Wireless network security access method and device

Abstract

The invention discloses a wireless network security access method and device, and belongs to the field of wireless communication, the method comprises the following steps: receiving a beacon frame sent by a second device, the beacon frame comprising a first data field generated and encrypted by the second device, the first data field comprises a product identifier, a first random number obtained based on a random number generation algorithm and dynamic key data; the first device analyzes the first data field from the beacon frame and decrypts the first data field to obtain a plaintext, and the legality of the beacon frame is determined according to the product identifier in the plaintext; and when the beacon frame is legal, storing the dynamic secret key data into the security module, performing a random number processing algorithm on the first random number to obtain a second random number, generating a second data field from the product identifier, the second random number and the secret key installation result state code, encrypting the second data field, adding the encrypted second data field into a beacon response frame, and packaging and sending the beacon response frame. According to the method, the random number carried by the beacon response frame simulated and sent by an intruder cannot pass the verification of the second device, so that the legality judgment of the first device can be effectively realized.

Description

Technical Field

[0001] The present invention relates to the field of wireless communications, and in particular to a method and device for securely accessing a wireless network. Background Art

[0002] With the development of wireless communication technology, WLAN technology is increasingly being used in all walks of life. A typical application scenario is wireless communication between rail transit trains and the ground. As people's living standards improve, the demand for safe travel is also increasing, and the services carried by rail transit wireless communication are also expanding.

[0003] However, the access authentication security of WLAN itself is relatively weak. Attackers can use professional tools to listen to and sniff wireless networks and perform a variety of attack methods including wireless network phishing, brute force cracking, man-in-the-middle attacks and password resets. These attacks can crack or reset WLAN access authentication passwords, allowing attackers to access rail transit wireless communication systems without obstacles, thereby conducting illegal attacks and sabotage. This illegal access behavior poses a serious threat to the safe operation of rail transit services. Summary of the invention

[0004] The main purpose of the present invention is to propose a rail transit wireless network security access authentication method and device based on traditional WLAN access authentication, so as to solve the problem that WLAN is easily illegally accessed under current technical conditions.

[0005] The present invention provides a wireless network security access method, comprising: receiving a beacon frame sent by a second device, the beacon frame comprising a first data field generated and encrypted by the second device, the first data field comprising a product identification, a first random number obtained based on a random number generation algorithm and dynamic key data; parsing the first data field from the beacon frame and decrypting it to obtain plain text, and determining the legitimacy of the beacon frame according to the product identification in the plain text; if the beacon frame is legal, storing the dynamic key data in a security module, and using a random number processing algorithm to obtain a second random number for the first random number, generating a second data field from the product identification, the second random number and a key installation result status code and encrypting it, adding it to a beacon response frame for packaging and sending; wherein the beacon response frame is used for the second device to decrypt the second data field after receiving it, and determining the legitimacy of the beacon response frame according to the password installation result status code, the consistency of the product identification, and the verification result of the second random number processing result based on the random number inverse processing algorithm and the consistency of the first random number; wherein the first device and the second device both pre-store the product identification and the initial key for encryption and decryption, and the initial key is used for encryption and decryption of the data field.

[0006] In the wireless network security access method of the present invention, after being added to the beacon response frame for packaging and sending, it also includes: generating a third data field according to the product identification, the third random number obtained by the random number generation algorithm and the authorization code, encrypting and adding it to the detection frame for packaging and sending; if the detection response frame sent by the second device is received, decrypting the fourth data field therein to obtain the product identification, the fourth random number and the authorization code verification result identifier; performing product identification verification, authorization code verification result identifier verification, and consistency verification of the fourth random number based on the processing result of the random number inverse processing algorithm and the third random number, and determining the legitimacy of the detection response frame according to the verification result; wherein the second device pre-stores the authorization code table of multiple devices, each authorization code corresponds to a MAC address one by one, after receiving the detection frame, the second device decrypts the third data field, and verifies the legitimacy of the detection frame according to the product identification, the authorization code, and the MAC address of the first device, and if the detection frame is legal, the third random number is subjected to the random number processing algorithm to obtain the fourth random number, and the fourth data field is generated according to the product identification, the fourth random number and the authorization code verification result, and encrypted and added to the detection response frame for packaging and sending.

[0007] In the wireless network security access method of the present invention, the dynamic key data is a key group including multiple keys, each key has a one-to-one corresponding key ID. Accordingly, after determining the legitimacy of the detection response frame according to the verification result, it also includes: selecting a configuration key from the key group, and generating a fifth data field according to the product identification, a fifth random number obtained by the random number generation algorithm and the key ID of the configuration key, encrypting it and adding it to the authentication frame for packaging and sending; if an authentication response frame sent by the second device is received, decrypting the sixth data field therein to obtain the product identification, the sixth random number and the key ID; performing product identification verification, key ID verification, and the sixth random number verification based on the random number The processing result of the inverse processing algorithm is checked for consistency with the fifth random number, and the legitimacy of the authentication response frame is determined based on the check result. When the authentication response frame is confirmed to be legal, the configuration key is used for encryption and decryption of subsequent data fields; wherein, after the second device receives the authentication frame, it decrypts the fifth data field, and verifies the legitimacy of the detection frame based on the product identification and key ID. When the authentication frame is legal, the fifth random number is subjected to a random number processing algorithm to obtain a sixth random number, and a sixth data field is generated based on the product identification, the sixth random number and the key ID, which is encrypted and added to the authentication response frame for packaging and sending, and the configuration key is used for encryption and decryption of subsequent data fields.

[0008] In the wireless network security access method of the present invention, after determining the legitimacy of the authentication response frame according to the verification result, it also includes: if the authentication response frame is legal, generating a seventh data field according to the product identification, the seventh random number obtained by the random number generation algorithm, the authorization code, and the key ID, encrypting and adding the seventh data field to the association frame for packaging and sending; if the association response frame sent by the second device is received, decrypting the eighth data field therein according to the new encryption and decryption key to obtain the product identification, the eighth random number and the association status identification; verifying the consistency of the product identification, the association status identification, and the eighth random number based on the random number inverse processing algorithm and the seventh random number, and determining the legitimacy of the association response frame according to the verification result; if the association response frame is confirmed to be legal, determining whether the access is successful according to the association status identification; wherein, after receiving the association frame, the second device decrypts the seventh data field, and verifies the legitimacy of the detection frame according to the product identification, the authorization code, and the key ID, and if the association frame is legal, the random number processing algorithm is used to obtain the eighth random number, and the eighth data field is generated according to the product identification, the eighth random number and the association status identification, and the eighth data field is encrypted and added to the association response frame for packaging and sending.

