication package to generate a message authentication code with attributes includes:

[0030] Generate a message authentication code with attributes according to the confidentiality key and identity identifier of the EAP-SIM configuration information and a random number.

[0031] Optionally, authenticating the WIFI terminal based on the message authentication code of the signature response includes:

[0032] Get the key in the signed response;

[0033] generating a message authentication code for the signed response based on the key and the signed response;

[0034] When the value of the message authentication code of the generated signature response is the same as the value of the message authentication code of the received signature response, it is confirmed that the WIFI terminal has passed the authentication.

[0035] Optionally, the key in the get-signature response includes:

[0036] Get the key in the signed response from the SIM database or memory or storage card.

[0037] Optionally, the method further includes:

[0038] Pre-select and configure multiple groups of EAP-SIM parameters, each group of EAP-SIM parameters includes: an international mobile user identity code, a confidentiality key, a signature response and a random number;

[0039] Each set of configured EAP-SIM parameters is stored in the SIM database or in the memory or storage card.

[0040] According to a third aspect of an embodiment of the present invention, a terminal authentication test device is provided, the device being applied to a WIFI terminal subsystem, comprising:

[0041] The acquisition module is used to obtain the EAP-SIM configuration information of the WIFI terminal authentication;

[0042] A first sending module, configured to send a first authentication packet including the EAP-SIM configuration information to an authentication subsystem through a wireless access point;

[0043] A first receiving module is configured to receive, through the wireless access point, a second authentication packet sent by the authentication subsystem based on the first authentication packet, wherein the second authentication packet includes: a message authentication code of a random number and an attribute;

[0044] An authentication module, configured to perform EAP authentication on the authentication subsystem based on the random number and the attributed message authentication code; and to generate a message authentication code for a signed response when the authentication module passes the authentication;

[0045] A second sending module, configured to send the message authentication code of the signature response to the authentication subsystem through the wireless access point;

[0046] The second receiving module is used to receive the information of successful authentication of the WIFI terminal sent by the authentication subsystem through the wireless access point.

[0047] Optionally, the acquisition module includes:

[0048] A configuration information acquisition module, used to obtain EAP-SIM configuration information for WIFI terminal authentication through a Wi-Fi protected access command line interface, wherein the EAP-SIM configuration information includes: a confidentiality key and a signature response;

[0049] A storage module is used to store the secret key into an internal secret key variable and store the signature response into an internal signature response variable.

[0050] Optionally, before receiving, through the wireless access point, a second authentication packet sent by the authentication subsystem based on the first authentication packet, the apparatus further includes:

[0051] The adding module is used to pre-add an EAP-SIM internal response function to the network request function so as to authenticate the type of EAP, wherein the EAP-SIM internal response function is provided with an external SIM response variable including a confidentiality key and a signature response.

[0052] Optionally, the authentication module includes:

[0053] A first calling module is used to obtain a confidentiality key and a signature response in an EAP-SIM internal response function when determining that the type of the EAP authentication of the second authentication package is EAP-SIM by using a network request function;

[0054] A calculation module, used to calculate a message authentication code of an attribute using a control response function based on the secret key and the random number;

[0055] A generation module is used to confirm that the authentication of the authentication subsystem is successful when the message authentication code of the attribute calculated by the calculation module is the same as the value of the message authentication code of the attribute included in the second authentication package, and calculate the message authentication code of the signature response based on the signature response.

[0056] According to a fourth aspect of an embodiment of the present invention, a terminal authentication test device is provided, the device being applied to an authentication subsystem, comprising:

[0057] A first receiving module, configured to receive, through a wireless access point, a first authentication packet sent by a WIFI terminal and including the EAP-SIM configuration information;

[0058] A processing module, configured to process the EAP-SIM configuration information in the first authentication package to generate a message authentication code with attributes;

[0059] A first sending module, configured to send a second authentication packet to the WIFI terminal through the wireless access point, wherein the second authentication packet includes: a message authentication code of a random number and an attribute;

[0060] A second receiving module is used to receive the message authentication code of the signature response sent by the WIFI terminal through the wireless access point;

[0061] An authentication module, used to authenticate the WIFI terminal based on the message authentication code of the signature response;

[0062] The second sending module is used to send authentication success information to the WIFI terminal through the wireless access point when the authentication is successful.

[0063] Optionally, the processing module is specifically configured to generate a message authentication code with attributes according to a confidentiality key and an identity identifier of the EAP-SIM configuration information, and a random number.

[0064] Optionally, the authentication module includes:

[0065] The key acquisition module is used to obtain the key in the signature response;

[0066] A message authentication module, used to generate a message authentication code of a signed response based on the key key and the signed response SRES;

[0067] The confirmation module is used to confirm that the WIFI terminal has passed the authentication when the message authentication code of the generated signature response is the same as the value of the message authentication code of the received signature response.

[0068] Optionally, the key acquisition module is specifically configured to acquire the key in the signature response from a SIM database or a memory or a storage card.

[0069] Optionally, the device further comprises:

[0070] A configuration module, used for pre-selecting and configuring a plurality of groups of EAP-SIM parameters, each group of EAP-SIM parameters including: an international mobile subscriber identity, a confidentiality key, a signature response and a random number;

[0071] The storage module is used to store each group of EAP-SIM parameters configured by the pre-configuration module in a SIM database or a memory or a storage card.

[0072] According to a fifth aspect of an embodiment of the present invention, there is provided an electronic device, including:

[0073] processor;

[0074] a memory for storing instructions executable by the processor;

[0075] The processor is configured to execute the instructions to implement the terminal authentication test method as described above.

[0076] According to a sixth aspect of an embodiment of the present invention, a computer-readable storage medium is provided. When instructions in the computer-readable storage medium are executed by a processor of an electronic device, the electronic device is enabled to perform the terminal authentication test method as described above.

[0077] According to a seventh aspect of an embodiment of the present invention, there is provided a computer program product, comprising a computer program or instructions, which, when executed by a processor of an electronic device, implements the terminal authentication test method as described above.

[0078] The technical solution provided by the embodiments of the present invention brings at least the following beneficial effects:

[0079] In an embodiment of the present invention, EAP-SIM configuration information for WIFI terminal authentication is obtained, and a first authentication package including the EAP-SIM configuration information is sent to an authentication subsystem through a wireless access point; a second authentication package sent by the authentication subsystem based on the first authentication package is received through the wireless access point, and the second authentication package includes: a message authentication code of a random number and an attribute; EAP authentication is performed on the authentication subsystem based on the random number and the attribute message authentication code, and a message authentication code of a signed response is generated if the authentication passes; the message authentication code of the signed response is sent to the authentication subsystem through the wireless access point; and information that the WIFI terminal authentication is successful and sent by the authentication subsystem is received through the wireless access point. That is to say, in the embodiment of the present invention, the WIFI terminal subsystem sends the EAP-SIM configuration information of the WIFI terminal authentication to the authentication subsystem for authentication through the wireless access point, and performs EAP authentication on the authentication subsystem based on the message authentication code of the random number and attribute fed back by the authentication subsystem. When the authentication is successful, a message authentication code of a signature response is generated, which is sent to the authentication system to verify the WIFI terminal based on the message authentication code of the signature response, thereby solving the problem of complex environment construction in the current EAP-SIM test, and meeting the needs of EAP-SIM authentication testing of various WIFI terminals under various systems (such as the open source Hongmeng system, Android system, and Linux system, etc.). The present invention is simple to implement, saves costs, improves the test efficiency of EAP-SIM authentication, and has strong scalability.

