Network access method, device, system and related product

Abstract

The invention discloses a network access method, device and system and a related product, and belongs to the technical field of WLAN (Wireless Local Area Network). The method comprises the following steps: a cloud server receives network information of a first access point (AP) reported by a wireless terminal, wherein the first AP is an AP associated with the wireless terminal or an AP once associated with the wireless terminal; and the cloud server sends an access permission to the first AP to the wireless terminal, wherein the access permission is based on the network information of the first AP. In the embodiment of the invention, the wireless terminal can be linked with the cloud server, so that the access authority of the first AP associated with or once associated with the wireless terminal can be dynamically modified through the cloud server. On one hand, the access authority of the AP associated with or once associated with the wireless terminal can be managed without configuring a special monitoring AP for the WLAN, and on the other hand, the access authority can be quickly determined through the cloud server for a scene with dynamic change of the WLAN.

Description

Technical Field

[0001] The embodiments of the present application relate to the technical field of wireless local area network (WLAN), and in particular to a method, device, system and related products for accessing a network. Background Art

[0002] A wireless terminal can access a WLAN through an access point (AP). In order to improve the security of the wireless terminal, it is usually necessary to verify the AP associated with the wireless terminal to ensure that the wireless terminal is associated with a legitimate AP.

[0003] A wireless intrusion detection system (WIDS) or a wireless intrusion prevention system (WIPS) can be used to ensure that the wireless terminal is associated with a legitimate AP. Alternatively, a static whitelist can be configured at the wireless terminal to ensure that the wireless terminal is associated with a legitimate AP.

[0004] The above WIDS / WIPS requires the configuration of monitoring APs in the WLAN to monitor whether the APs associated with the wireless terminals are legitimate. For networks without monitoring APs, it is impossible to ensure that the wireless terminals are associated with legitimate APs. In addition, configuring a static whitelist at the wireless terminal cannot quickly respond to the scenario of dynamic changes in access to the WLAN. Summary of the invention

[0005] The embodiments of the present application provide a method, device, system and related products for accessing a network. On the one hand, it is possible to manage the access rights of the APs associated or previously associated with the wireless terminal without configuring a special monitoring AP for the WLAN. On the other hand, it is possible to quickly determine the access rights through the cloud service end for the scenario of dynamically changing WLAN. The technical solution is as follows:

[0006] In a first aspect, a method for accessing a network is provided, in which a cloud service end receives network information of a first access point AP reported by a wireless terminal, where the first AP is an AP associated with the wireless terminal or an AP that the wireless terminal has been associated with; the cloud service end sends access rights to the first AP to the wireless terminal, and the access rights are based on the network information of the first AP.

[0007] In the embodiment of the present application, the wireless terminal can be linked with the cloud server to dynamically modify the access rights of the first AP associated or previously associated with the wireless terminal through the cloud server. On the one hand, it is possible to manage the access rights of the AP associated or previously associated with the wireless terminal without configuring a special monitoring AP for the WLAN, and on the other hand, the access rights can be quickly determined through the cloud server for the scenario of dynamic changes in the WLAN.

[0008] Based on the method provided in the first aspect, in a possible implementation, before the cloud service end sends access rights to the first AP to the wireless terminal, the cloud service end sends network information of the first AP to the monitoring terminal, the monitoring terminal is a terminal bound to the wireless terminal, the wireless terminal communicates with the cloud service end through a first link, and the monitoring terminal communicates with the cloud service end through a second link; the cloud service end receives the access rights to the first AP sent by the monitoring terminal.

[0009] After receiving the network information of the first AP reported by the wireless terminal, the cloud service end may forward the network information of the first AP to the monitoring terminal bound to the wireless terminal, so as to dynamically determine the access authority of the wireless terminal to the first AP through the monitoring terminal.