[0009] In the wireless network security access method of the present invention, the encryption and decryption process of each data field adopts a symmetric encryption and decryption algorithm.

[0010] In the wireless network security access method of the present invention, the method also includes, after the management frame legitimacy verification fails, sending feedback information to the management frame sender so that the sender can resend the management frame, and after the management frame legitimacy verification fails for a preset number of times, no longer communicating with the device that sent the corresponding frame; wherein the management frame includes a beacon frame, a detection frame, an authentication frame, an association frame and their corresponding response frames, and the preset number of times includes 3 times.

[0011] In the wireless network security access method of the present invention, the random number generation algorithm includes: n =(S n-1 +IV)mod0xffff; where S0 is the random number generated for the first time after the system is powered on, IV is a constant, n is an integer greater than 0, and mod is the modulus.

[0012] In the wireless network security access method of the present invention, the random number processing algorithm includes performing XOR on the random number to be processed and the preset number of digits of the product identification; accordingly, the random number inverse processing algorithm includes performing XOR on the random number to be processed and the preset number of digits of the product identification again.

[0013] The present invention also provides a wireless network security access device, including: a data transceiver module, used to receive a beacon frame sent by a second device, the beacon frame including a first data field generated and encrypted by the second device, the first data field including a product identification, a first random number obtained based on a random number generation algorithm, and dynamic key data; an encryption and decryption module, used to parse the first data field from the beacon frame and decrypt it to obtain plain text; a data processing module, used to determine the legality of the beacon frame based on the product identification in the plain text; a data security module, used to store the dynamic key data when the beacon frame is legal; a data field generation module, used to obtain a second random number using a random number processing algorithm for the first random number, and generate a second data field using the product identification, the second random number and the key installation result status code, so that after being encrypted by the encryption and decryption module, the second data field is added to the beacon response frame and packaged and sent by the data transceiver module.

[0014] The present invention also provides a computer storage medium, which stores a computer program executable by a processor, and the computer program executes any one of the above-mentioned wireless network security access methods.

[0015] The beneficial effects of the present invention are: the first random number carried by each beacon frame corresponds to the second random number of the beacon response frame one by one, and each frame is different. The random number carried by the beacon response frame simulated by the intruder cannot pass the verification of the second device, while the random number carried by the legitimate beacon response frame can be restored to a random number consistent with the first random number through the random number inverse processing algorithm, thereby effectively realizing the verification of the legitimacy of the access device, and the update of the dynamic key can be completed through the legitimate management frame. In addition, the verification is bidirectional, whether it is a simulated access terminal or a simulated access point device, it cannot successfully connect to our device. This method can effectively prevent phishing attacks, replay attacks, man-in-the-middle attacks and password reinstallation attacks, and reduce access risks. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0017] Figure 1 It is a flowchart of a wireless network security access method according to an embodiment of the present invention;

[0018] Figure 2 is a schematic diagram of a beacon frame check process according to an embodiment of the present invention;

[0019] Figure 3 is a diagram of the dynamic key data format of an embodiment of the present invention;

[0020] Figure 4 is a schematic diagram of a key group to be configured according to an embodiment of the present invention;

[0021] Figure 5 is a schematic diagram of a beacon frame structure according to an embodiment of the present invention;

[0022] Figure 6 It is a schematic diagram of the management frame legitimacy verification process of an embodiment of the present invention;

[0023] Figure 7 is a schematic diagram of a key installation result status code according to an embodiment of the present invention;

[0024] Figure 8 is a schematic diagram of a beacon response frame structure according to an embodiment of the present invention;

[0025] Fig. 9 is a schematic diagram of a detection frame check process according to an embodiment of the present invention;

[0026] Fig.10 is a schematic diagram of basic data of an embodiment of the present invention;

[0027] Fig.11 is a schematic diagram of a detection frame structure according to an embodiment of the present invention;

[0028] Fig.12 2 is a schematic diagram for describing the authorization verification result code according to an embodiment of the present invention;

[0029] Fig.13 Schematic diagram of the detection response frame structure of an embodiment of the present invention

[0030] Fig.14 Schematic diagram of the authentication frame verification process of an embodiment of the present invention

[0031] Fig.15 is a schematic diagram of the authentication frame structure of an embodiment of the present invention;

[0032] Fig.16 is a diagram of the authentication response frame structure of an embodiment of the present invention;

[0033] Fig.17 Schematic diagram of the associated frame check process of an embodiment of the present invention

[0034] Fig.18 is a schematic diagram of an association frame structure according to an embodiment of the present invention;

[0035] Fig.19 is a relationship status identification definition diagram of an embodiment of the present invention;

[0036] Fig. 20 is a diagram of an association response frame structure according to an embodiment of the present invention;

[0037] Fig.21 It is a schematic diagram of the structure of a wireless network security access device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0038] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention. Figures 1 to 21 The wireless network security access method and device of the present invention are described.

[0039] The application process of the present invention includes two devices, a first device and a second device, both of which can be used to send and receive wireless data. The wireless network security access method is implemented by sending and receiving management frames by these two devices and performing two-way verification. The first and second devices mainly include the following functional modules: data domain generation module, encryption and decryption module, data transceiver module, data processing module and data security module.

[0040] Generally, the device installed on the train is an access terminal device, and the device installed beside the track is an access point device. If the first device is installed on the train, then the second transceiver device is installed beside the track at a certain distance. The first device and the second device are interchangeable. If the first device is installed on the train, it is equivalent to an access terminal device, and the corresponding second device must be installed beside the track, which is equivalent to an access point device. The first device can also be installed beside the track at a certain distance, in which case it is equivalent to an access point device, and the corresponding second device must be installed on the train, which is equivalent to an access terminal.