[0080] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0081] The drawings herein are incorporated into the specification and constitute a part of the specification, showing embodiments consistent with the present invention, and are used together with the specification to explain the principles of the present invention, and do not constitute an improper limitation of the present invention. In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the drawings required for use in the embodiments or the prior art description will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0082] Figure 1 The present invention provides a flow chart of a terminal authentication testing method.

[0083] Figure 2 It is an application schematic diagram of a terminal authentication test method provided by an embodiment of the present invention.

[0084] Figure 3 This is another flow chart of a terminal authentication testing method provided by an embodiment of the present invention.

[0085] Figure 4 This is another application schematic diagram of a terminal authentication testing method provided by an embodiment of the present invention.

[0086] Figure 5 The present invention provides a block diagram of a terminal authentication test device according to an embodiment of the present invention.

[0087] Figure 6 This is another block diagram of a terminal authentication testing device provided by an embodiment of the present invention.

[0088] Figure 7 The present invention provides a block diagram of a terminal authentication test system.

[0089] Figure 8 It is a block diagram of an electronic device provided by an embodiment of the present invention.

[0090] Fig. 9 The invention is a block diagram of a device for testing terminal authentication provided by an embodiment of the invention. DETAILED DESCRIPTION

[0091] In order to enable ordinary persons in the art to better understand the technical solutions of the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings.

[0092] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present invention. Instead, they are merely examples of devices and methods consistent with some aspects of the present invention as detailed in the appended claims.

[0093] Technical terms:

[0094] The Extensible Authentication Protocol-Subscriber Identity Module (EAP-SIM) authentication mechanism provides an authentication and key distribution mechanism based on the Global System for Mobile Communications-SIM (GSM-SIM) card. Based on the GSM one-way authentication, it provides two-way authentication, that is, the server authenticates the client, and the client also authenticates the server. Only after the two-way authentication is passed, the server sends an EAP-Success message to the client, and the client can access the wireless network.

[0095] On the basis of understanding the above technical terms, please refer to the following embodiments.

[0096] Figure 1 is a flow chart of a terminal authentication test method provided by an embodiment of the present invention, wherein the method is applied to a WIFI terminal subsystem, such as Figure 1 As shown, the method includes:

[0097] Step 101: Obtain EAP-SIM configuration information for WIFI terminal authentication.

[0098] Step 102: Send a first authentication packet including the EAP-SIM configuration information to the authentication subsystem through a wireless access point.

[0099] Step 103: A second authentication packet sent by the authentication subsystem based on the first authentication packet is received through the wireless access point, wherein the second authentication packet includes: a random number and an attribute message authentication code.

[0100] Step 104: Perform EAP authentication on the authentication subsystem based on the random number and the attribute message authentication code, and generate a message authentication code of a signed response if the authentication passes.

[0101] Step 105: Send the message authentication code of the signature response to the authentication subsystem through the wireless access point.

[0102] Step 106: Receive the information that the WIFI terminal authentication is successful, which is sent by the authentication subsystem, through the wireless access point.

[0103] The terminal authentication test method described in the present invention can be applied to terminals, servers, etc., without limitation herein. The terminal implementation device can be an electronic device such as a smart phone, a laptop computer, a tablet computer, a desktop computer, a personal digital assistant (PDA, Personal Digital Assistant) and a wearable device. The server can be an independent server or a server cluster, or a server that provides cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, intermediate services, domain name services, security services, content distribution networks, or a big data and artificial intelligence platform, etc., without limitation herein.

[0104] Combine the following Figure 1 , the specific implementation steps of a terminal authentication test method provided by an embodiment of the present invention are described in detail.

[0105] In step 101, EAP-SIM configuration information for WIFI terminal authentication is obtained.

[0106] In this step, EAP-SIM configuration information for WIFI terminal authentication can be obtained through the Wi-Fi protected access command line interface, and the EAP-SIM configuration information includes: a confidentiality key and a signature response, and may also include information such as an identity identifier; and the confidentiality key is stored in an internal confidentiality key variable, and the signature response is stored in an internal signature response variable.

[0107] In this embodiment, wpa_cli in the WIFI terminal subsystem is responsible for sending relevant configuration information of EAP-SIM to wpa_supplicant, and initiating an EAP-SIM connection request based on the relevant configuration information of EAP-SIM. In this embodiment, wpa_cli and wpa_supplicant can communicate through Unix Socket. Of course, in specific applications, it is not limited to this and other communication methods can also be used, which is not limited in this embodiment.

[0108] Specifically, the Wi-Fi protected access client (wpa_supplicant, referred to as the WIFI terminal in this embodiment, the same below) in the WIFI terminal subsystem receives the kc parameter value issued by the Wi-Fi protected access command line interface (wpa_cli) in the WIFI terminal subsystem, and saves the value of the confidentiality key (kc, Key for Confidentiality) to the kc internal confidentiality key variable (eapsim_params); and when receiving the signature response (sres) parameter value issued by wpa_cli, save the sres parameter value to the sres internal signature response variable (eapsim_params). And

[0109] After receiving the EAP_SIM connection request (including ssid, key_mgmt, eap, identity, set_external_sim) sent by wpa_cli, the WIFI terminal processes the relevant EAP-SIM authentication process on the WIFI terminal side, that is, processes the EAP / Identity and EAP / SIM / Start processes, that is, executes step 102.

[0110] It should be noted that the Wi-Fi protected access client in this embodiment, also called a Wi-Fi client, is a Wi-Fi terminal used by a user, referred to as a Wi-Fi terminal.

[0111] In step 102, a first authentication packet including the EAP-SIM configuration information is sent to an authentication subsystem via a wireless access point.

[0112] In this step, after obtaining the EAP-SIM configuration information for WIFI terminal authentication, the WIFI terminal can send a first authentication package including the EAP-SIM configuration information to the wireless access point through the WIFI air interface. The first authentication package can also be called an EAP-SIM authentication package, etc. The wireless access point forwards the received first authentication package to the authentication subsystem for authentication through the Remote Authentication Dial-in User Service (Radius) protocol.

[0113] The authentication subsystem performs a process of authenticating the WIFI terminal based on the first authentication package, that is, the authentication subsystem obtains relevant parameters in the EAP-SIM from the configuration file, and performs EAP-SIM authentication related processes based on the relevant parameters in the EAP-SIM and the Radius protocol package forwarded by the wireless access point, that is, generates an attribute message authentication code according to the confidentiality key kc and identity identifier of the EAP-SIM configuration information, and a random number, and then sends a second authentication package to the wireless access point through the Radius protocol, and the second authentication package includes: a random number and an attribute message authentication code.

