Wireless connection management system of mobile routing equipment

Abstract

The embodiment of the invention relates to a wireless connection management system of mobile routing equipment. The system comprises first access equipment and first Mi Fi equipment, the first management module of the first access device and the second management module of the first Mi Fi device are used for carrying out key and token data interaction processing through an NFC communication mode; and the first management module of the first access equipment and the second management module of the first Mi Fi equipment are also used for carrying out Wi-Fi connection and Internet uplink and downlink message data exchange processing in a Wi-Fi communication mode. According to the invention, the data leakage risk can be reduced.

Description

Technical Field

[0001] The present invention relates to the technical field of data processing, and in particular to a wireless connection management system for a mobile routing device. Background Art

[0002] Mobile WiFi (Mi Fi) devices are a new type of routing device that can directly provide Internet access services (referred to as Internet access services) to all WI FI access devices under it. The Internet access function of Mi Fi devices is achieved by logging into the mobile communication network through a built-in identity module (such as a SIM module, eSIM module, vSIM module, etc.).

[0003] Conventional Mi Fi devices manage wireless connections of access devices in the following ways: receiving Internet access applications from access devices through WiFi communication; and after receiving Internet access applications from a certain access device, performing a series of key information interactions with the current access device through WiFi communication according to a pre-specified key exchange protocol (such as DH key exchange protocol, WPA2 key exchange protocol, WPA3 key exchange protocol, etc.) to generate a corresponding temporary key or session key A; and decrypting the password ciphertext sent by the access device through WI FI communication based on key A and verifying the obtained password plaintext; and assigning a WiFi Internet access channel B to the current access device after the key verification is passed; and always encrypting / decrypting the WiFi interaction data in channel B based on key A before the current access device disconnects the current WiFi connection. In summary, this conventional wireless connection management method only processes three types of data interaction processes based on one wireless communication method (i.e., WiFi communication method): key exchange process, password transmission process, and Internet access data exchange process.

[0004] By analyzing several commonly used key exchange protocols, we know that once the public keys of the two devices (Mi Fi devices and access devices) and the interactive data of the key exchange process between the two are obtained, it is possible to deduce the corresponding key A. If the ciphertext data of the password transmission process is further obtained, the corresponding access device password can be cracked. The signal reception range of the WiFi communication method is relatively large, which also facilitates the cracker to successfully obtain the interactive data of the key exchange process and the password transmission process. In other words, the wireless connection management method of Mi Fi devices based on WiFi communication to handle three types of data interaction processes has a greater risk of data leakage.

[0005] In order to reduce the risk of data leakage of Mi Fi devices, we propose a new wireless connection management method: add a wireless communication method with a small signal reception range and high difficulty of air data theft, namely NFC communication method, to MiFi devices; and split the wireless communication methods of three types of data interaction processes: use NFC communication method to handle the key exchange process and password transmission process, and use WiFi communication method to handle the Internet data exchange process. The specific implementation scheme of this new wireless connection management method is the technical problem to be solved by this invention. Summary of the invention

[0006] The purpose of the present invention is to provide a wireless connection management system for mobile routing devices in view of the defects of the prior art, the system includes: a first access device and a first Mi Fi device; the first access device and the first Mi Fi device perform key and token data interaction processing through NFC communication, and perform WiFi connection and Internet uplink and downlink message data exchange processing through WiFi communication. The present invention can increase the difficulty of stealing air data and reduce the risk of data leakage of devices (Mi Fi devices, access devices).

[0007] To achieve the above object, an embodiment of the present invention provides a wireless connection management system for a mobile routing device, the system comprising: a first access device and a first Mi Fi device;

[0008] The first access device includes a first NFC communication module, a first WiFi communication module and a first management module; the first management module is connected to the first NFC communication module and the first WiFi communication module respectively; the wireless communication range of the first NFC communication module is much smaller than the wireless communication range of the first WiFi communication module;

[0009] The first Mi Fi device includes a second NFC communication module, a second WiFi communication module and a second management module; the second management module is connected to the second NFC communication module and the second WiFi communication module respectively; the wireless communication range of the second NFC communication module is much smaller than the wireless communication range of the second WiFi communication module;

[0010] The first NFC communication module of the first access device is used to perform NFC wireless communication connection with the second NFC communication module within the wireless communication range of the second NFC communication module of the first Mi Fi device;

[0011] The first WiFi communication module of the first access device is used to establish WiFi wireless communication connection with the second WiFi communication module within the wireless communication range of the second WiFi communication module of the first Mi Fi device;

[0012] The first management module of the first access device and the second management module of the first Mi Fi device are used to perform key and token data interaction processing through NFC communication;

[0013] The first management module of the first access device and the second management module of the first Mi Fi device are also used to perform WiFi connection and Internet uplink and downlink message data exchange processing through WiFi communication.

[0014] Preferably, the number of the first access devices is greater than or equal to one.

[0015] Preferably, the first management module of the first access device and the second management module of the first Mi Fi device are specifically used for performing the key and token data interaction processing through the NFC communication mode:

[0016] The first management module of the first access device sends a Mi Fi device identification reading request to the second NFC communication module of the first Mi Fi device through the first NFC communication module;

[0017] The second NFC communication module of the first Mi Fi device forwards the received Mi Fi device identification reading request to the second management module;

[0018] After receiving the Mi Fi device identification reading request, the second management module of the first Mi Fi device sends back the Mi Fi device identification reading feedback carrying the preset Mi Fi device identification to the first NFC communication module of the first access device through the second NFC communication module;

[0019] The first NFC communication module of the first access device forwards the Mi Fi device identification reading feedback to the first management module;