[0010] Based on the method provided in the first aspect, in a possible implementation manner, before the cloud service end receives the access permission to the first AP sent by the monitoring terminal, the cloud service end generates risk information based on the network information of the first AP and the locally stored security access rules, or generates risk information based on the network information of the first AP and the historical association behavior of the wireless terminal, the risk information indicating the risk of the wireless terminal associating with the first AP; the cloud service end sends the risk information to the monitoring terminal.

[0011] The cloud service sends the risk information and the network information of the first AP to the monitoring terminal, so that the user corresponding to the monitoring terminal can set the access authority of the wireless terminal to the first AP based on more information, further improving the security of the wireless terminal.

[0012] Based on the method provided in the first aspect, in a possible implementation manner, the network information of the first AP includes one or more of a service set identifier SSID of the first AP, a location of the first AP, and a time when the wireless terminal associates with the first AP.

[0013] Through the above manner, the cloud service end or the monitoring terminal can flexibly configure the access authority of the wireless terminal to the first AP based on the network information of the first AP.

[0014] Based on the method provided in the first aspect, in a possible implementation manner, the access right includes a permission type, and the permission type indicates whether the wireless terminal is allowed or prohibited from associating with the first AP.

[0015] Based on the method provided in the first aspect, in a possible implementation manner, the access right further includes one or more of an allowed association duration, an allowed association time period, and a permission aging duration.

[0016] Through the above method, the cloud service end or the monitoring terminal can flexibly configure the specific access rights of the wireless terminal to the first AP.

[0017] In a second aspect, a method for accessing a network is provided, in which the wireless terminal reports network information of a first AP to a cloud service end, where the first AP is an AP associated with the wireless terminal or an AP with which the wireless terminal has been associated; the wireless terminal receives access rights to the first AP sent by the cloud service end, and the access rights are based on the network information of the first AP.

[0018] In the embodiment of the present application, the wireless terminal can be linked with the cloud server to dynamically modify the access rights of the first AP associated or previously associated with the wireless terminal through the cloud server. On the one hand, it is possible to manage the access rights of the AP associated or previously associated with the wireless terminal without configuring a special monitoring AP for the WLAN, and on the other hand, the access rights can be quickly determined through the cloud server for the scenario of dynamic changes in the WLAN.

[0019] Based on the method provided in the second aspect, in a possible implementation, in this method, when the wireless terminal detects the first AP, if the first AP is an AP that has not been associated before the current time, the wireless terminal associates with the first AP, and the duration allowed for associating with the first AP is a temporary association duration; within the temporary association duration after associating with the first AP, if access permission is received and the access permission indicates that the wireless terminal is prohibited from associating with the first AP, the wireless terminal disconnects the association with the first AP.

[0020] Through the above method, after the wireless terminal associates with an AP for the first time, the cloud service end can dynamically modify the access rights of the wireless terminal to the AP.

[0021] Based on the method provided in the second aspect, in a possible implementation manner, the network information of the first AP includes one or more of a service set identifier SSID of the first AP, a location of the first AP, and a time when the wireless terminal associates with the first AP.

[0022] Based on the method provided in the second aspect, in a possible implementation manner, the access right includes a permission type, and the permission type indicates whether the wireless terminal is allowed or prohibited from associating with the first AP.

[0023] Based on the method provided in the second aspect, in a possible implementation manner, the access right also includes one or more of an allowed association duration, an allowed association time period, and a permission aging duration.

[0024] According to a third aspect, a method for accessing a network is provided, in which a monitoring terminal receives network information of a first access point AP sent by a cloud service end, the first AP is an AP associated with the wireless terminal or an AP previously associated with the wireless terminal, the monitoring terminal is a terminal bound to the wireless terminal, and the wireless terminal communicates with the cloud service end via a first link, and the monitoring terminal communicates with the cloud service end via a second link; the monitoring terminal sends the access rights of the wireless terminal to the first AP to the cloud service end, and the access rights are based on the network information of the first AP.