[0041] Here, the first device and the second device can send and receive management frames as well as management response frames. They are in a corresponding relationship of sending and receiving data. Specifically, when the first device sends a management frame, the second device receives the management frame, and when the second device sends a management frame, the first device receives the management frame; similarly, when the first device sends a management response frame, the second device receives the management response frame, and when the second device sends a management response frame, the first device receives the management response frame. In order to more clearly describe the specific security access authentication process below, it is assumed that the first device is installed on the train, representing the access terminal device, and the corresponding second device is installed next to the track, representing the access point device. Figure 1 FIG. 1 is a flow chart of a wireless network security access method according to an embodiment of the present invention. Figure 1 As shown, the method is applied to a first device, and the method includes:

[0042] S1. Receive a beacon frame sent by a second device, wherein the beacon frame includes a first data field generated and encrypted by the second device, wherein the first data field includes a product identification, a first random number obtained based on a random number generation algorithm, and dynamic key data.

[0043] Among them, the first device and the second device both pre-store product identification and initial encryption and decryption keys, the initial key is used for encryption and decryption of the data domain, the dynamic key group data is initially stored in the second device, and the dynamic key group data and the initial key are not the same.

[0044] Before S1 , the second device generates and sends a beacon frame, and then in S1 , the first device receives and processes the beacon frame.

[0045] In the specific implementation process, the flow chart of the steps of interaction with the second device is as follows Figure 2 As shown, the second device first generates a custom data domain (referred to as the first data domain here for the sake of distinction, and similar descriptions are used in the following) based on the product-specific identification data, the first random number generated by the random number generation algorithm, the dynamic key data and other data. The dynamic key data may include 16 groups of key data, each group of key data consists of a one-byte ID number and a 32-byte key, such as Figure 3 The 16 groups of key data can be organized in the order of ID numbers, as shown in Figure 4 shown.

[0046] In one embodiment, the encryption and decryption process of each data field adopts a symmetric encryption and decryption algorithm, which is used as an example for description below.

[0047] The custom data domain is encrypted by a symmetric encryption algorithm (encryption uses the initial key mentioned above, and the initial key is not the same as the dynamic key data). The generated ciphertext is added to the original IEEE802.11 protocol beacon frame to form a new beacon frame. The new beacon frame complies with the IEEE802.11 specification. The organized beacon frame is as follows: Figure 5 Then, the second device sends new beacon frame data to the first device, and the new beacon frame carries the encrypted custom data field.

[0048] S2. Parse the first data field from the beacon frame and decrypt it to obtain plain text, and determine the legitimacy of the beacon frame according to the product identifier in the plain text.

[0049] The first device receives the new beacon frame data, first parses out the custom data field, and then decrypts the custom data field using a symmetric encryption and decryption algorithm to obtain the plaintext product-specific identification data, random number, and dynamic key data. In S2, the beacon frame is verified, and if the verification fails, it returns to step XB001 (such as by sending a beacon frame error information feedback message to the second device, so that the second device sends the beacon frame again, thereby executing XB001 again)

[0050] In one embodiment, the method further includes, after the legitimacy verification of the management frame fails, sending feedback information to the sender of the management frame so that the sender can resend the management frame, and after the legitimacy verification of the management frame fails for a preset number of times, no longer communicating with the device that sent the corresponding frame; wherein the management frame includes a beacon frame, a detection frame, an authentication frame, an association frame and their corresponding response frames, and the preset number of times includes 3 times.

[0051] Beacon frames, probe frames, authentication frames, association frames and their corresponding response frames all belong to the category of management frames, but for the purpose of description, this article defines their response frames as beacon response frames, probe response frames, authentication response frames and association response frames. Figure 6 As shown, the beacon frame process is first executed, and the beacon frame verification is mainly used to load the dynamic key group data into the access terminal security module. If the beacon frame verification fails, the current verification will continue. If the verification fails three times in a row, the system prompts an error. If the beacon frame verification is correct, the subsequent process will proceed. By resending the management frame multiple times, the data frame error problem caused by the communication link can be avoided.

[0052] If the beacon frame received by the first device does not contain a custom data field, it indicates that the first device is a pseudo device. If the beacon frame received by the first device contains a custom data field, the last 4 digits of the product-specific identification data obtained after decryption are compared with the last 4 digits of the product-specific product identification stored in the device to see if they are the same. If they are the same, continue with the subsequent operations. If they are not the same, return to step XB001. If verification errors occur more than three times in a row, it can be determined that the first device is a pseudo device. The second device will no longer communicate with it.

[0053] S3. If the beacon frame is legal, the dynamic key data is stored in the security module, and the first random number is processed by a random number processing algorithm to obtain a second random number. The product identification, the second random number and the key installation result status code are generated into a second data domain and encrypted, and added to the beacon response frame for packaging and sending.

[0054] Among them, the beacon response frame is used to decrypt the second data field after the second device receives it, and determine the legitimacy of the beacon response frame based on the password installation result status code, product identification consistency, and the verification result of the second random number based on the random number inverse processing algorithm and the consistency with the first random number.

[0055] In one embodiment, the random number processing algorithm includes performing an XOR operation on the random number to be processed and the preset number of digits of the product identification; correspondingly, the random number inverse processing algorithm includes performing an XOR operation on the random number to be processed and the preset number of digits of the product identification again. The random number may be four digits, and correspondingly, the preset number of digits may be the last four digits of the product identification. This example is used for explanation below.

[0056] The first device, upon successful verification, first stores the dynamic key data in the security module. Based on the above random number processing algorithm, the received first random number can be XORed with the last 4 bytes of the product identification unique to the product to generate a new random number (second random number). The new random number, the product-specific identification data, and the key installation result status code data are used together to generate a custom data domain (second data domain), wherein the specific information of the key installation result status code is as follows: Figure 7 As shown, 01 indicates that the key is successfully installed, 02 indicates a key verification error, and 03 indicates an error in the key installation process.

[0057] The custom data field generated by the first device is encrypted by a symmetric encryption algorithm, and the generated ciphertext is added to the response frame of the original IEEE802.11 protocol beacon frame to form a new beacon response frame. The new beacon response frame complies with the IEEE802.11 specification. The specific format is as follows: Figure 8 Then, the first device sends a new beacon response frame carrying the encrypted custom data field to the second device.