[0020] After receiving the Mi Fi device identification reading feedback, the first management module of the first access device extracts the corresponding Mi F i device identification from the current Mi Fi device identification reading feedback as the corresponding current Mi Fi device identification; and identifies whether the current Mi Fi device identification matches the preset registered Mi Fi device identification; if the current Mi Fi device identification does not match the registered Mi Fi device identification, the first NFC communication module is controlled to disconnect the NFC communication connection with the second NFC communication module of the first Mi Fi device; if the current Mi Fi device identification matches the registered Mi Fi device identification, the access device identification, asymmetric algorithm type, key exchange protocol type, WiFi message protocol type and access device public key preset locally on the access device are extracted to form corresponding access device interaction information, and the access device interaction information is sent to the second NFC communication module of the first Mi Fi device through the first NFC communication module;

[0021] The second NFC communication module of the first Mi Fi device forwards the received access device interaction information to the second management module;

[0022] After receiving the access device interaction information, the second management module of the first Mi Fi device extracts the corresponding access device identifier, the asymmetric algorithm type, the key exchange protocol type, the WiFi message protocol type and the access device public key from the current access device interaction information as the corresponding first access device identifier, the first asymmetric algorithm type, the first key exchange protocol type, the first WiFi message protocol type and the first access device public key and saves them; and confirms whether the first access device identifier is included in the preset registered access device identifier list; if it is confirmed that the registered access device identifier list does not include the first access device identifier, control the second NFC communication module to disconnect the NFC communication connection with the first NFC communication module of the first access device; if it is confirmed that the registered access device identifier list includes the first access device identifier, perform a corresponding asymmetric algorithm public-private key pair generation process based on the first asymmetric algorithm type to obtain a pair of public-private keys as the corresponding Mi Fi device public key and Mi Fi device private key and save it, and based on the temporary key parameter requirement corresponding to the first key exchange protocol type, perform corresponding temporary key parameter preparation to obtain the corresponding temporary key parameter set and save it, and based on the symmetric temporary key generation rule corresponding to the first key exchange protocol type, perform corresponding symmetric temporary key generation processing according to the temporary key parameter set to obtain the corresponding first temporary key and save it, and based on the first access device public key, perform data encryption processing on the temporary key parameter set to obtain the corresponding temporary key parameter set ciphertext, and based on the preset one-time token generation rule, perform corresponding one-time token generation processing to obtain the corresponding first access device token and save it, and initialize the token utility state of the first access device token saved this time to a valid state, and encrypt the first access device token based on the first temporary key to obtain the corresponding one-time token ciphertext, and form the corresponding Mi F i device interaction information with the obtained Mi F i device public key, the temporary key parameter set ciphertext and the one-time token ciphertext, and send the Mi Fi device interaction information back to the first NFC communication module of the first access device through the second NFC communication module;

[0023] The first NFC communication module of the first access device forwards the Mi Fi device interaction information to the first management module;

[0024] After receiving the Mi Fi device interaction information, the first management module of the first access device extracts the corresponding Mi Fi device public key, the temporary key parameter set ciphertext and the one-time token ciphertext from the current Mi Fi device interaction information as the corresponding first Mi F i device public key, the first temporary key parameter set ciphertext and the first token ciphertext; and decrypts the first temporary key parameter set ciphertext based on the access device public key preset locally on the access device to obtain the corresponding first temporary key parameter set; and performs corresponding symmetric temporary key generation processing according to the first temporary key parameter set according to the symmetric temporary key generation rule corresponding to the key exchange protocol type preset locally on the access device to obtain the corresponding second temporary key; and decrypts the first token ciphertext based on the second temporary key to obtain the corresponding second access device token; and saves the first Mi Fi device public key, the second temporary key and the second access device token; and when the data saving is completed, controls the first NFC communication module to disconnect the NFC communication connection with the second NFC communication module of the first Mi F i device.

[0025] Preferably, the asymmetric algorithm type includes at least RSA algorithm, ECC algorithm and national secret SM2 algorithm;

[0026] The key exchange protocol types include at least DH key exchange protocol, WPA2 key exchange protocol, and WPA3 key exchange protocol; the symmetric temporary key corresponding to the symmetric temporary key generation rule corresponding to any of the key exchange protocol types is a symmetric algorithm key, and the symmetric algorithm type corresponding to the symmetric algorithm key includes at least DES algorithm, 3DES algorithm, AES algorithm, national secret SM1 algorithm, and national secret SM4 algorithm;

[0027] The WiFi message protocol type includes at least TLS / SSL message protocol.

[0028] Preferably, the first management module of the first access device and the second management module of the first Mi Fi device are specifically used for performing WiFi connection and Internet uplink and downlink message data exchange processing through the WiFi communication mode:

[0029] The first management module of the first access device extracts the latest second access device token stored locally in the access device as the corresponding one-time token plaintext; and the one-time token plaintext and the access device identifier preset locally in the access device form a corresponding WiFi connection request; and the WiFi connection request is sent to the second WiFi communication module of the first Mi Fi device through the first WiFi communication module;

[0030] The second WiFi communication module of the first Mi Fi device forwards the received WiFi connection request to the second management module;

[0031] After receiving the WiFi connection request, the second management module of the first Mi Fi device extracts the corresponding one-time token plain text and the access device identifier from the current WiFi connection request as the corresponding current access device token and current access device identifier; and extracts the first access device token corresponding to the current access device identifier stored locally in the Mi Fi device as the corresponding current comparison token; and identifies whether the current comparison token is empty; if the current comparison token is empty, controls the second WiFi communication module to disconnect the WiFi communication connection with the first WiFi communication module of the first access device; if the current comparison token is not empty, identifies the token utility state of the current comparison token; if the token utility state of the current comparison token is an invalid state, controls the second WiFi communication module to disconnect the WiFi communication connection with the first WiFi communication module of the first access device; if the token utility state of the current comparison token is a valid state, identifies whether the current comparison token matches the current access device token; if If the current comparison token does not match the current access device token, the token utility state of the current comparison token is set to an invalid state, and the second WiFi communication module is controlled to disconnect the WiFi communication connection with the first WiFi communication module of the first access device; if the current comparison token matches the current access device token, the token utility state of the current comparison token is set to an invalid state, and a corresponding WiFi data channel is allocated to the first access device corresponding to the current access device identifier as the corresponding first WiFi channel, and the channel identifier corresponding to the first WiFi channel is used as the corresponding WiFi channel identifier, and the WiFi connection feedback carrying the WiFi channel identifier is sent back to the first WiFi communication module of the first access device through the second WiFi communication module;