[0025] In the embodiment of the present application, the wireless terminal can be linked with the cloud service end and the monitoring terminal to dynamically modify the access rights of the first AP associated or previously associated with the wireless terminal through the cloud service end and the monitoring terminal. On the one hand, it is possible to manage the access rights of the AP associated or previously associated with the wireless terminal without configuring a special monitoring AP for the WLAN, and on the other hand, the access rights can be quickly determined through the cloud service end for the scenario of dynamic changes in the WLAN.

[0026] Based on the method provided in the third aspect, in one possible implementation, before the monitoring terminal sends the access rights of the wireless terminal to the first AP to the cloud service end, the network information of the first AP is displayed; in response to the user's permission configuration operation, the access rights of the wireless terminal to the first AP are obtained.

[0027] Through the above manner, the user corresponding to the monitoring terminal can dynamically modify the access authority of the AP associated or previously associated with the bound wireless terminal.

[0028] Based on the method provided in the third aspect, in a possible implementation, in response to the user's permission configuration operation, before obtaining the wireless terminal's access permission to the first AP, risk information sent by the cloud service end is received, and the risk information indicates the risk of the wireless terminal associating with the first AP, and the risk information is based on the network information of the first AP and the security access rules stored in the cloud service end, or the risk information is based on the network information of the first AP and the historical association behavior of the wireless terminal; the risk information is displayed.

[0029] The cloud service sends the risk information and the network information of the first AP to the monitoring terminal, so that the user corresponding to the monitoring terminal can set the access authority of the wireless terminal to the first AP based on more information, further improving the security of the wireless terminal.

[0030] Based on the method provided in the third aspect, in a possible implementation manner, the network information of the first AP includes one or more of a service set identifier SSID of the first AP, a location of the first AP, and a time when the wireless terminal associates with the first AP.

[0031] Based on the method provided in the third aspect, in a possible implementation manner, the access right includes a permission type, and the permission type indicates whether the wireless terminal is allowed or prohibited from associating with the first AP.

[0032] Based on the method provided in the third aspect, in a possible implementation manner, the access right also includes one or more of an allowed association duration, an allowed association time period, and a permission aging duration.

[0033] In a fourth aspect, a device for accessing a network is provided, wherein the device for accessing a network has the function of implementing the method for accessing a network in the first aspect. The device for accessing a network includes at least one module, and the at least one module is used to implement the method for accessing a network provided in the first aspect.

[0034] In a fifth aspect, a device for accessing a network is provided, wherein the device for accessing a network has the function of implementing the method for accessing a network in the second aspect. The device for accessing a network includes at least one module, and the at least one module is used to implement the method for accessing a network provided in the second aspect.

[0035] In a sixth aspect, a device for accessing a network is provided, wherein the device for accessing a network has the function of implementing the method for accessing a network in the second aspect. The device for accessing a network includes at least one module, and the at least one module is used to implement the method for accessing a network provided in the second aspect.

[0036] In a seventh aspect, a wireless terminal is provided, wherein the structure of the wireless terminal includes a processor and a memory, wherein the memory is used to store a program that supports the wireless terminal to execute the method for accessing a network provided in the first aspect, and to store data involved in implementing the method for accessing a network provided in the first aspect. The processor is configured to execute the program stored in the memory.

[0037] In an eighth aspect, a cloud service end is provided, wherein the structure of the cloud service end includes a processor and a memory, wherein the memory is used to store a program that supports the cloud service end to execute the method for accessing a network provided in the second aspect, and to store data involved in implementing the method for accessing a network provided in the second aspect. The processor is configured to execute the program stored in the memory.

[0038] In a ninth aspect, a monitoring terminal is provided, wherein the structure of the monitoring terminal includes a processor and a memory, wherein the memory is used to store a program that supports the monitoring terminal to execute the method for accessing a network provided in the third aspect, and to store data involved in implementing the method for accessing a network provided in the third aspect. The processor is configured to execute the program stored in the memory.