[0114] In step 103, a second authentication packet sent by the authentication subsystem based on the first authentication packet is received through the wireless access point, and the second authentication packet includes: a random number and an attribute message authentication code.

[0115] In this step, the WIFI terminal receives, through the wireless access point, a second authentication packet sent by the authentication subsystem based on the first authentication packet, wherein the second authentication packet includes: a random number and an attribute message authentication code.

[0116] In step 104, EAP authentication is performed on the authentication subsystem based on the random number and the attribute message authentication code, and if the authentication is successful, a message authentication code of a signed response is generated.

[0117] In this step, the WIFI terminal determines whether the type of EAP authentication is EAP-SIM based on the second authentication package by using the network request function, and obtains the confidentiality key kc and the signature response sres in the internal response function of EAP-SIM when the type of EAP authentication is determined to be EAP-SIM; calculates the message authentication code of the attribute by using the control response function based on the confidentiality key kc and the random number; then, determines whether the value of the message authentication code calculated for the attribute is the same as the value of the message authentication code of the attribute included in the second authentication package; when the value of the message authentication code calculated for the attribute is the same as the value of the message authentication code of the attribute included in the second authentication package, confirms that the authentication of the authentication subsystem is passed, and calculates the message authentication code MAC_SRES of the signature response according to the signature response sres.

[0118] In step 105, the message authentication code of the signature response is sent to the authentication subsystem through the wireless access point.

[0119] In this step, the WIFI terminal sends the message authentication code of the signature response to the authentication subsystem through the wireless access point, and the authentication subsystem authenticates the WIFI terminal based on the message authentication code MAC_SRES of the signature response. If the authentication is successful, a message indicating that the WIFI terminal has been successfully authenticated is sent to the WIFI terminal subsystem; specifically, the key key in the signature response SRES is obtained; the message authentication code MAC_SRES of the signature response is generated based on the key key and the signature response SRES; when the value of the message authentication code of the generated signature response is the same as the value of the message authentication code of the received signature response, it is confirmed that the WIFI terminal has passed the authentication, and if the authentication is passed, authentication success information is sent to the WIFI terminal through the wireless access point.

[0120] In step 106, the information indicating successful authentication of the WIFI terminal sent by the authentication subsystem is received through the wireless access point.

[0121] In this step, the WIFI terminal receives the information of successful authentication of the WIFI terminal sent by the authentication subsystem through the wireless access point.

[0122] In an embodiment of the present invention, EAP-SIM configuration information for WIFI terminal authentication is obtained, and a first authentication package including the EAP-SIM configuration information is sent to an authentication subsystem through a wireless access point; a second authentication package sent by the authentication subsystem based on the first authentication package is received through the wireless access point, and the second authentication package includes: a message authentication code of a random number and an attribute; EAP authentication is performed on the authentication subsystem based on the random number and the attribute message authentication code, and a message authentication code of a signed response is generated when the authentication is successful; the message authentication code of the signed response is sent to the authentication subsystem through the wireless access point; and information that the WIFI terminal authentication is successful and sent by the authentication subsystem is received through the wireless access point. That is to say, in the embodiment of the present invention, the WIFI terminal subsystem sends the EAP-SIM configuration information of the WIFI terminal authentication to the authentication subsystem for authentication through the wireless access point, and performs EAP authentication on the authentication subsystem based on the message authentication code of the random number and attribute fed back by the authentication subsystem. When the authentication is successful, a message authentication code of a signature response is generated, which is sent to the authentication system to verify the WIFI terminal based on the message authentication code of the signature response, thereby solving the problem of complex environment construction in the current EAP-SIM test, and meeting the needs of EAP-SIM authentication testing of various WIFI terminals under various systems (such as the open source Hongmeng system, Android system, and Linux system, etc.). The present invention is simple to implement, saves costs, improves the test efficiency of EAP-SIM authentication, and has strong scalability.

[0123] Optionally, in another embodiment, based on the above embodiment, before receiving, through the wireless access point, a second authentication package sent by the authentication subsystem based on the first authentication package, the method may further include: pre-adding an EAP-SIM internal response function to the network request function to authenticate the type of EAP, wherein the EAP-SIM internal response function is provided with an external SIM response variable including a confidentiality key and a signature response.

[0124] The embodiment of the present invention optimizes wpa_supplicant in the WIFI terminal subsystem, so that it receives kc and sres sent by wpa_cli and saves related parameters in the memory, that is, saves the value of kc to the kc internal confidentiality key variable (eapsim_params); saves the value of sres to the sres internal signature response variable (eapsim_params). So that after receiving the EAP-Request / SIM / Challenge message, wpa_supplicant adds an EAP-SIM internal response function (wpas_send_network_

[0125] eapsim_gsmauth_response_internal) to process EAP-SIM authentication. The EAP-SIM internal response function is provided with external SIM response variables including a confidentiality key and a signed response.

[0126] See also Figure 2 , is an application diagram of a terminal authentication test method provided by an embodiment of the present invention. In this embodiment, taking wpa_supplicant for EAP-SIM authentication as an example, this method is applied to a WIFI terminal subsystem, and the WIFI terminal subsystem includes: a Wi-Fi protected access client (wpa_supplicant) and a Wi-Fi protected access command line interface (wpa_cli), specifically including:

[0127] Step 000: Start;

[0128] Step 200: wpa_supplicant receives the confidentiality key (kc) value issued by wpa_cli, and saves the value of the confidentiality key kc into the internal confidentiality key variable (eapsim_params.kc);

[0129] Step 201: wpa_supplicant receives the value of the signature response (sres) sent by wpa_cli, and saves the value of sres into the internal signature response variable (eapsim_params.sres);

[0130] Step 202: wpa_supplicant receives an Extensible Authentication Protocol-Subscriber Identity Module (EAP_SIM) connection request sent by wpa_cli, wherein the EAP_SIM connection request may include: wireless network name (ssid), key management (key_mgmt), Extensible Authentication Protocol (eap), identity (identity), external user identity (set_external_sim), etc.;

[0131] Step 203: wpa_supplicant processes EAP / Identity and EAP / SIM / Start processes;

[0132] In this step, wpa_supplicant initiates the relevant EAP-SIM authentication process on the WIFI terminal side to the authentication subsystem through the wireless access point AP.

[0133] That is, wpa_supplicant sends an EAP-SIM authentication package to the wireless access point AP, and the AP parses the EAP-SIM authentication package and forwards it to the authentication subsystem through the Remote Authentication Dial-up User Service (Radius) protocol; the authentication subsystem generates information such as the attribute message authentication code (AT_MAC) based on the EAP-SIM authentication package and feeds it back to the wireless access point AP. When the AP receives the response to the Radius protocol package sent by the authentication subsystem, it parses it and forwards it to the wpa_supplicant of the WIFI terminal subsystem through the WIFI air interface.

[0134] Step 204: wpa_supplicant receives an extensible authentication protocol request EAP-Request sent by the AP. The EAP-Request may include a SIM and a Challenge message. The EAP-Request includes information such as a random number (RAND) and an attribute message authentication code (AT_MAC).