[0032] The first WiFi communication module of the first access device forwards the WiFi connection feedback to the first management module;

[0033] After receiving the WiFi connection feedback, the first management module of the first access device extracts the corresponding WiFi channel identifier from the current WiFi connection feedback as the corresponding first WiFi channel identifier and saves it; and after the channel identifier is successfully saved, receives the Internet uplink message generated by the Internet access application locally installed on the access device; and when each Internet uplink message is received, encrypts the current Internet uplink message based on the latest second temporary key stored locally on the access device to obtain the corresponding Internet uplink message ciphertext, and extracts the WiFi message protocol type stored locally on the access device as the corresponding current message protocol, and encapsulates the uplink message carrying the Internet uplink message ciphertext according to the message encapsulation mechanism corresponding to the current message protocol to obtain the corresponding WiFi uplink message, and sends the WiFi uplink message to the second WiFi communication module of the first Mi Fi device through the first WiFi communication module;

[0034] The second WiFi communication module of the first Mi Fi device forwards the received WiFi uplink message to the second management module;

[0035] After receiving the WiFi uplink message, the second management module of the first Mi Fi device extracts the first WiFi message protocol type and the first temporary key corresponding to the current access device stored locally in the Mi Fi device as the corresponding current message protocol and the current temporary key; and parses the WiFi uplink message according to the message parsing mechanism corresponding to the current message protocol to obtain the corresponding first Internet uplink message ciphertext; and decrypts the first Internet uplink message ciphertext based on the current temporary key to obtain the corresponding first Internet uplink message; and extracts the target address in the first Internet uplink message as the corresponding first target address; and forwards the first Internet uplink message to the first target address; and after the message is forwarded successfully, receives the Internet downlink message of the first target address; and when receiving an Internet downlink message, encrypts the current Internet downlink message based on the current temporary key to obtain the corresponding Internet downlink message ciphertext, and encapsulates the downlink message carrying the Internet downlink message ciphertext according to the message encapsulation mechanism corresponding to the current message protocol to obtain the corresponding WiFi downlink message, and transmits the WiFi downlink message to the Wi F i downlink message is sent to the first WiFi communication module of the first access device;

[0036] The first WiFi communication module of the first access device forwards the WiFi downlink message to the first management module;

[0037] After receiving the WiFi downlink message, the first management module of the first access device extracts the WiFi message protocol type and the latest second temporary key stored locally in the access device as the corresponding current message protocol and current temporary key; and parses the current WiFi downlink message according to the message parsing mechanism corresponding to the current message protocol to obtain the corresponding first Internet downlink message ciphertext; and decrypts the first Internet downlink message ciphertext based on the current temporary key to obtain the corresponding first Internet downlink message; and feeds back the first Internet downlink message to the Internet access application locally installed on the access device.

[0038] The embodiment of the present invention provides a wireless connection management system for a mobile routing device, the system comprising: a first access device and a first Mi Fi device; the first access device and the first Mi Fi device perform key and token data interaction processing through NFC communication, perform WiFi connection through WiFi communication, and perform Internet uplink and downlink message data exchange processing. The embodiment of the present invention reduces the risk of data leakage and improves the data security protection capability by introducing the NFC communication method with a small signal receiving range and high difficulty of air data theft to process the key and token data interaction process. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] Figure 1 A schematic diagram of modules of a wireless connection management system for a mobile routing device provided by an embodiment of the present invention;

[0040] Figure 2 A schematic diagram of data interaction between devices when a first access device and a first Mi Fi device process key and token data interaction provided by an embodiment of the present invention;

[0041] Figure 3 A schematic diagram of data interaction between devices when a first access device and a first Mi F i device process WiFi connection and Internet uplink and downlink message data exchange provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0042] In order to make the purpose, technical solution and advantages of the present invention clearer, the present invention will be further described in detail below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0043] An embodiment of the present invention provides a wireless connection management system for a mobile routing device. Figure 1As shown in a module schematic diagram of a wireless connection management system for a mobile routing device provided by an embodiment of the present invention, the system includes: a first access device 1 and a first Mi Fi device 2.

[0044] The first access device 1 of the embodiment of the present invention can be a mobile phone, PAD, computer, notebook or mobile terminal that supports NFC and WiFi communication functions, or any type of device, equipment, server or system that supports NFC and WiFi communication functions. The first access device 1 includes a first NFC communication module 11, a first WiFi communication module 12 and a first management module 13; wherein the first management module 13 is connected to the first NFC communication module 11 and the first WiFi communication module 12 respectively; the wireless communication range of the first NFC communication module 11 is much smaller than the wireless communication range of the first WiFi communication module 12. The number of the first access devices 1 of the embodiment of the present invention is greater than or equal to 1.

[0045] The first Mi Fi device 2 of the embodiment of the present invention is a Mi Fi device supporting NFC and WiFi communication functions. The first Mi Fi device 2 includes a second NFC communication module 21, a second WiFi communication module 22 and a second management module 23; wherein the second management module 23 is connected to the second NFC communication module 21 and the second WiFi communication module 22 respectively; the wireless communication range of the second NFC communication module 21 is much smaller than the wireless communication range of the second WiFi communication module 22.