[0058] For the beacon response frame, after the second device receives the new beacon response frame, it uses the symmetric decryption algorithm to decrypt it and obtain the product-specific identification data, random number and key installation result status code data. Verify the key installation result status code, and return to XB001 if the verification error occurs. Verify the product-specific identification data again, and return to XB001 if the verification error occurs. If the first two are verified correctly, then verify the received random number with the original random number (the random number generated by XB001). If they are different, return to XB001. If they are the same, continue the subsequent verification process.

[0059] Second device verification process: If the beacon response frame received by the second device does not contain a custom data field, it indicates that the first device is a pseudo device. If the beacon response frame received by the second device contains a custom data field, by default, the beacon frame is sent every 40ms. In order to improve and speed up data communication efficiency, if the key installation result status code obtained after decryption is not 0x01, it means that the dynamic key data installation of the first device has failed. The second device immediately sends a beacon frame to the first device and repeats the above steps. If the verification error occurs three times, it prompts a key installation error and no longer communicates with the first device. If the verification is correct, the product-specific identification data is verified again. The last 4 bits of the product-specific identification data are compared with the last 4 bits of the product-specific identification data stored in the device to see if they are the same. If they are different, return to step XB001. If they are the same, continue the subsequent process, XOR the received random number with the last 4 bytes of the product-specific identification data, and compare the value obtained by the XOR result with the original random number (the random number generated by XB001). If they are the same, proceed to the subsequent process. If the random number verification error occurs more than three times in a row, it can be judged that the first device is a pseudo device and the second device will no longer communicate with it.

[0060] Assume that an illegal intruder obtains all the beacon frames and beacon response frames of the first device and the second device through a wireless listening device. After obtaining these interactive frame data, the intruder has two possibilities to invade. One is to simulate our first device (that is, the access terminal), and the other is to simulate our second device (that is, the access point device). For the convenience of description, T1 is used to represent the pseudo device used by the intruder to attack. If an intruder simulates our first device and tries to access our wireless system (access the second device) in this way, the beacon frame verification must be performed first, that is, the second device sends an encrypted custom data field beacon frame to T1, and T1 simulates sending the beacon response frame heard in the previous frame to the second device. The beacon response frame must contain an encrypted custom data field, but the random number check obtained by the second device after decrypting the data must fail, because the random number carried by each beacon response frame received by our device is temporarily generated according to the random number of the sending device, and the random number carried by each beacon frame is one-to-one with the random number of the corresponding beacon response frame, and each frame is different. Therefore, the random number carried by the beacon frame response frame simulated by the intruder using T1 cannot pass the verification of the second device. If the verification error occurs more than three times in a row, it can be judged that T1 is a pseudo device and the second device will no longer communicate with it.

[0061] It can be seen that in the wireless network security access method of the present invention, the first random number is randomly generated by the second device, so the second random number that the beacon response frame should return should also be different at each moment. In addition, the returned second random number needs to be obtained based on the first random number based on the random number processing algorithm, that is to say, even if the timely and effective first random number is obtained, the legal second random number cannot be obtained. It can be seen that the first random number carried by each beacon frame corresponds to the second random number of the beacon response frame, and each frame is different. The random number carried by the beacon response frame simulated by the intruder cannot pass the verification of the second device, while the random number carried by the legal beacon response frame can be restored to a random number consistent with the first random number through the random number inverse processing algorithm, thereby effectively realizing the verification of the legitimacy of the access device, and the update of the dynamic key data can be completed through the legal management frame.

[0062] In one embodiment, after being packaged and sent in the beacon response frame, it also includes: generating a third data field based on the product identification, a third random number obtained by the random number generation algorithm and an authorization code, encrypting it and adding it to the detection frame for packaging and sending; if a detection response frame sent by the second device is received, decrypting the fourth data field therein to obtain the product identification, the fourth random number and the authorization code verification result identification; performing product identification verification, authorization code verification result identification verification, and consistency verification of the fourth random number based on the processing result of the random number inverse processing algorithm and the third random number, and determining the legitimacy of the detection response frame based on the verification result.

[0063] Among them, the second device pre-stores an authorization code table of multiple devices, each authorization code corresponds to a MAC address one by one. After receiving the detection frame, the second device decrypts the third data field, and verifies the legitimacy of the detection frame according to the product identification, authorization code, and MAC address of the first device. When the detection frame is legal, a random number processing algorithm is used to obtain a fourth random number from the third random number, and a fourth data field is generated according to the product identification, the fourth random number and the authorization code verification result, and the encrypted data is added to the detection response frame for packaging and sending.

[0064] After the beacon frame verification is correct, the detection frame verification is entered, mainly to confirm that the access terminal is an authorized device. The above three verification methods can be used. If the detection frame verification fails, continue the current verification. If the verification fails for three consecutive times, the system prompts an error. After the detection frame verification is correct, the following process is performed.

[0065] The specific implementation steps are as follows Fig. 9 As shown, the first device generates a custom data domain (third data domain) based on the product identifier unique to the product, the random number (third random number) generated by the random number algorithm, and the authorization code and other data. The authorization code is generated by the system and indicates that it is a legal authorized product. This authorization code is unique for each product. The second device pre-stores the basic data of the first device, such as Fig.10 As shown in the figure (n represents the maximum number of records, and the default maximum supported is 1000 basic data, and the specific number can be configured), the basic data includes the MAC address of the first device and the authorization code of the first device (the basic data can be imported through the network or other means). The custom data domain is encrypted by a symmetric encryption algorithm, and the generated ciphertext is added to the original IEEE802.11 protocol detection frame to form a new detection frame. The new detection frame complies with the IEEE802.11 specification. The specific format is as follows Fig.11 It should be noted that, like the beacon frame, the encryption key used here is the initial key.