[0039] In the tenth aspect, a computer-readable storage medium is provided, wherein instructions are stored in the computer-readable storage medium, and when the computer-readable storage medium is executed on a computer, the computer executes the method for accessing a network described in the first aspect, or executes the method for accessing a network described in the second aspect, or executes the method for accessing a network described in the third aspect.

[0040] In the eleventh aspect, a computer program product comprising instructions is provided, which, when executed on a computer, enables the computer to execute the method for accessing a network described in the first aspect, or the method for accessing a network described in the second aspect, or the method for accessing a network described in the third aspect.

[0041] The technical effects obtained by the corresponding technical means in the above-mentioned second to eleventh aspects are similar and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] Figure 1 This is a schematic diagram of the architecture of a WLAN network within an enterprise provided by an embodiment of the present application;

[0043] Figure 2 This is a schematic diagram of a scenario in which a wireless terminal is associated with an AP provided in an embodiment of the present application;

[0044] Figure 3 It is a schematic diagram of the architecture of a communication network provided in an embodiment of the present application;

[0045] Figure 4 is a schematic diagram of the architecture of another communication network provided in an embodiment of the present application;

[0046] Figure 5 is a schematic diagram of the architecture of another communication network provided in an embodiment of the present application;

[0047] Figure 6 is a flow chart of a method for accessing a network provided by an embodiment of the present application;

[0048] Figure 7 This is a schematic diagram of a scenario of accessing a network provided in an embodiment of the present application;

[0049] Figure 8 is a schematic diagram of another scenario of accessing a network provided in an embodiment of the present application;

[0050] Fig. 9 is a flow chart of another method for accessing a network provided in an embodiment of the present application;

[0051] Fig.10 is a schematic diagram of another scenario of accessing a network provided in an embodiment of the present application;

[0052] Fig.11 is a schematic diagram of another scenario of accessing a network provided in an embodiment of the present application;

[0053] Fig.12 It is a structural diagram of a device for accessing a network provided in an embodiment of the present application;

[0054] Fig.13 is a schematic diagram of the structure of another device for accessing a network provided in an embodiment of the present application;

[0055] Fig.14 is a schematic diagram of the structure of another device for accessing a network provided in an embodiment of the present application;

[0056] Fig.15 It is a structural diagram of a computer device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0057] In order to make the purpose, technical solutions and advantages of the present application more clear, the implementation mode of the present application will be further described in detail below with reference to the accompanying drawings.

[0058] Wi-Fi is a WLAN technology based on the Institute of Electrical and Electronics Engineers (IEEE) 802.11 standard. Wi-Fi is also known as "wireless hotspot" or "Wi-Fi hotspot" or "wireless network" or "Wi-Fi network". Since the release of the first generation of IEEE 802.11 standards in 1997, the IEEE802.11 standard has evolved through multiple versions. Before the release of Wi-Fi 6, the Wi-Fi standard was identified by version numbers from IEEE802.11b to IEEE 802.11ac. With the evolution of Wi-Fi standards, the Wi-Fi Alliance chose to rename the Wi-Fi standards using digital numbers such as Wi-Fi 6 to make it easier for Wi-Fi users and equipment manufacturers to understand Wi-Fi standards.

[0059] The service set identifier (SSID) is the identifier of a WLAN and is used to distinguish different WLANs. The IEEE 802.11 standard stipulates that the smallest unit of a wireless LAN is the basic service set (BSS), which represents the coverage area of ​​an AP, and the BSS is identified by the SSID. SSID can be divided into the following two types: basic service set identifier (BSSID) and extended service set identifier (ESSID). Among them, BSSID is the media access control (MAC) address of the data link layer on the AP. The specific AP can be quickly located based on the BSSID. ESSID is the identifier of one or a group of WLANs. The name of the WLAN that users search for using wireless terminals such as mobile phones is the ESSID. Users are accustomed to abbreviating ESSID as SSID.