[0046] The first NFC communication module 11 of the first access device 1 is used to perform NFC wireless communication connection with the second NFC communication module 21 within the wireless communication range of the second NFC communication module 21 of the first Mi Fi device 2. The first WiFi communication module 12 of the first access device 1 is used to perform WiFi wireless communication connection with the second WiFi communication module 22 within the wireless communication range of the second WiFi communication module 22 of the first Mi Fi device 2.

[0047] The first management module 13 of the first access device 1 and the second management module 23 of the first Mi Fi device 2 are used to perform key and token data interaction processing through NFC communication. The first management module 13 of the first access device 1 and the second management module 23 of the first MiFi device 2 are also used to perform WiFi connection and Internet uplink and downlink message data exchange processing through WiFi communication.

[0048] In a specific implementation of the embodiment of the present invention, the first management module 13 of the first access device 1 and the second management module 23 of the first Mi Fi device 2 perform the key and token data interaction processing through the NFC communication mode. Figure 2The schematic diagram of the data interaction between the first access device and the first Mi Fi device when processing the key and token data interaction provided by the embodiment of the present invention is shown, and the specific processing steps of the key and token data interaction processing process are shown in the following steps A1-A9:

[0049] In step A1, the first management module 13 of the first access device 1 sends a Mi Fi device identification reading request to the second NFC communication module 21 of the first Mi Fi device 2 through the first NFC communication module 11.

[0050] Step A2: the second NFC communication module 21 of the first Mi Fi device 2 forwards the received Mi Fi device identification reading request to the second management module 23.

[0051] Step A3, after receiving the Mi F i device identification reading request, the second management module 23 of the first Mi Fi device 2 sends the Mi F i device identification reading feedback carrying the preset Mi Fi device identification to the first NFC communication module 11 of the first access device 1 through the second NFC communication module 21.

[0052] Here, the Mi Fi device identifier is a unique device identifier pre-stored locally in the first Mi Fi device 2 .

[0053] Step A4: the first NFC communication module 11 of the first access device 1 forwards the Mi Fi device identification reading feedback to the first management module 13.

[0054] Step A5, after receiving the Mi Fi device identification reading feedback, the first management module 13 of the first access device 1 extracts the corresponding Mi Fi device identification from the current Mi Fi device identification reading feedback as the corresponding current Mi Fi device identification; and identifies whether the current Mi Fi device identification matches the preset registered Mi Fi device identification; if the current Mi Fi device identification does not match the registered Mi Fi device identification, the first NFC communication module 11 is controlled to disconnect the NFC communication connection with the second NFC communication module 21 of the first Mi Fi device 2; if the current Mi Fi device identification matches the registered Mi Fi device identification, the access device identification, asymmetric algorithm type, key exchange protocol type, WiFi message protocol type and access device public key preset locally on the access device are extracted to form the corresponding access device interaction information, and the access device interaction information is sent to the second NFC communication module 21 of the first Mi Fi device 2 through the first NFC communication module 11.

[0055] Here, each first access device 1 of the embodiment of the present invention should complete device registration on the first Mi Fi device 2 in advance, and thereby obtain the unique device identifier of the first Mi Fi device 2 as the corresponding registered Mi Fi device identifier stored locally in the access device.

[0056] In addition, the local side of each first access device 1 in the embodiment of the present invention should also save the preset information such as access device identification, asymmetric algorithm type, key exchange protocol type, WiFi message protocol type, access device public key and access device private key; wherein:

[0057] The access device identifier of the embodiment of the present invention is the unique device identifier of the current first access device 1;

[0058] The asymmetric algorithm type of the embodiment of the present invention is used to identify the specific algorithm type of the asymmetric algorithm used for asymmetric algorithm calculation between the current access device and its corresponding Mi Fi device, and the asymmetric algorithm type includes at least RSA algorithm, ECC algorithm and national secret SM2 algorithm;

[0059] The key exchange protocol type of the embodiment of the present invention is used to identify the specific protocol type of the key exchange protocol used between the current access device and its corresponding Mi Fi device. The key exchange protocol type includes at least the DH key exchange protocol, the WPA2 key exchange protocol, and the WPA3 key exchange protocol; it should be noted that the temporary key generation rule corresponding to any key exchange protocol type in the embodiment of the present invention is a symmetric temporary key generation rule, and the temporary key generated based on the symmetric temporary key generation rule is called a symmetric temporary key. The symmetric temporary key should be a symmetric algorithm key. The symmetric algorithm type corresponding to the symmetric algorithm key includes at least the DES algorithm, the 3DES algorithm, the AES algorithm, the national secret SM1 algorithm, and the national secret SM4 algorithm; it should also be noted that because the conventional DH key exchange protocol, the WPA2 key exchange protocol, the WPA3 key exchange protocol, etc. have their own corresponding symmetric temporary key generation rules, the embodiment of the present invention does not limit the specific rule content of the above-mentioned temporary key generation rules. The application party can set it according to the symmetric temporary key generation rule of the conventional key exchange protocol based on the application requirements, or customize it on the basis of the conventional key exchange protocol;

[0060] The WiFi message protocol type of the embodiment of the present invention includes at least the TLS / SSL message protocol, and other message protocols may also be expanded or customized based on application requirements;

[0061] The access device public key and the access device private key in the embodiment of the present invention are a pair of mutually adapted public-private key pairs, which are generated in advance based on an asymmetric algorithm public-private key pair generation mechanism corresponding to the asymmetric algorithm type.

[0062] Step A6: the second NFC communication module 21 of the first Mi Fi device 2 forwards the received access device interaction information to the second management module 23.