[0066] The first device sends new detection frame data to the second device, and the new detection frame carries an encrypted custom data field (third data field). The second device receives the new detection frame data, and first parses out the custom data field (third data field), and then decrypts the custom data field using a symmetric encryption and decryption algorithm to obtain product-specific identification data, a third random number, and the authorization code of the first device. Verify the product-specific identification data. If the verification fails, return to step TC001. If the verification succeeds, verify the authorization code again. If the authorization code verification fails, return to step TC001. After the verification succeeds, the received random number is XORed with the last 4 bytes of the product-specific identification data to generate a new random number (fourth random number). The new random number, product-specific identification data, and authorization code verification result identifier are used together to generate a custom data field (fourth data field), where the specific information of the authorization code verification result identifier can be set as follows: Fig.12 As shown, 0x01 indicates that the authorization code verification result is successful, 0x02 indicates that the authorization code does not exist, 0x03 indicates that the MAC address does not exist, and 0x04 indicates that the authorization code verification process is wrong. The detection response frame format is as follows Fig.13 shown.

[0067] During the verification process, if the detection frame received by the second device does not contain a custom data field, it indicates that the first device is a pseudo device. If the detection frame received by the second device contains a custom data field, the last 4 digits of the product-specific identification data obtained after decryption are compared with the last 4 digits of the product-specific identification data stored in the device to see if they are the same. If they are the same, continue with the subsequent operations. If they are not the same, return to step TC001. After the product-specific identification data is successfully verified, the second device searches for the corresponding authorization code from the pre-stored basic data according to the MAC address of the first device in the IEEE802.11 protocol header, and compares the obtained authorization code with the received authorization code. If they are the same, it means that the authorization code verification is successful. If they are different, it can be determined that the first device is a pseudo device and the second device will no longer communicate with it.

[0068] If an intruder uses T1 to simulate our second device and tries to access by deceiving our first device, then according to Figure 6 Process, after the beacon frame verification, the first device needs to perform a probe frame verification. The first device sends a probe frame to T1, and T1 sends the previously intercepted probe response frame to the first device. At this time, the random number carried in the probe response frame does not correspond to the random number currently generated by the first device, and the verification fails. Similarly, if the verification error occurs more than three times in a row, T1 can be judged as a pseudo device and the first device will no longer communicate with it. From the above description, it can be seen that whether T1 simulates an access terminal or an access point device, it cannot successfully connect to our device. Therefore, this two-way verification can effectively prevent phishing attacks, replay attacks, man-in-the-middle attacks and password reinstallation attacks, and reduce access risks.

[0069] In one embodiment, the dynamic key data is a key group including multiple keys, each key has a one-to-one corresponding key ID. Accordingly, after determining the legitimacy of the detection response frame according to the verification result, it also includes: selecting a configuration key from the key group, and generating a fifth data field according to the product identification, a fifth random number obtained by the random number generation algorithm and the key ID of the configuration key, encrypting it and adding it to the authentication frame for packaging and sending; if an authentication response frame sent by the second device is received, decrypting the sixth data field therein to obtain the product identification, the sixth random number and the key ID; performing product identification verification, key ID verification, and consistency verification of the sixth random number based on the processing result of the random number inverse processing algorithm and the fifth random number, and determining the legitimacy of the authentication response frame according to the verification result. When the authentication response frame is confirmed to be legal, the configuration key is used for encryption and decryption of subsequent data fields.

[0070] Among them, after the second device receives the authentication frame, it decrypts the fifth data field and verifies the legitimacy of the detection frame according to the product identification and the key ID. When the authentication frame is legal, the fifth random number is subjected to a random number processing algorithm to obtain a sixth random number, and a sixth data field is generated according to the product identification, the sixth random number and the key ID. After encryption, the sixth data field is added to the authentication response frame for packaging and sending, and the configuration key is used for encryption and decryption of subsequent data fields.

[0071] After the detection frame verification is correct, it enters the authentication frame verification. The authentication frame verification is mainly used to change the key of the management frame wireless communication. If the authentication frame verification fails, the current verification will continue. If the verification fails for three consecutive times, the system prompts an error. After the authentication frame verification is correct, the following process is carried out.

[0072] The specific verification process is as follows: Fig.14 As shown, the first device generates a custom data field (fifth data field) based on the product-specific identification data, the random number (fifth random number) generated by the random number algorithm, and the key ID and other data, wherein the key ID is the ID in the dynamic key group such as Figure 5 As shown, the ID is generated according to the key selection algorithm. The time period for each key timing change can be configured. According to the security needs of the system, it can be freely configured between the maximum timing period and the minimum timing period. The maximum timing period is 1 year and the minimum timing period is 40ms. In general, the smaller the configured timing period, the higher the system security level. The custom data domain is encrypted by the symmetric encryption algorithm, and the generated ciphertext is added to the original IEEE802.11 protocol authentication frame to form a new authentication frame. The new authentication complies with the IEEE802.11 specification. The specific format is as follows Fig.15 .

[0073] It should be noted that, like the beacon frame, the key used for symmetric encryption and decryption is the initial key. The first device sends new authentication frame data to the second device, and the authentication frame carries an encrypted custom data field (fifth data field). The second device receives the authentication frame data, first parses out the fifth data field, and then decrypts the fifth data field using a symmetric encryption and decryption algorithm to obtain product-specific identification data, random numbers, and key ID. Verify the product-specific identification data. If the verification fails, return to step RZ001. If the verification succeeds, verify the key ID again. If the key ID verification fails, return to step RZ001. After the verification succeeds, the received random number is XORed with the last 4 bytes of the product-specific identification data to generate a new random number. This new random number (sixth random number), the product-specific identification data, and the key ID received this time and other data together generate a custom data field (sixth data field).

[0074] The specific verification process is that if the authentication frame received by the second device does not contain a custom data field, it indicates that the first device is a pseudo device. If the authentication frame received by the second device contains a custom data field, the last 4 digits of the product-specific identification data obtained after decryption are compared with the last 4 digits of the product-specific identification data stored in the device to see if they are the same. If they are the same, continue with the subsequent operations, otherwise return to step RZ001. After the product-specific identification data is successfully verified, verify the key ID. The specific method is that the received key ID must be within the range of 1 to 16, otherwise return to step RZ001. If errors occur more than three times in a row during the verification, it can be determined that the first device is a pseudo device and the second device will no longer communicate with it.

[0075] The custom data field generated by the second device is encrypted by a symmetric encryption algorithm, and the generated ciphertext is added to the original IEEE802.11 protocol authentication response frame to form a new authentication response frame. The new authentication response frame complies with the IEEE802.11 specification. The specific format is as follows Fig.16 .