[0135] Step 205: wpa_supplicant uses the network request function (wpas_notify_network_request) to determine whether the type of EAP authentication is Extensible Authentication Protocol-Subscriber Identity Token (EAP-SIM): if the type of EAP authentication is EAP-SIM, execute step 206; if the type of EAP authentication is not EAP-SIM, execute back to step 204.

[0136] Step 206: wpa_supplicant calls the EAP-SIM internal response function (wpas_send_network_eapsim_gsmauth_response_internal).

[0137] Step 207: wpas_send_network_eapsim_gsmauth_response_internal sets the external SIM response variable (external_sim_resp) and calls the control response function (eapol_sm_notify_ctrl_response).

[0138] Among them, the external SIM response variable (external_sim_resp) is the authentication of the Global System for Mobile Communications GSM-AUTH:kc:sres:kc:sres:kc:sres.

[0139] Step 208: Use the control response function (eapol_sm_notify_ctrl_response) to process related processes; and calculate the message authentication code of the attribute.

[0140] In this step, wpa_supplicant uses the control response function to calculate the attribute message authentication code based on the kc and random number in the external SIM response variable. Specifically, K_aut, K_encr, MSK, EMSK can be obtained through the GSM-specific algorithm based on parameters such as kc, identity and RAND, and then the AT_MAC value can be calculated through the HMAC-SHA1 algorithm based on parameters such as K_aut. The specific calculation process is already a well-known technology and will not be repeated here.

[0141] The GSM-specific algorithm may be A3, A8 or A5, etc., which is not limited in this embodiment.

[0142] Step 209: wpa_supplicant calculates the attribute message authentication code AT_MAC value and compares it with the attribute message authentication code AT_MAC value received in step 204; if AT_MAC is the same, execute step 210; if AT_MAC is different, return to step 204;

[0143] In this step, wpa_supplicant obtains K_aut, K_encr, MSK, EMSK through a GSM-specific algorithm based on parameters such as kc, identity and RAND, and then calculates AT_MAC through the HMAC-SHA1 algorithm based on parameters such as K_aut, and compares it with the AT_MAC value received in step 204.

[0144] Step 210: wpa_supplicant authenticates the authentication subsystem, calculates the message authentication code (MAC_SRES) of the signature response according to the content of sres and EAP Packet, and sends an extensible authentication protocol response EAP-Response / user identity SIM / Challenge message to the authentication subsystem through the AP.

[0145] In this step, wpa_supplicant authenticates the authentication subsystem and calculates the message authentication code (MAC_SRES) of the signature response based on the content of sres and EAP Packet using the HMAC-SHA1 algorithm.

[0146] Among them, HMAC-SHA1 is a keyed hash algorithm constructed from the SHA1 hash function, which is usually used as a hash-based message authentication code (HMAC). This HMAC process mixes the key with the message data, uses a hash function to hash the mixed result, mixes the resulting hash value with the key, and then applies the hash function again. The hash value output is usually 160 bits long. In other words, HMAC-SHA1 can process keys of any size and produce a hash sequence with a length of 160 bits. Its processing process is already a well-known technical technology to those skilled in the art, and will not be repeated here.

[0147] Step 211: wpa_supplicant receives an EAP-Success message of the Extensible Authentication Protocol (EAP) success sent by the AP forwarding authentication subsystem to the WIFI terminal;

[0148] Step 212: The EAP-SIM authentication process ends.

[0149] See also Figure 3 , is another flow chart of a terminal authentication test method provided by an embodiment of the present invention, the method is applied to an authentication subsystem, and includes:

[0150] Step 301: receiving a first authentication packet including the EAP-SIM configuration information sent by a WIFI terminal through a wireless access point;

[0151] In this step, the authentication subsystem receives a first authentication package including the EAP-SIM configuration information sent by the WIFI terminal through a wireless access point; wherein the EAP-SIM configuration information in the first authentication package may include information such as kc, sres, and identity identification.

[0152] Step 302: Process the EAP-SIM configuration information in the first authentication package to generate a message authentication code with attributes;

[0153] In this step, when the authentication subsystem receives the first authentication packet, it will randomly generate a random number. After that, the authentication subsystem generates a message authentication code with attributes according to the confidentiality key kc and identity identifier of the EAP-SIM configuration information and the random number.

[0154] Specifically, the authentication subsystem obtains K_aut, K_encr, MSK, EMSK and other parameters through the GSM-specific algorithm according to parameters such as kc, identity and RAND, and then calculates AT_MAC and other information through the HMAC-SHA1 algorithm according to parameters such as K_aut. The specific GSM-specific algorithm and HMAC-SHA1 algorithm are described above and will not be repeated here.

[0155] Step 303: Sending a second authentication packet to the WIFI terminal through the wireless access point, wherein the second authentication packet includes: a random number and an attribute message authentication code;

[0156] In this step, the authentication subsystem can send a second authentication package to the WIFI terminal through the wireless access point. The WIFI terminal performs EAP authentication on the authentication subsystem based on the random number and attribute message authentication code in the received second authentication package. If the authentication is successful, a message authentication code for a signed response is generated, and the message authentication code for the signed response is sent to the authentication subsystem through the wireless access point. The specific authentication process is detailed in the implementation process of the corresponding embodiment above, which will not be repeated here.

[0157] Step 304: receiving a message authentication code MAC_SRES of a signature response sent by the WIFI terminal through the wireless access point;

[0158] In this step, the authentication subsystem receives the message authentication code of the signature response sent by the WIFI terminal through the wireless access point.

[0159] Step 305: Authenticate the WIFI terminal based on the message authentication code MAC_SRES of the signature response;

[0160] In this step, the authentication subsystem obtains the key key in the signature response SRES; specifically, the key key in the signature response SRES can be obtained from the SIM database or memory or storage card. Afterwards, the authentication subsystem generates a message authentication code MAC_SRES of the signature response based on the key key and the signature response SRES; its specific generation process is already a well-known technology and will not be repeated here. Afterwards, the authentication subsystem determines whether the value of the message authentication code of the generated signature response is the same as the value of the message authentication code of the received signature response, and when the value of the message authentication code of the generated signature response is the same as the value of the message authentication code of the received signature response, it is confirmed that the WIFI terminal has passed the authentication.

[0161] Step 306: When the authentication is successful, send authentication success information to the WIFI terminal through the wireless access point.

[0162] When confirming that the WIFI terminal has passed the authentication, the authentication subsystem sends authentication success information to the WIFI terminal through the wireless access point.

[0163] In an embodiment of the present invention, after receiving an authentication package including EAP-SIM configuration information sent by the WIFI terminal subsystem through the wireless access point, the authentication subsystem generates a message authentication code with attributes based on the EAP-SIM configuration information in the authentication package, and feeds it back to the WIFI terminal subsystem, and when receiving a message authentication code of a signature response sent by the WIFI terminal subsystem through the wireless access point, the WIFI terminal is subjected to EAP authentication based on the message authentication code of the signature response, and when the authentication is passed, authentication success information is sent to the WIFI terminal through the wireless access point, thereby solving the problem of complex environment construction in the current EAP-SIM test, and meeting the requirements of EAP-SIM authentication tests of various WIFI terminals under various systems (such as an open source Hongmeng system, an Android system, and a Linux system, etc.). The present invention is simple to implement, saves costs, improves the test efficiency of EAP-SIM authentication, and has strong scalability.