[0063] Step A7, after receiving the access device interaction information, the second management module 23 of the first Mi Fi device 2 extracts the corresponding access device identifier, asymmetric algorithm type, key exchange protocol type, WiFi message protocol type and access device public key from the current access device interaction information as the corresponding first access device identifier, first asymmetric algorithm type, first key exchange protocol type, first WiFi message protocol type and first access device public key and saves them; and confirms whether the preset registered access device identifier list contains the first access device identifier; if it is confirmed that the registered access device identifier list does not contain the first access device identifier, the second NFC communication module 21 is controlled to disconnect the NFC communication connection with the first NFC communication module 11 of the first access device 1; if it is confirmed that the registered access device identifier list contains the first access device identifier, a corresponding asymmetric algorithm public-private key pair generation process is performed based on the first asymmetric algorithm type to obtain a pair of public-private keys as the corresponding Mi Fi device public key and Mi Fi device private key and save it, and based on the temporary key parameter requirements corresponding to the first key exchange protocol type, perform corresponding temporary key parameter preparation to obtain the corresponding temporary key parameter set and save it, and based on the symmetric temporary key generation rule corresponding to the first key exchange protocol type, perform corresponding symmetric temporary key generation processing according to the temporary key parameter set to obtain the corresponding first temporary key and save it, and based on the first access device public key, perform data encryption processing on the temporary key parameter set to obtain the corresponding temporary key parameter set ciphertext, and based on the preset one-time token generation rule, perform corresponding one-time token generation processing to obtain the corresponding first access device token and save it, and initialize the token utility state of the first access device token saved this time to a valid state, and encrypt the first access device token based on the first temporary key to obtain the corresponding one-time token ciphertext, and form the corresponding Mi Fi device interaction information with the obtained Mi Fi device public key, temporary key parameter set ciphertext and one-time token ciphertext, and send the Mi Fi device interaction information back to the first NFC communication module 11 of the first access device 1 through the second NFC communication module 21.

[0064] Here, as described above, each first access device 1 of the embodiment of the present invention should complete device registration on the first Mi Fi device 2 in advance, and the registered access device identification list on the first Mi Fi device 2 side is used to back up the access device identifications of all registered first access devices 1.

[0065] It should be noted that the conventional DH key exchange protocol, WPA2 key exchange protocol, WPA3 key exchange protocol, etc. have their own corresponding symmetric temporary key generation rules, in which some parameters are collected to assist in key generation, such as random numbers, timestamps, etc. The embodiments of the present invention collectively refer to these parameters as temporary key parameters; the parameters required for the symmetric temporary key generation rules of each type of key exchange protocol are not necessarily unique, so the embodiments of the present invention use temporary key parameter sets to correspond to the symmetric temporary key generation rules of each type of key exchange protocol; as mentioned above, the embodiments of the present invention do not specifically limit the specific rule content of the above-mentioned temporary key generation rules, so the embodiments of the present invention do not limit the specific parameter objects in each temporary key parameter set.

[0066] It should also be noted that the one-time token (OTP) generation rule of the embodiment of the present invention may also be implemented in a variety of ways, such as in a random number manner, in a timestamp manner, in a hash code calculation manner combining a random number and a timestamp, etc. In specific applications, any one of the conventional OTP generation schemes can be selected as the current one-time token generation rule, and another customized OTP generation scheme can also be selected as the current one-time token generation rule based on application requirements.

[0067] It should also be noted that each one-time token generated by the embodiment of the present invention will correspond to a token utility state, which includes two state values: valid state and invalid state. For each one-time token generated by the embodiment of the present invention, the corresponding token utility state will be set to a valid state by default when it is just generated. After it has been verified once, regardless of whether the result of the verification is success or failure, the corresponding token utility state will be set to an invalid state.

[0068] Step A8: the first NFC communication module 11 of the first access device 1 forwards the MiFi device interaction information to the first management module 13 .

[0069] Step A9, after receiving the MiFi device interaction information, the first management module 13 of the first access device 1 extracts the corresponding MiFi device public key, temporary key parameter set ciphertext and one-time token ciphertext from the current MiFi device interaction information as the corresponding first MiFi device public key, first temporary key parameter set ciphertext and first token ciphertext; and decrypts the first temporary key parameter set ciphertext based on the access device public key preset locally on the access device to obtain the corresponding first temporary key parameter set; and performs corresponding symmetric temporary key generation processing according to the first temporary key parameter set according to the symmetric temporary key generation rule corresponding to the key exchange protocol type preset locally on the access device to obtain the corresponding second temporary key; and decrypts the first token ciphertext based on the second temporary key to obtain the corresponding second access device token; and saves the first MiFi device public key, the second temporary key and the second access device token; and when the data saving is completed, controls the first NFC communication module 11 to disconnect the NFC communication connection with the second NFC communication module 21 of the first Mi Fi device 2.

[0070] Here, the first temporary key parameter set obtained on the first access device 1 side in an embodiment of the present invention should normally be consistent with the temporary key parameter set obtained on the first MiFi device 2 side in step A7. The symmetric temporary key generation rule on the first access device 1 in an embodiment of the present invention should normally be consistent with the symmetric temporary key generation rule obtained on the first MiFi device 2 side in step A7. The second temporary key obtained on the first access device 1 side in an embodiment of the present invention should normally be consistent with the first temporary key obtained on the first Mi Fi device 2 side in step A7. The second access device token obtained on the first access device 1 side in an embodiment of the present invention should normally be consistent with the first access device token obtained on the first Mi Fi device 2 side in step A7.