[0076] The second device sends a new authentication response frame data carrying an encrypted custom data field (sixth data field) to the first device. After receiving the new authentication response frame, the first device decrypts it using a symmetric decryption algorithm to obtain product-specific identification data, random numbers, and key ID. Verify the product-specific identification data. If the verification is wrong, return to RZ001. If the verification is correct, perform a key ID verification. If the verification is wrong, return to RZ001. If the key ID verification is correct, then perform an XOR of the received random number (sixth random number) with the last four digits of the product identification, and then verify it with the original random number (the random number generated by RZ001, the fifth random number). If they are different, return to RZ001. If they are the same, continue with the following verification.

[0077] It should be noted that the custom data fields in all subsequent management frames are encrypted and decrypted using the key corresponding to the key ID here, that is, the configuration key selected from the dynamic key data is used for encryption and decryption of subsequent data fields.

[0078] If the authentication response frame received by the first device does not contain a custom data field, it indicates that the second device is a pseudo device. If the authentication response frame received by the first device contains a custom data field, the last 4 digits of the product-specific identification data are compared with the last 4 digits of the product-specific identification data stored in the device to see if they are the same. If they are different, return to step RZ001. If they are the same, verify the key ID. The specific method is to see if the received key ID is the same as the key ID generated by RZ001. If they are different, return to step RZ001. Verify that the key ID is correct and then XOR the received random number with the last 4 bytes of the product-specific identification data. Compare the value obtained by the XOR result with the original random number (the random number generated by RZ001). If they are the same, perform the following associated authentication process. If the above verification fails three times in a row, it can be determined that the first device is a pseudo device and the second device will no longer communicate with it.

[0079] In one embodiment, after determining the legitimacy of the authentication response frame according to the verification result, it also includes: if the authentication response frame is legal, generating a seventh data field according to the product identification, the seventh random number obtained by the random number generation algorithm, the authorization code, and the key ID, encrypting it, adding it to the association frame for packaging and sending; if an association response frame sent by the second device is received, decrypting the eighth data field therein according to the new encryption and decryption key to obtain the product identification, the eighth random number and the association status identification; verifying the consistency of the product identification, the association status identification, and the eighth random number based on the processing result of the random number inverse processing algorithm with the seventh random number, and determining the legitimacy of the association response frame according to the verification result; if the association response frame is confirmed to be legal, determining whether the access is successful according to the association status identification.

[0080] Among them, after the second device receives the association frame, it decrypts the seventh data field and verifies the legitimacy of the detection frame according to the product identification, authorization code, and key ID. When the association frame is legal, the seventh random number is processed by a random number processing algorithm to obtain the eighth random number, and the eighth data field is generated according to the product identification, the eighth random number and the association status identification, and after encryption, it is added to the association response frame for packaging and sending.

[0081] After the authentication frame is verified correctly, the association frame verification is entered, which is used to establish the final confirmation of the wireless communication session and to prevent DoS attacks. If the association frame verification fails, the current verification will continue. If the verification fails three times in a row, the system prompts an error. After the association frame verification is correct, it means that the access is successful and normal data transmission and reception can be entered.

[0082] like Fig.17As shown, the first device generates a custom data field (the seventh data field) based on the product-specific identification data, the random number generated by the random number algorithm (the seventh random number), the authorization code (the authorization code mentioned in the detection frame process) and the key ID (the key ID mentioned in the authentication frame) and other data, and the generated ciphertext is added to the original IEEE802.11 protocol association frame to form a new association frame. The new association frame complies with the IEEE802.11 specification, and the specific format is as follows Fig.18 .

[0083] It should be noted that the encryption key used at GL003 is the key configured during the authentication frame. The first device sends new associated frame data to the second device, and the new associated frame carries an encrypted custom data field. The second device receives the new associated frame data, first parses out the custom field, and then decrypts the custom data field using a symmetric encryption and decryption algorithm to obtain product-specific identification data, random numbers, authorization codes, and key IDs. Verify the product-specific identification data. If the verification fails, return to step GL001. If the verification succeeds, verify the authorization code. If the verification fails, it can be determined that the first device simulates our company's equipment to carry out a DoS attack, and will no longer communicate with the first device. If the verification succeeds, verify the key ID again. If the key ID verification fails, it can be determined that the first device simulates our company's equipment to carry out a DoS attack, and will no longer communicate with it. After the verification succeeds, the received random number is XORed with the last 4 bytes of the product-specific identification data to generate a new random number (the eighth random number). This new random number, product-specific identification data, and associated status identification are used together to generate a custom data field (the eighth data field), where the specific information of the associated status identification is as follows: Fig.19 As shown, 0x01 indicates successful association, and 0x02 indicates failed association.

[0084] The specific verification method is that if the associated frame received by the second device does not contain a custom data field, it indicates that the first device is a pseudo device. If the associated frame received by the second device contains a custom data field, the last 4 digits of the product-specific identification data obtained after decryption are compared with the last 4 digits of the product-specific identification data stored in the device to see if they are the same. If they are the same, continue with the subsequent operations. If they are not the same, return to step GL001. After the product-specific identification data is successfully verified, the authorization code is verified. The verification method refers to the detection frame process. After the verification is successful, the key ID is verified. The specific method refers to the authentication frame process. If the verification is wrong, return to step GL001. If the verification fails for more than three consecutive times, it can be determined that the first device is a pseudo device and the second device will no longer communicate with it.

[0085] The custom data field generated by the second device is encrypted by a symmetric encryption algorithm, and the generated ciphertext is added to the original IEEE802.11 protocol association response frame to form a new association response frame. The new association response frame complies with the IEEE802.11 specification. The specific format is as follows Fig. 20 .

[0086] The second device sends a new association response frame data carrying an encrypted custom data field to the first device. After receiving the new authentication response frame, the first device decrypts it using a symmetric decryption algorithm to obtain product-specific identification data, random numbers, and association status identifiers. Verify the product-specific identification data. If the verification is wrong, return to GL001. If the verification is correct, verify the association status identifier. If the verification is wrong, return to GL001. If the association status identifier is verified correctly, then verify the received random number with the original random number (the random number generated by GL001). If they are different, return to GL001. If they are the same, it means that the access is successful.