[0164] Optionally, in another embodiment, based on the above embodiment, the method may further include: pre-configuring multiple groups of EAP-SIM parameters, each group of EAP-SIM parameters including: an international mobile user identity code, a confidentiality key, a signature response and a random number; i.e., IMSI:kc:sres:RAND; and storing each configured group of EAP-SIM parameters in a SIM database or memory or a storage card.

[0165] The embodiment of the present invention optimizes the authentication subsystem and can pre-configure three groups of EAP-SIM related parameters in the SIM database (hostapd.sim_db), each group can include IMSI:kc:sres:RAND, so as to process EAP-SIM authentication related processes.

[0166] See also Figure 4 , is another application example diagram of a terminal authentication test method provided by an embodiment of the present invention. In this embodiment, taking the EAP-SIM authentication process performed by the authentication subsystem as an example, the process includes:

[0167] Step 400: Start;

[0168] Step 401: The authentication subsystem configures three groups of EAP-SIM related parameters in the SIM database (hostapd.sim_db), wherein each group of EAP-SIM related parameters includes: IMSI: kc: sres: RAND;

[0169] Step 402: The authentication subsystem processes the Radius / Access-Request / EAP-Response / Identity and Radius / SIM / Start processes, and sends a Radius / Access-Challenge / EAP-Request / SIM / Challenge message, wherein the message includes information such as RAND and AT_MAC;

[0170] Among them, Radius is Remote Authentication Dial-In User Service, Access-Request is access request, EAP-Response is Extensible Authentication Protocol-Response, Identity is identity identification, and Access-Challenge is access challenge.

[0171] That is to say, in this step, when the authentication subsystem receives the authentication package or authentication request sent by the WiFi terminal subsystem through the wireless access point, it starts to process the Radius / Access-Request / EAP-Response / Identity and Radius / SIM / Start processes and generates AT_MAC. The generation process includes:

[0172] The authentication subsystem obtains the relevant parameters of EAP-SIM from the SIM database. The relevant parameters of EAP-SIM may include: IMSI, kc, sres and RAND. After that, K_aut, K_encr, MSK, EMSK are obtained through the GSM-specific algorithm according to the parameters such as kc, identity and RAND. Then, AT_MAC is calculated through the HMAC-SHA1 algorithm according to the parameters such as K_aut. Finally, the generated AT_MAC and random number are sent to the WiFi terminal in the WiFi terminal subsystem through the wireless access point. The WiFi terminal authenticates the authentication subsystem based on AT_MAC and random number, and generates a message authentication code for the signed response if the authentication is successful, and sends the message authentication code for the signed response to the authentication subsystem through the wireless access point.

[0173] Step 403: The authentication subsystem receives the Radius / Access-Request / EAP-Response / SIM / Challenge message sent by the AP, which includes a MAC_SRES; wherein EAP-Response is an Extensible Authentication Protocol-Response and Challenge is a challenge.

[0174] Step 404: The authentication subsystem generates a MAC_SRES based on the SRES configured on the local end and the content of the EAPPacket in the received Challenge message, and compares it with the MAC_SRES received in step 403. If the MAC_SRES are the same, execute step 406; if the MAC_SRES are not the same, return to step 403;

[0175] In this step, the authentication subsystem uses the sres configured on the local end as the key, and calculates MAC_SRES with the content of the EAP Packet in the received Challenge message through the HMAC-SHA1 algorithm, and compares it with the MAC_SRES received in step 403; if the MAC_SRES are the same, execute step 406; if the MAC_SRES are not the same, return to step 403. Among them, the HMAC-SHA1 algorithm is already a well-known technology and will not be repeated here.

[0176] Step 405: The authentication subsystem authenticates the terminal subsystem successfully and sends a Radius / Access-Accept / EAP-Success message to the AP;

[0177] Step 406: The EAP-SIM authentication process ends.

[0178] In the embodiment of the present invention, by optimizing the WIFI terminal subsystem and the authentication subsystem, the problem of complex environment construction in the current EAP-SIM test is solved, and the needs of EAP-SIM authentication testing of WIFI terminals in various systems (such as the open source Hongmeng system, Android system or Linux system, etc.) are met. It has strong scalability and can also be extended to various WIFI terminals in Android system and Linux system.

[0179] It should be noted that, for the method embodiments, for the sake of simplicity, they are all described as a series of action combinations, but those skilled in the art should know that this implementation disclosure is not limited by the order of the actions described, because according to the present invention, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also know that the embodiments described in the specification are all preferred embodiments, and the actions involved are not necessarily required by the present invention.

[0180] Figure 5 The present invention provides a block diagram of a terminal authentication test device. The device is applied to a WIFI terminal subsystem, including: an acquisition module 501, a first sending module 502, a first receiving module 503, an authentication module 504, a second sending module 505 and a second receiving module 506, wherein:

[0181] The acquisition module 501 is used to obtain EAP-SIM configuration information for WIFI terminal authentication; wherein the EAP-SIM configuration information may include information such as kc, sres and identity identification;

[0182] A first sending module 502, configured to send a first authentication packet including the EAP-SIM configuration information to an authentication subsystem via a wireless access point;

[0183] The first receiving module 503 is configured to receive, through the wireless access point, a second authentication packet sent by the authentication subsystem based on the first authentication packet, wherein the second authentication packet includes: a message authentication code of a random number and an attribute;

[0184] An authentication module 504 is used to perform EAP authentication on the authentication subsystem based on the random number and the attribute message authentication code; if the authentication module passes the authentication, generate a message authentication code for a signed response;

[0185] A second sending module 505, configured to send the message authentication code of the signature response to the authentication subsystem via the wireless access point;

[0186] The second receiving module 506 is configured to receive, through the wireless access point, the information indicating that the WIFI terminal has been successfully authenticated, which is sent by the authentication subsystem.

[0187] Optionally, in another embodiment, based on the above embodiment, the acquisition module includes:

[0188] A configuration information acquisition module, used to obtain EAP-SIM configuration information for WIFI terminal authentication through a Wi-Fi protected access command line interface, wherein the EAP-SIM configuration information includes: a confidentiality key and a signature response;

[0189] A storage module is used to store the secret key into an internal secret key variable and store the signature response into an internal signature response variable.

[0190] Optionally, in another embodiment, based on the above embodiment, before receiving, through the wireless access point, a second authentication packet sent by the authentication subsystem based on the first authentication packet, the apparatus further includes:

[0191] The adding module is used to add an EAP-SIM internal response function in advance to the network request function so as to authenticate the type of EAP, wherein the EAP-SIM internal response function is provided with an external SIM response variable including a confidentiality key kc and a signature response sres.