[0071] In another specific implementation of the embodiment of the present invention, the first management module 13 of the first access device 1 and the second management module 23 of the first Mi Fi device 2 perform WiFi connection and Internet uplink and downlink message data exchange processing through WiFi communication. Figure 3 The schematic diagram of the data interaction between the first access device and the first Mi Fi device when processing WiFi connection and Internet uplink and downlink message data exchange provided by the embodiment of the present invention is shown, and the specific processing steps of the WiFi connection and Internet uplink and downlink message data exchange processing process are shown in the following steps B1-B9:

[0072] Step B1, the first management module 13 of the first access device 1 extracts the latest second access device token stored locally in the access device as the corresponding one-time token plaintext; and the one-time token plaintext and the access device identifier preset locally in the access device form a corresponding WiFi connection request; and the WiFi connection request is sent to the second WiFi communication module 22 of the first Mi Fi device 2 through the first WiFi communication module 12.

[0073] Step B2: the second WiFi communication module 22 of the first Mi Fi device 2 forwards the received WiFi connection request to the second management module 23.

[0074] Step B3, after receiving the WiFi connection request, the second management module 23 of the first Mi Fi device 2 extracts the corresponding one-time token plain text and access device identifier from the current WiFi connection request as the corresponding current access device token and current access device identifier; and extracts the first access device token corresponding to the current access device identifier stored locally in the Mi Fi device as the corresponding current comparison token; and identifies whether the current comparison token is empty; if the current comparison token is empty, the second WiFi communication module 22 is controlled to disconnect the WiFi communication connection with the first WiFi communication module 12 of the first access device 1; if the current comparison token is not empty, the token utility state of the current comparison token is identified; if the token utility state of the current comparison token is an invalid state, the second WiFi communication module 22 is controlled to disconnect the WiFi communication connection with the first WiFi communication module 12 of the first access device 1; if the token utility state of the current comparison token is a valid state, the current comparison token is compared with the current access device 1. The access device token is matched for identification; if the current comparison token does not match the current access device token, the token utility state of the current comparison token is set to an invalid state, and the second WiFi communication module 22 is controlled to disconnect the WiFi communication connection with the first WiFi communication module 12 of the first access device 1; if the current comparison token matches the current access device token, the token utility state of the current comparison token is set to an invalid state, and a corresponding WiFi data channel is allocated to the first access device 1 corresponding to the current access device identifier as the corresponding first WiFi channel, and the channel identifier corresponding to the first WiFi channel is used as the corresponding WiFi channel identifier, and the WiFi connection feedback carrying the WiFi channel identifier is sent back to the first WiFi communication module 12 of the first access device 1 through the second WiFi communication module 22.

[0075] Step B4: the first WiFi communication module 12 of the first access device 1 forwards the WiFi connection feedback to the first management module 13 .

[0076] Step B5, after receiving the WiFi connection feedback, the first management module 13 of the first access device 1 extracts the corresponding WiFi channel identifier from the current WiFi connection feedback as the corresponding first WiFi channel identifier and saves it; and after the channel identifier is successfully saved, the Internet uplink message generated by the Internet access application locally installed on the access device is received; and when each Internet uplink message is received, the current Internet uplink message is encrypted based on the latest second temporary key stored locally in the access device to obtain the corresponding Internet uplink message ciphertext, and the WiFi message protocol type stored locally in the access device is extracted as the corresponding current message protocol, and the uplink message carrying the Internet uplink message ciphertext is encapsulated according to the message encapsulation mechanism corresponding to the current message protocol to obtain the corresponding WiFi uplink message, and the WiFi uplink message is sent to the second WiFi communication module 22 of the first Mi Fi device 2 through the first WiFi communication module 12.

[0077] Step B6, the second WiFi communication module 22 of the first Mi Fi device 2 forwards the received WiFi uplink message to the second management module 23.

[0078] Step B7, after receiving the WiFi uplink message, the second management module 23 of the first Mi Fi device 2 sends the Mi The first WiFi message protocol type and the first temporary key corresponding to the current access device stored locally on the Fi device are extracted as the corresponding current message protocol and the current temporary key; and the WiFi uplink message is parsed according to the message parsing mechanism corresponding to the current message protocol to obtain the corresponding first Internet uplink message ciphertext; and the first Internet uplink message ciphertext is decrypted based on the current temporary key to obtain the corresponding first Internet uplink message; and the target address in the first Internet uplink message is extracted as the corresponding first target address; and the first Internet uplink message is forwarded to the first target address; and after the message is forwarded successfully, the Internet downlink message of the first target address is received; and when an Internet downlink message is received, the current Internet downlink message is encrypted based on the current temporary key to obtain the corresponding Internet downlink message ciphertext, and the downlink message carrying the Internet downlink message ciphertext is encapsulated according to the message encapsulation mechanism corresponding to the current message protocol to obtain the corresponding WiFi downlink message, and the WiFi downlink message is sent to the first WiFi communication module 12 of the first access device 1 through the second WiFi communication module 22.

[0079] Step B8: the first WiFi communication module 12 of the first access device 1 forwards the WiFi downlink message to the first management module 13.

[0080] Step B9, after receiving the WiFi downlink message, the first management module 13 of the first access device 1 extracts the WiFi message protocol type and the latest second temporary key stored locally in the access device as the corresponding current message protocol and current temporary key; and parses the current WiFi downlink message according to the message parsing mechanism corresponding to the current message protocol to obtain the corresponding first Internet downlink message ciphertext; and decrypts the first Internet downlink message ciphertext based on the current temporary key to obtain the corresponding first Internet downlink message; and feeds back the first Internet downlink message to the Internet access application installed locally on the access device.

[0081] In summary, the embodiment of the present invention provides a wireless connection management system for a mobile routing device. It can be seen from the above content that the system of the embodiment of the present invention includes: a first access device and a first Mi Fi device; the first access device and the first Mi Fi device perform key and token data interaction processing through NFC communication, perform WiFi connection through WiFi communication, and perform Internet uplink and downlink message data exchange processing. The embodiment of the present invention reduces the risk of data leakage and improves the data security protection capability by introducing the NFC communication method with a small signal reception range and high difficulty of air data theft to process the key and token data interaction process.