[0087] During the specific verification process, if the association response frame received by the first device does not contain a custom data field, it indicates that the second device is a pseudo device. If the authentication response frame received by the first device contains a custom data field, the last 4 digits of the product-specific identification data are compared with the last 4 digits of the product-specific identification data stored in the device to see if they are the same. If they are not the same, return to step GL001. If the verification is correct, check the association status identifier to determine whether this identifier is 0x01. Otherwise, return to step GL001. If the verification of the association status identifier is correct, then XOR the received random number with the last 4 bytes of the product-specific identification data. The value obtained by the XOR result is compared with the original random number (the random number generated by GL001). If they are the same, it means that the access is successful. If the above verification fails three times in a row, it can be judged that the first device is a pseudo device and the second device will no longer communicate with it.

[0088] It should be noted that in the above process, starting from the completion of the authentication frame verification process, the subsequent management frame process uses the configuration key specified in the authentication process for communication.

[0089] In one embodiment, the random number generation algorithm includes: n =(S n-1 +IV) mod 0xffff. When n=1, S0 is the random number generated for the first time after the system is powered on, IV is a constant, and n is an integer greater than 0.

[0090] This is the random number generation algorithm on the sender side. The random number generated each time is the sum of the last sent random number and the IV constant, and then the sum is modulo 0xffff.

[0091] In addition, the random number generation algorithm of the responder is specifically as follows: Sr = St ⊕ A4, where St is the random number received from the sender. A4 is the last four digits of the product-specific product identification, and the random number Sr of the responder is the XOR value of the random number of the sender and the last four digits of the product-specific identification data. During verification, Sr is XORed with the last four digits of the product identification again to obtain Sr' again, verify the consistency of Sr' and Sr, and combine with other parameters, such as product identification, to determine the legitimacy of the management frame.

[0092] like Fig.21 As shown, the present invention also provides a wireless network security access device, including: a data transceiver module, used to receive a beacon frame sent by a second device, the beacon frame including a first data field generated and encrypted by the second device, the first data field including a product identification, a first random number obtained based on a random number generation algorithm, and dynamic key data; an encryption and decryption module, used to parse the first data field from the beacon frame and decrypt it to obtain plain text; a data processing module, used to determine the legitimacy of the beacon frame based on the product identification in the plain text; a data security module, used to store the dynamic key data when the beacon frame is legal; a data field generation module, used to obtain a second random number using a random number processing algorithm for the first random number, and generate a second data field using the product identification, the second random number and the key installation result status code, so that after being encrypted by the encryption and decryption module, it is added to the beacon response frame and packaged and sent by the data transceiver module.

[0093] Wherein, the beacon response frame is used for the second device to decrypt the second data domain after receiving it, and determine the legitimacy of the beacon response frame according to the password installation result status code, product identification consistency, and the verification result of the second random number based on the random number inverse processing algorithm and the consistency of the first random number; wherein the wireless network security access device and the second device both pre-store the product identification and the initial key for encryption and decryption, and the initial key is used for encryption and decryption of the data domain. wherein, the data transceiver module is used for transceiving wired data and wireless data, specifically, such as receiving the beacon frame sent by the second device.

[0094] The encryption and decryption module is mainly used to encrypt and decrypt communication data, specifically, to parse the first data field from the beacon frame and decrypt it to obtain plain text.

[0095] The data processing module is mainly used to package the data to be sent, analyze and process the received data, and verify it. Specifically, it determines the legitimacy of the beacon frame based on the product identification in the plain text.

[0096] The data security module is mainly used to store important initialization data and key data of the system. The storage method is all in ciphertext form and can only be accessed using a dedicated interface function. Specifically, if the beacon frame is legal, the key data will be stored.

[0097] The data domain generation module is mainly used to generate custom data domains using product-specific identification data and random numbers.

[0098] The wireless network security access device provided in the embodiment of the present invention has the same implementation principle and technical effects as those of the aforementioned wireless network security access method embodiment. For the sake of brief description, for matters not mentioned in the embodiment of the wireless network security access device, reference may be made to the corresponding contents in the aforementioned wireless network security access method embodiment.

[0099] The present application also provides a computer-readable storage medium, such as a flash memory, a hard disk, a multimedia card, a card-type memory (e.g., an SD or DX memory, etc.), a random access memory (RAM), a static random access memory (SRAM), a read-only memory (ROM), an electrically erasable programmable read-only memory (EEPROM), a programmable read-only memory (PROM), a magnetic memory, a disk, an optical disk, a server, an App application store, etc., on which a computer program is stored, and when the program is executed by a processor, a corresponding function is realized. When the computer-readable storage medium of this embodiment is executed by a processor, a method embodiment of a wireless network secure access method is realized.

[0100] It should be pointed out that, according to the needs of implementation, the various steps / components described in this application can be split into more steps / components, and two or more steps / components or partial operations of steps / components can be combined into new steps / components to achieve the purpose of the present invention.

[0101] The order of execution of each step in the above embodiment does not mean the order of execution. The order of execution of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiment of the present application.

[0102] It should be understood that those skilled in the art can make improvements or changes based on the above description, and all these improvements and changes should fall within the scope of protection of the appended claims of the present invention.

Claims

1. A wireless network secure access method, characterized in that: Applied to a first device, the method comprises: Receiving a beacon frame sent by a second device, wherein the beacon frame includes a first data field generated and encrypted by the second device, wherein the first data field includes a product identification, a first random number obtained based on a random number generation algorithm, and dynamic key data; Parsing the first data field from the beacon frame and decrypting it to obtain plain text, and determining the legitimacy of the beacon frame according to the product identifier in the plain text; If the beacon frame is legal, the dynamic key data is stored in a security module, and a random number processing algorithm is used to obtain a second random number for the first random number, and the product identification, the second random number and the key installation result status code are generated into a second data field and encrypted, and then added to the beacon response frame for packaging and sending; The beacon response frame is used for the second device to decrypt the second data field after receiving it, and determine the legitimacy of the beacon response frame according to the password installation result status code, product identification consistency, and the verification result of the second random number based on the random number inverse processing algorithm and the consistency of the first random number; The first device and the second device both pre-store product identification and initial encryption and decryption keys, and the initial keys are used for encryption and decryption of the data domain.