[0192] Optionally, in another embodiment, based on the above embodiment, the authentication module includes:

[0193] A first calling module is used to obtain a confidentiality key kc and a signature response sres in an EAP-SIM internal response function when determining that the type of the EAP authentication of the second authentication package is EAP-SIM by using a network request function;

[0194] A calculation module, used to calculate a message authentication code of an attribute using a control response function based on the confidentiality key kc and the random number;

[0195] A generation module is used to confirm that the authentication of the authentication subsystem is successful when the message authentication code of the attribute calculated by the calculation module is the same as the value of the message authentication code of the attribute included in the second authentication package, and calculate the message authentication code MAC_SRES of the signature response based on the signature response sres.

[0196] See also Figure 6 , is a block diagram of a terminal authentication test device provided in an embodiment of the present invention, the device is applied to an authentication subsystem, including: a first receiving module 601, a processing module 602, a first sending module 603, a second receiving module 604, an authentication module 605 and a second sending module 606, wherein,

[0197] The first receiving module 601 is configured to receive, through a wireless access point, a first authentication packet sent by a WIFI terminal and including the EAP-SIM configuration information;

[0198] A processing module 602 is used to process the EAP-SIM configuration information in the first authentication package to generate a message authentication code with attributes;

[0199] The first sending module 603 is used to send a second authentication packet to the WIFI terminal through the wireless access point, wherein the second authentication packet includes: a message authentication code with a random number and an attribute;

[0200] The second receiving module 604 is configured to receive, through the wireless access point, a message authentication code MAC_SRES of a signature response sent by the WIFI terminal;

[0201] An authentication module 605 is used to authenticate the WIFI terminal based on the message authentication code MAC_SRES of the signature response;

[0202] The second sending module 606 is used to send authentication success information to the WIFI terminal through the wireless access point when the authentication is successful.

[0203] Optionally, in another embodiment, based on the above embodiment, the processing module is specifically configured to generate a message authentication code with attributes according to the confidentiality key kc and identity identifier of the EAP-SIM configuration information, and a random number.

[0204] Optionally, in another embodiment, based on the above embodiment, the authentication module includes:

[0205] The key acquisition module is used to obtain the key in the signature response SRES;

[0206] A message authentication module, used to generate a message authentication code MAC_SRES of a signature response based on the key key and the signature response SRES;

[0207] The confirmation module is used to confirm that the WIFI terminal has passed the authentication when the message authentication code of the generated signature response is the same as the value of the message authentication code of the received signature response.

[0208] Optionally, in another embodiment, based on the above embodiment, the key acquisition module is specifically used to acquire the key key in the signature response SRES from a SIM database or a memory or a storage card.

[0209] Optionally, in another embodiment, based on the above embodiment, the device further includes:

[0210] A configuration module, used for pre-selecting and configuring a plurality of groups of EAP-SIM parameters, each group of EAP-SIM parameters including: an international mobile subscriber identity, a confidentiality key, a signature response and a random number;

[0211] The storage module is used to store each group of EAP-SIM parameters configured by the pre-configuration module in a SIM database or a memory or a storage card.

[0212] Optionally, an embodiment of the present invention further provides an electronic device, including:

[0213] processor;

[0214] a memory for storing instructions executable by the processor;

[0215] The processor is configured to execute the instructions to implement the terminal authentication test method as described above.

[0216] Optionally, an embodiment of the present invention further provides a computer-readable storage medium, when instructions in the computer-readable storage medium are executed by a processor of an electronic device, the electronic device is enabled to execute the terminal authentication test method as described above.

[0217] Optionally, an embodiment of the present invention further provides a computer program product, including a computer program or instructions, which implement the terminal authentication test method as described above when executed by a processor of an electronic device.

[0218] Regarding the device in the above embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the method, and will not be elaborated here.

[0219] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0220] See also Figure 7, which is an application example diagram of a terminal authentication test system provided by an embodiment of the present invention. This embodiment takes a test of EAP-SIM user authentication in the open source Hongmeng system as an example. The system includes: a WIFI terminal subsystem 700, a wireless access point (AP) 701 and an authentication subsystem 702. The WIFI terminal subsystem 700 is connected to the AP701 via WiFi, and the AP701 is connected to the authentication subsystem 702. The WIFI terminal subsystem 700 includes: a Wi-Fi protected access command line interface (wpa_cli) 710 and a Wi-Fi protected access client (wpa_supplicant, referred to as the Wi-Fi terminal in this embodiment) 720.

[0221] As shown in the figure, wpa_cli 710 in the WIFI terminal subsystem 700 is used to perform EAP-SIM related configurations to wpa_supplicant 720 and initiate an EAP-SIM connection, wherein wpa_cli 710 and wpa_supplicant 720 communicate using Unix Socket.

[0222] The wpa_supplicant 720 in the WIFI terminal subsystem 700 receives the relevant configuration of the EAP-SIM issued by the wpa_cli 710, and performs the relevant EAP-SIM authentication process on the WIFI terminal side, that is, sends the EAP-SIM authentication package to the AP701 through the WIFI air interface, and receives the EAP-SIM authentication package forwarded by the AP701 through the WIFI air interface;

[0223] That is, wpa_cli 710 sends the confidentiality key (kc) parameter value and the signature response (sres) parameter value to wpa_supplicant respectively. wpa_supplicant 720 saves the confidentiality key kc parameter value to the internal confidentiality key variable (eapsim_params.kc); and saves the sres parameter value to the internal signature response variable (eapsim_params.sres).

[0224] Afterwards, wpa_cli710 sends the EAP_SIM connection request to wpa_supplicant720, wherein the EAP_SIM connection request may include: wireless network name (ssid), key management (key_mgmt), extensible authentication protocol (eap), identity (identity), external user identity (set_external_sim), etc. When wpa_supplicant720 receives the EAP_SIM connection request, it starts to process the EAP / Identity and EAP / SIM / Start processes; and initiates the relevant EAP-SIM authentication process on the WIFI terminal side to the wireless access point AP702 via WiFi. That is, wpa_supplicant sends an EAP-SIM authentication package to the wireless access point AP, and the EAP-SIM authentication package includes: configuration information of the WIFI terminal;

[0225] AP701 is used to receive a WIFI air interface packet sent by the WIFI terminal subsystem 700, the WIFI air interface packet including an EAP-SIM authentication packet, parse the EAP-SIM authentication packet, and forward the parsing result to the authentication subsystem 702 via a remote authentication dial-in user service (Radius) protocol packet;

[0226] The authentication subsystem 702 is used to read the relevant parameters in the EAP-SIM from the configuration file, and based on the received Radius protocol package, perform the EAP-SIM authentication related process, that is, start processing the Radius / Access-Request / EAP-Response / Identity and Radius / SIM / Start processes, and generate information such as the attribute message authentication code AT_MAC. And send the AT_MAC and random number to AP701 through the Radius protocol package.