[0082] The professionals should further realize that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented by electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to the function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0083] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0084] The specific implementation methods described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific implementation method of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A wireless connection management system for a mobile routing device, characterized in that: The system comprises: a first access device and a first MiFi device; The first access device includes a first NFC communication module, a first WiFi communication module and a first management module; the first management module is connected to the first NFC communication module and the first WiFi communication module respectively; the wireless communication range of the first NFC communication module is much smaller than the wireless communication range of the first WiFi communication module; The first MiFi device includes a second NFC communication module, a second WiFi communication module and a second management module; the second management module is connected to the second NFC communication module and the second WiFi communication module respectively; the wireless communication range of the second NFC communication module is much smaller than the wireless communication range of the second WiFi communication module; The first NFC communication module of the first access device is used to perform NFC wireless communication connection with the second NFC communication module within the wireless communication range of the second NFC communication module of the first MiFi device; The first WiFi communication module of the first access device is used to establish a WiFi wireless communication connection with the second WiFi communication module within the wireless communication range of the second WiFi communication module of the first MiFi device; The first management module of the first access device and the second management module of the first MiFi device are used to perform key and token data interaction processing through NFC communication; The first management module of the first access device and the second management module of the first MiFi device are also used to perform WiFi connection and Internet uplink and downlink message data exchange processing through WiFi communication.

2. The wireless connection management system for mobile routing devices according to claim 1, characterized in that: The number of the first access devices is greater than or equal to 1.

3. The wireless connection management system for mobile routing devices according to claim 1, characterized in that: The first management module of the first access device and the second management module of the first MiFi device are specifically used for performing key and token data interaction processing through the NFC communication method: The first management module of the first access device sends a MiFi device identification reading request to the second NFC communication module of the first MiFi device through the first NFC communication module; The second NFC communication module of the first MiFi device forwards the received MiFi device identification reading request to the second management module; After receiving the MiFi device identification reading request, the second management module of the first MiFi device sends back the MiFi device identification reading feedback carrying the preset MiFi device identification to the first NFC communication module of the first access device through the second NFC communication module; The first NFC communication module of the first access device forwards the MiFi device identification reading feedback to the first management module; After receiving the MiFi device identification reading feedback, the first management module of the first access device extracts the corresponding MiFi device identification from the current MiFi device identification reading feedback as the corresponding current MiFi device identification; and identifies whether the current MiFi device identification matches the preset registered MiFi device identification; If the current MiFi device identifier does not match the registered MiFi device identifier, controlling the first NFC communication module to disconnect the NFC communication connection with the second NFC communication module of the first MiFi device; If the current MiFi device identifier matches the registered MiFi device identifier, the access device identifier, asymmetric algorithm type, key exchange protocol type, WiFi message protocol type and access device public key preset locally on the access device are extracted to form corresponding access device interaction information, and the access device interaction information is sent to the second NFC communication module of the first MiFi device through the first NFC communication module; The second NFC communication module of the first MiFi device forwards the received access device interaction information to the second management module; After receiving the access device interaction information, the second management module of the first MiFi device extracts the corresponding access device identifier, the asymmetric algorithm type, the key exchange protocol type, the WiFi message protocol type and the access device public key from the current access device interaction information as the corresponding first access device identifier, the first asymmetric algorithm type, the first key exchange protocol type, the first WiFi message protocol type and the first access device public key and saves them; and confirms whether the first access device identifier is included in the preset registered access device identifier list; if it is confirmed that the registered access device identifier list does not include the first access device identifier, control the second NFC communication module to disconnect the NFC communication connection with the first NFC communication module of the first access device; if it is confirmed that the registered access device identifier list includes the first access device identifier, then based on the first asymmetric algorithm type, a corresponding asymmetric algorithm public-private key pair generation process is performed to obtain a pair of public-private keys as the corresponding MiFi device public key and MiFi device private key and save them, and based on the first key exchange The temporary key parameter requirements corresponding to the protocol type are required to prepare the corresponding temporary key parameters to obtain the corresponding temporary key parameter set and save it, and based on the symmetric temporary key generation rule corresponding to the first key exchange protocol type, the corresponding symmetric temporary key generation processing is performed according to the temporary key parameter set to obtain the corresponding first temporary key and save it, and the temporary key parameter set is encrypted based on the first access device public key to obtain the corresponding temporary key parameter set ciphertext, and the corresponding one-time token generation processing is performed based on the preset one-time token generation rule to obtain the corresponding first access device token and save it, and the token utility state of the first access device token saved this time is initialized to a valid state, and the first access device token is encrypted based on the first temporary key to obtain the corresponding one-time token ciphertext, and the obtained MiFi device public key, the temporary key parameter set ciphertext and the one-time token ciphertext form the corresponding MiFi device interaction information, and the MiFi device interaction information is sent back to the first NFC communication module of the first access device through the second NFC communication module; The first NFC communication module of the first access device forwards the MiFi device interaction information to the first management module; After receiving the MiFi device interaction information, the first management module of the first access device extracts the corresponding MiFi device public key, the temporary key parameter set ciphertext and the one-time token ciphertext from the current MiFi device interaction information as the corresponding first MiFi device public key, the first temporary key parameter set ciphertext and the first token ciphertext; and decrypts the first temporary key parameter set ciphertext based on the access device public key preset locally on the access device to obtain the corresponding first temporary key parameter set; and performs corresponding symmetric temporary key generation processing according to the first temporary key parameter set according to the symmetric temporary key generation rule corresponding to the key exchange protocol type preset locally on the access device to obtain the corresponding second temporary key; And decrypt the first token ciphertext based on the second temporary key to obtain the corresponding second access device token; and save the first MiFi device public key, the second temporary key and the second access device token; And when the data saving is completed, the first NFC communication module is controlled to disconnect the NFC communication connection with the second NFC communication module of the first MiFi device.