2. The wireless network secure access method according to claim 1, characterized in that: After the beacon response frame is added and packaged and sent, the method further includes: Generate a third data field according to the product identification, a third random number obtained by the random number generation algorithm, and the authorization code, encrypt it, add it to the detection frame, and package it for transmission; If a detection response frame sent by the second device is received, the fourth data field is decrypted to obtain the product identification, the fourth random number and the authorization code verification result identification; Perform product identification verification, authorization code verification result identification verification, and consistency verification of the fourth random number based on the processing result of the random number inverse processing algorithm and the third random number, and determine the legitimacy of the detection response frame according to the verification result; Among them, the second device pre-stores an authorization code table of multiple devices, each authorization code corresponds to a MAC address one by one. After receiving the detection frame, the second device decrypts the third data field, and verifies the legitimacy of the detection frame according to the product identification, authorization code, and MAC address of the first device. When the detection frame is legal, a random number processing algorithm is used to obtain a fourth random number from the third random number, and a fourth data field is generated according to the product identification, the fourth random number and the authorization code verification result, and the encrypted data is added to the detection response frame for packaging and sending.

3. The wireless network secure access method according to claim 2, characterized in that: The dynamic key data is a key group including a plurality of keys, each key having a one-to-one corresponding key ID. Accordingly, after determining the legitimacy of the detection response frame according to the verification result, the method further includes: Select a configuration key from the key group, generate a fifth data field according to the product identifier, a fifth random number obtained by the random number generation algorithm and the key ID of the configuration key, encrypt the data field, add the data field to the authentication frame and package it for transmission; If the authentication response frame sent by the second device is received, the sixth data field is decrypted to obtain the product identification, the sixth random number and the key ID; Perform product identification verification, key ID verification, and consistency verification between the processing result of the sixth random number based on the random number inverse processing algorithm and the fifth random number, and determine the legitimacy of the authentication response frame according to the verification result. If the authentication response frame is confirmed to be legitimate, use the configuration key for encryption and decryption of subsequent data fields; Among them, after the second device receives the authentication frame, it decrypts the fifth data field and verifies the legitimacy of the detection frame according to the product identification and the key ID. When the authentication frame is legal, the fifth random number is subjected to a random number processing algorithm to obtain a sixth random number, and a sixth data field is generated according to the product identification, the sixth random number and the key ID. After encryption, the sixth data field is added to the authentication response frame for packaging and sending, and the configuration key is used for encryption and decryption of subsequent data fields.

4. The wireless network secure access method according to claim 3, characterized in that: After determining the legitimacy of the authentication response frame according to the verification result, the method further includes: If the authentication response frame is legal, the seventh data field is generated according to the product identification, the seventh random number obtained by the random number generation algorithm, the authorization code, and the key ID, and is encrypted and added to the associated frame for packaging and sending; If an association response frame sent by the second device is received, the eighth data field is decrypted according to the new encryption and decryption key to obtain the product identifier, the eighth random number and the association status identifier; Perform product identification, association status identification, and consistency verification of the eighth random number based on the random number inverse processing algorithm and the seventh random number, and determine the legitimacy of the association response frame according to the verification result; If the association response frame confirms that it is legal, determine whether the access is successful based on the association status identifier; Among them, after the second device receives the association frame, it decrypts the seventh data field and verifies the legitimacy of the detection frame according to the product identification, authorization code, and key ID. When the association frame is legal, the seventh random number is processed by a random number processing algorithm to obtain the eighth random number, and the eighth data field is generated according to the product identification, the eighth random number and the association status identification, and after encryption, it is added to the association response frame for packaging and sending.

5. The wireless network secure access method according to any one of claims 1 to 4, characterized in that: The encryption and decryption process of each data field adopts a symmetric encryption and decryption algorithm.

6. The wireless network secure access method according to any one of claims 1 to 4, characterized in that: The method further includes, after the management frame legality verification fails, sending feedback information to the management frame sender so that the sender can resend the management frame, and after the management frame legality verification fails for a preset number of times, no longer communicating with the device that sent the corresponding frame; The management frames include beacon frames, detection frames, authentication frames, association frames and their corresponding response frames, and the preset number of times includes 3 times.

7. The wireless network secure access method according to any one of claims 1 to 4, characterized in that: The random number generation algorithm includes: S n =(S n-1 +IV)mod 0xffff; Among them, S0 is the random number generated for the first time after the system is powered on, IV is a constant, n is an integer greater than 0, and mod is the modulus.

8. The wireless network secure access method according to any one of claims 1 to 4, characterized in that: The random number processing algorithm includes performing an XOR operation on the random number to be processed and the preset number of digits of the product identification; Correspondingly, the random number inverse processing algorithm includes performing XOR again on the random number to be processed and the preset number of bits of the product identification.

9. A wireless network security access device, characterized in that: include: A data transceiver module, configured to receive a beacon frame sent by a second device, wherein the beacon frame includes a first data field generated and encrypted by the second device, wherein the first data field includes a product identification, a first random number obtained based on a random number generation algorithm, and dynamic key data; An encryption and decryption module, used for parsing the first data field from the beacon frame and decrypting it to obtain plain text; A data processing module, used to determine the legitimacy of the beacon frame based on the product identification in the plain text; A data security module, used for storing the dynamic key data if the beacon frame is legal; A data domain generation module, used to obtain a second random number by applying a random number processing algorithm to the first random number, and to generate a second data domain by using the product identification, the second random number and the key installation result status code, so as to be encrypted by the encryption and decryption module, added to the beacon response frame and packaged and sent by the data transceiver module; The beacon response frame is used for the second device to decrypt the second data field after receiving it, and determine the legitimacy of the beacon response frame according to the password installation result status code, product identification consistency, and the verification result of the second random number based on the random number inverse processing algorithm and the consistency of the first random number; The wireless network security access device and the second device both pre-store product identification and initial encryption and decryption keys, and the initial keys are used for encryption and decryption of the data domain.

10. A computer storage medium, characterized in that: A computer program executable by a processor is stored therein, and the computer program executes the wireless network security access method described in any one of claims 1 to 8.

Images