[0227] AP701 is used to receive the Radius protocol packet sent by the authentication subsystem 702, parse the Radius protocol packet, and send the random number and AT_MAC to wpa_supplicant720 via WiFi when the random number and AT_MAC are obtained;

[0228] wpa_supplicant720, used to perform EAP authentication on the authentication subsystem based on the random number and AT_MAC, and generate a message authentication code for a signed response if the authentication is successful; and send the message authentication code for the signed response to AP701;

[0229] AP701, used to send the message authentication code of the signature response to the authentication subsystem 702;

[0230] The authentication subsystem 702 is used to obtain the key key in the signature response SRES; generate a message authentication code MAC_SRES of the signature response based on the key key and the signature response SRES; when the value of the message authentication code of the generated signature response is the same as the value of the message authentication code of the received signature response, confirm that the WIFI terminal has passed the authentication, and if the authentication is passed, send the authentication success information to AP701;

[0231] AP701 is used to send authentication success information to the WIFI terminal subsystem 700 via WIFI.

[0232] The WIFI terminal subsystem 700 is used to complete the EAP-SIM authentication process when receiving the authentication success information forwarded by the AP 702, and this authentication ends.

[0233] It should be noted that, in this embodiment, the specific process of authentication is detailed in the implementation process corresponding to the above embodiment, and will not be repeated here.

[0234] In the embodiment of the present invention, 1) wpa_cli in the WIFI terminal subsystem is optimized to support the configuration of kc and sres for specific users. 2) wpa_supplicant in the WIFI terminal subsystem is optimized to receive kc and sres sent by wpa_cli and save related parameters in memory. When receiving EAP-Request / SIM / Challenge messages, an EAP-SIM internal response function is added to the network request function to process EAP-SIM authentication. 3) The authentication subsystem is optimized to configure multiple groups (for example, 3 groups) of EAP-SIM related parameters (each group includes IMSI:kc:sres:RAND) in the SIM database to process EAP-SIM authentication related processes.

[0235] Therefore, the embodiment of the present invention solves the problem of complex environment construction in the current open source Hongmeng system EAP-SIM test by optimizing the WIFI terminal subsystem and the authentication subsystem, meets the needs of EAP-SIM authentication testing of WIFI terminals in various systems, has strong scalability, and can also be extended to various WIFI terminals in Android and Linux systems.

[0236] Figure 8 800 is a block diagram of an electronic device 800 provided in an embodiment of the present invention. For example, the electronic device 800 may be a mobile terminal or a server, and the electronic device is a mobile terminal as an example for explanation in the embodiment of the present invention. For example, the electronic device 800 may be a mobile phone, a computer, a digital broadcast terminal, a message transceiver device, a game console, a tablet device, a medical device, a fitness device, a personal digital assistant, etc.

[0237] Reference Figure 8 , the electronic device 800 may include one or more of the following components: a processing component 802 , a memory 804 , a power component 806 , a multimedia component 808 , an audio component 810 , an input / output (I / O) interface 812 , a sensor component 814 , and a communication component 816 .

[0238] The processing component 802 generally controls the overall operation of the electronic device 800, such as operations associated with display, phone calls, data communications, camera operations, and recording operations. The processing component 802 may include one or more processors 820 to execute instructions to complete all or part of the steps of the above-mentioned method. In addition, the processing component 802 may include one or more modules to facilitate the interaction between the processing component 802 and other components. For example, the processing component 802 may include a multimedia module to facilitate the interaction between the multimedia component 808 and the processing component 802.

[0239] The memory 804 is configured to store various types of data to support operations on the device 800. Examples of such data include instructions for any application or method operating on the electronic device 800, contact data, phone book data, messages, pictures, videos, etc. The memory 804 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk.

[0240] The power supply component 806 provides power to the various components of the electronic device 800. The power supply component 806 may include a power management system, one or more power supplies, and other components associated with generating, managing, and distributing power to the electronic device 800.

[0241] The multimedia component 808 includes a screen that provides an output interface between the electronic device 800 and the user. In some embodiments, the screen may include a liquid crystal display (LCD) and a touch panel (TP). If the screen includes a touch panel, the screen may be implemented as a touch screen to receive input signals from the user. The touch panel includes one or more touch sensors to sense touch, slide, and gestures on the touch panel. The touch sensor may not only sense the boundaries of the touch or slide action, but also detect the duration and pressure associated with the touch or slide operation. In some embodiments, the multimedia component 808 includes a front camera and / or a rear camera. When the device 800 is in an operating mode, such as a shooting mode or a video mode, the front camera and / or the rear camera may receive external multimedia data. Each front camera and the rear camera may be a fixed optical lens system or have a focal length and optical zoom capability.

[0242] The audio component 810 is configured to output and / or input audio signals. For example, the audio component 810 includes a microphone (MIC), and when the electronic device 800 is in an operating mode, such as a call mode, a recording mode, and a voice recognition mode, the microphone is configured to receive an external audio signal. The received audio signal can be further stored in the memory 804 or sent via the communication component 816. In some embodiments, the audio component 810 also includes a speaker for outputting audio signals.

[0243] I / O interface 812 provides an interface between processing component 802 and peripheral interface modules, such as keyboards, click wheels, buttons, etc. These buttons may include but are not limited to: home button, volume button, start button, and lock button.

[0244] The sensor assembly 814 includes one or more sensors for providing various aspects of status assessment for the electronic device 800. For example, the sensor assembly 814 can detect the open / closed state of the device 800, the relative positioning of components, such as the display and keypad of the electronic device 800, and the sensor assembly 814 can also detect the position change of the electronic device 800 or a component of the electronic device 800, the presence or absence of contact between the user and the electronic device 800, the orientation or acceleration / deceleration of the electronic device 800, and the temperature change of the electronic device 800. The sensor assembly 814 may include a proximity sensor configured to detect the presence of nearby objects without any physical contact. The sensor assembly 814 may also include an optical sensor, such as a CMOS or CCD image sensor, for use in imaging applications. In some embodiments, the sensor assembly 814 may also include an accelerometer, a gyroscope sensor, a magnetic sensor, a pressure sensor, or a temperature sensor.

[0245] The communication component 816 is configured to facilitate wired or wireless communication between the electronic device 800 and other devices. The electronic device 800 can access a wireless network based on a communication standard, such as WiFi, a carrier network (such as 2G, 3G, 4G or 5G), or a combination thereof. In an exemplary embodiment, the communication component 816 receives a broadcast signal or broadcast-related information from an external broadcast management system via a broadcast channel. In an exemplary embodiment, the communication component 816 also includes a near field communication (NFC) module to facilitate short-range communication. For example, the NFC module can be implemented based on radio frequency identification (RFID) technology, infrared data association (IrDA) technology, ultra-wideband (UWB) technology, Bluetooth (BT) technology and other technologies.

[0246] In an embodiment, the electronic device 800 may be implemented by one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field programmable gate arrays (FPGAs), controllers, microcontrollers, microprocessors or other electronic components to perform the terminal authentication test method shown above.

[0247] In an embodiment, a computer-readable storage medium is also provided, and when the instructions in the computer-readable storage medium are executed by the processor of the electronic device, the electronic device 800 can perform the terminal authentication test method shown above. For example, the computer-readable storage medium can be a ROM, a random access memory (RAM), a CD-ROM, a magnetic tape, a floppy disk, an optical data storage device, etc.