4. The wireless connection management system for mobile routing devices according to claim 3, characterized in that: The asymmetric algorithm types include at least RSA algorithm, ECC algorithm and national secret SM2 algorithm; The key exchange protocol types include at least DH key exchange protocol, WPA2 key exchange protocol, and WPA3 key exchange protocol; the symmetric temporary key corresponding to the symmetric temporary key generation rule corresponding to any of the key exchange protocol types is a symmetric algorithm key, and the symmetric algorithm type corresponding to the symmetric algorithm key includes at least DES algorithm, 3DES algorithm, AES algorithm, national secret SM1 algorithm, and national secret SM4 algorithm; The WiFi message protocol type includes at least TLS / SSL message protocol.

5. The wireless connection management system for mobile routing devices according to claim 3, characterized in that: The first management module of the first access device and the second management module of the first MiFi device are specifically used for performing WiFi connection and Internet uplink and downlink message data exchange processing through the WiFi communication mode: The first management module of the first access device extracts the latest second access device token stored locally in the access device as the corresponding one-time token plaintext; and the one-time token plaintext and the access device identifier preset locally in the access device form a corresponding WiFi connection request; and the WiFi connection request is sent to the second WiFi communication module of the first MiFi device through the first WiFi communication module; The second WiFi communication module of the first MiFi device forwards the received WiFi connection request to the second management module; After receiving the WiFi connection request, the second management module of the first MiFi device extracts the corresponding one-time token plaintext and the access device identifier from the current WiFi connection request as the corresponding current access device token and current access device identifier; and extracting the first access device token corresponding to the current access device identifier stored locally in the MiFi device as the corresponding current comparison token; And identifying whether the current comparison token is empty; If the current comparison token is empty, controlling the second WiFi communication module to disconnect the WiFi communication connection with the first WiFi communication module of the first access device; If the current comparison token is not empty, identifying the token utility state of the current comparison token; If the token utility state of the current comparison token is an invalid state, controlling the second WiFi communication module to disconnect the WiFi communication connection with the first WiFi communication module of the first access device; If the token utility state of the current comparison token is a valid state, identifying whether the current comparison token matches the current access device token; If the current comparison token does not match the current access device token, the token utility state of the current comparison token is set to an invalid state, and the second WiFi communication module is controlled to disconnect the WiFi communication connection with the first WiFi communication module of the first access device; If the current comparison token matches the current access device token, the token utility state of the current comparison token is set to an invalid state, and a corresponding WiFi data channel is allocated to the first access device corresponding to the current access device identifier as the corresponding first WiFi channel, and the channel identifier corresponding to the first WiFi channel is used as the corresponding WiFi channel identifier, and the WiFi connection feedback carrying the WiFi channel identifier is sent back to the first WiFi communication module of the first access device through the second WiFi communication module; The first WiFi communication module of the first access device forwards the WiFi connection feedback to the first management module; After receiving the WiFi connection feedback, the first management module of the first access device extracts the corresponding WiFi channel identifier from the current WiFi connection feedback as the corresponding first WiFi channel identifier and saves it; After the channel identifier is successfully saved, the Internet uplink message generated by the Internet access application installed locally on the access device is received; and each time an Internet uplink message is received, the current Internet uplink message is encrypted based on the latest second temporary key stored locally on the access device to obtain the corresponding Internet uplink message ciphertext, and the WiFi message protocol type stored locally on the access device is extracted as the corresponding current message protocol, and the uplink message carrying the Internet uplink message ciphertext is encapsulated according to the message encapsulation mechanism corresponding to the current message protocol to obtain the corresponding WiFi uplink message, and the WiFi uplink message is sent to the second WiFi communication module of the first MiFi device through the first WiFi communication module; The second WiFi communication module of the first MiFi device forwards the received WiFi uplink message to the second management module; After receiving the WiFi uplink message, the second management module of the first MiFi device extracts the first WiFi message protocol type and the first temporary key corresponding to the current access device stored locally in the MiFi device as the corresponding current message protocol and current temporary key; and parsing the WiFi uplink message according to the message parsing mechanism corresponding to the current message protocol to obtain a corresponding first Internet uplink message ciphertext; and decrypting the first Internet uplink message ciphertext based on the current temporary key to obtain a corresponding first Internet uplink message; and extracting the destination address in the first Internet uplink message as the corresponding first destination address; and forwarding the first Internet uplink message to the first target address; After the message is forwarded successfully, the Internet downlink message of the first target address is received; and when a said Internet downlink message is received, the current said Internet downlink message is encrypted based on the said current temporary key to obtain the corresponding Internet downlink message ciphertext, and the downlink message carrying the said Internet downlink message ciphertext is encapsulated according to the message encapsulation mechanism corresponding to the said current message protocol to obtain the corresponding WiFi downlink message, and the said WiFi downlink message is sent to the said first WiFi communication module of the first access device through the said second WiFi communication module; The first WiFi communication module of the first access device forwards the WiFi downlink message to the first management module; After receiving the WiFi downlink message, the first management module of the first access device extracts the WiFi message protocol type and the latest second temporary key stored locally in the access device as the corresponding current message protocol and current temporary key; and parsing the current WiFi downlink message according to the message parsing mechanism corresponding to the current message protocol to obtain a corresponding first Internet downlink message ciphertext; and decrypting the first Internet downlink message ciphertext based on the current temporary key to obtain a corresponding first Internet downlink message; And the first Internet downlink message is fed back to the Internet access application installed locally on the access device.

Images