[0248] In an embodiment, a computer program product is further provided, including a computer program or instructions. When the computer program or instructions are executed by the processor 820 of the electronic device 800, the electronic device 800 executes the above-mentioned terminal authentication test method.

[0249] Fig. 9 900 is a block diagram of a device 900 for testing terminal authentication provided by an embodiment of the present invention. For example, the device 900 may be provided as a server. Fig. 9 The apparatus 900 includes a processing component 922, which further includes one or more processors, and a memory resource represented by a memory 932 for storing instructions executable by the processing component 922, such as an application. The application stored in the memory 932 may include one or more modules, each corresponding to a set of instructions. In addition, the processing component 922 is configured to execute instructions to perform the above-mentioned terminal authentication test method.

[0250] The device 900 may also include a power supply component 926 configured to perform power management of the device 900, a wired or wireless network interface 950 configured to connect the device 900 to a network, and an input / output (I / O) interface 958. The device 900 may operate based on an operating system stored in the memory 932, such as Windows Server™, Mac OS X™, Unix™, Linux™, FreeBSD™, or the like.

[0251] Those skilled in the art will readily appreciate other embodiments of the present invention after considering the specification and practicing the invention disclosed herein. This application is intended to cover any variations, uses or adaptations of the present invention that follow the general principles of the present invention and include common knowledge or customary techniques in the art that are not disclosed by the present invention. The specification and examples are to be considered exemplary only, and the true scope and spirit of the present invention are indicated by the following claims.

[0252] It should be understood that the present invention is not limited to the exact construction that has been described above and shown in the drawings and that various modifications and changes may be made without departing from the scope thereof. The scope of the present invention is limited only by the appended claims.

Claims

1. A terminal authentication test method, characterized in that: The method is applied to a WIFI terminal subsystem, comprising: Get the Extensible Authentication Protocol-Subscriber Identity Module (EAP-SIM) configuration information for Wi-Fi terminal authentication; Sending a first authentication packet including the EAP-SIM configuration information to the authentication subsystem through a wireless access point; Receiving, through the wireless access point, a second authentication packet sent by the authentication subsystem based on the first authentication packet, the second authentication packet including: a message authentication code of a random number and an attribute; Performing EAP authentication on the authentication subsystem based on the random number and the attributed message authentication code, and generating a message authentication code for a signed response if the authentication passes; Sending the message authentication code of the signature response to the authentication subsystem through the wireless access point; The wireless access point receives information indicating successful authentication of the WIFI terminal sent by the authentication subsystem.

2. The terminal authentication test method according to claim 1, characterized in that: The step of obtaining EAP-SIM configuration information for WIFI terminal authentication includes: Obtaining EAP-SIM configuration information for WIFI terminal authentication through a Wi-Fi command line interface, wherein the EAP-SIM configuration information includes: a confidentiality key and a signature response; The secret key is stored in an internal secret key variable, and the signed response is stored in an internal signed response variable.

3. The terminal authentication testing method according to claim 1, characterized in that: Before receiving, through the wireless access point, a second authentication packet sent by the authentication subsystem based on the first authentication packet, the method further includes: An EAP-SIM internal response function is added in advance to the network request function so as to authenticate the type of EAP, wherein the EAP-SIM internal response function is provided with an external SIM response variable including a confidentiality key and a signature response.

4. The terminal authentication test method according to any one of claims 1 to 3, characterized in that: The performing EAP authentication on the authentication subsystem based on the message authentication code of the random number and the attribute, and generating a message authentication code of a signed response when the authentication passes, comprises: When determining that the type of EAP authentication is EAP-SIM by using the network request function based on the second authentication packet, obtaining a confidentiality key and a signature response in an EAP-SIM internal response function; Based on the secret key and the random number, a message authentication code of the attribute is calculated using a control response function; When the calculated message authentication code of the attribute is the same as the value of the message authentication code of the attribute included in the second authentication package, it is confirmed that the authentication of the authentication subsystem is passed, and the message authentication code of the signature response is calculated according to the signature response.

5. A terminal authentication test method, characterized in that: The method is applied to an authentication subsystem and includes: Receiving, through a wireless access point, a first authentication packet including EAP-SIM configuration information sent by a WIFI terminal; Processing the EAP-SIM configuration information in the first authentication package to generate a message authentication code with attributes; Sending a second authentication packet to the WIFI terminal through the wireless access point, wherein the second authentication packet includes: a message authentication code of a random number and an attribute; A message authentication code of a signed response sent by the WIFI terminal is received through the wireless access point; Authenticating the WIFI terminal based on the message authentication code of the signature response; When the authentication is successful, the wireless access point sends authentication success information to the WIFI terminal.

6. The terminal authentication test method according to claim 5, characterized in that: The processing of the EAP-SIM configuration information in the first authentication package to generate a message authentication code with attributes includes: Generate a message authentication code with attributes according to the confidentiality key and identity identifier of the EAP-SIM configuration information and a random number.

7. The terminal authentication test method according to claim 5, characterized in that: The authenticating the WIFI terminal based on the message authentication code of the signature response includes: Get the key in the signed response; generating a message authentication code for the signed response based on the key and the signed response; When the value of the message authentication code of the generated signature response is the same as the value of the message authentication code of the received signature response, it is confirmed that the WIFI terminal has passed the authentication.

8. A terminal authentication test device, characterized in that: The device is applied to a WIFI terminal subsystem, comprising: The acquisition module is used to obtain the EAP-SIM configuration information of the WIFI terminal authentication; A first sending module, configured to send a first authentication packet including the EAP-SIM configuration information to an authentication subsystem through a wireless access point; A first receiving module is configured to receive, through the wireless access point, a second authentication packet sent by the authentication subsystem based on the first authentication packet, wherein the second authentication packet includes: a message authentication code of a random number and an attribute; An authentication module, configured to perform EAP authentication on the authentication subsystem based on the random number and the attributed message authentication code; and to generate a message authentication code for a signed response if the authentication module passes the authentication; A second sending module, configured to send the message authentication code of the signature response to the authentication subsystem through the wireless access point; The second receiving module is used to receive the information of successful authentication of the WIFI terminal sent by the authentication subsystem through the wireless access point.

9. A terminal authentication test device, characterized in that: The device is applied to an authentication subsystem and includes: A first receiving module, configured to receive, through a wireless access point, a first authentication packet sent by a WIFI terminal and including the EAP-SIM configuration information; A processing module, configured to process the EAP-SIM configuration information in the first authentication package to generate a message authentication code with attributes; A first sending module, configured to send a second authentication packet to the WIFI terminal through the wireless access point, wherein the second authentication packet includes: a message authentication code of a random number and an attribute; A second receiving module is used to receive the message authentication code of the signature response sent by the WIFI terminal through the wireless access point; An authentication module, used to authenticate the WIFI terminal based on the message authentication code of the signature response; The second sending module is used to send authentication success information to the WIFI terminal through the wireless access point when the authentication is successful.

10. An electronic device, characterized in that: include: processor; a memory for storing instructions executable by the processor; The processor is configured to execute the instructions to implement the terminal authentication testing method according to any one of claims 1 to 7.

Images