[0060] Administrators can enhance the flexibility and security of WLAN by configuring different SSIDs. For example, a wireless LAN can be divided into sub-networks with different SSIDs and configured differently, allowing users with different identities to access the corresponding sub-networks based on different SSIDs, thereby achieving differentiation of access rights and network functions.

[0061] For example, in an enterprise, the administrator can use multiple SSIDs to provide different network services for employees and guests. Figure 1 FIG. 1 is a schematic diagram of an architecture of a WLAN network within an enterprise provided by an embodiment of the present application. Figure 1 As shown, the WLAN network includes a wireless access controller (WAC), a switch, and two APs. The two APs are deployed in the front hall and the office respectively. The AP deployed in the front hall (referred to as the front hall AP) corresponds to the WLAN with ESSID guest and BSSID 0025.9e45.24a0, thereby providing network services for guests. The AP deployed in the office (referred to as the office AP) corresponds to the WLAN with ESSD employee and BSSID 0025.9e45.5619, thereby providing network services for corporate employees.

[0062] A wireless terminal (STA) can associate with an AP through authentication to access the WLAN through the AP. However, a WLAN based on the IEEE 802.11 standard is an open wireless public network that may face various network threats, such as signal interference caused by unauthorized private APs in the company, interference from illegal wireless users or ad-hoc networks (Ad-hoc), deception by counterfeit APs, and denial of service attacks by malicious terminals.

[0063] For example, when an illegal AP uses an "open, no-access authentication" SSID, and the illegal SSID is configured to be similar to the SSID of a legitimate AP, wireless terminals can easily associate with the illegal AP. For example, in densely populated commercial office buildings, employees' office computers and other wireless terminals access the surrounding open, no-access authentication WLAN, which can easily affect the company's information security, such as the wireless terminal being invaded by a virus and then used as a springboard to attack the company's internal network, or the wireless terminal data being stolen.

[0064] Figure 2 FIG. 1 is a schematic diagram of a scenario in which a wireless terminal is associated with an AP provided in an embodiment of the present application. Figure 2 As shown, a wireless terminal such as a mobile phone is associated with an AP with SSID 123 through authentication to access the WLAN through the AP. However, another AP with SSID 1234 is deployed in the network. The AP is an open AP without password authentication. In this case, the wireless terminal can be associated with the AP without authentication to access the corresponding WLAN. Since the wireless terminal is associated with the AP without authentication, the terminal security of the wireless terminal cannot be guaranteed. For example, after the wireless terminal is associated with the AP without password authentication, the WLAN can attack the wireless terminal through malicious induction.

[0065] Based on this, it is necessary to manage the access rights of wireless terminals to WLAN to ensure the security of wireless terminals. In some scenarios, the security of wireless terminals can be protected by WIDS / WIPS or static SSID whitelist.

[0066] Among them, WIDS is used to implement security detection of illegal wireless terminals, malicious user attacks and intrusions into WLAN. WIPS is a technology based on WIDS that further protects the security of enterprise WLAN, such as preventing unauthorized access to enterprise networks and users by wireless illegal devices, and providing attack protection for network systems.

[0067] In WIDS / WIPS technology, both legal APs and monitoring APs are configured in the WLAN. The monitoring AP will continuously scan and identify illegal SSIDs of illegal APs. When a legal wireless terminal that has been authenticated on a legal AP is found to be associated with an illegal AP, the monitoring AP sends a deauthentication frame to the legal wireless terminal. After receiving the deauthentication frame, the legal wireless terminal associated with the illegal AP disconnects from the illegal AP. This countermeasure mechanism can prevent legal wireless terminals from connecting to illegal APs, thereby protecting the security of legal wireless terminals.

[0068] In WIDS / WIPS technology, monitoring APs are deployed in the coverage area of ​​legal APs to obtain information about legal wireless terminals through legal APs. Therefore, WIDS / WIPS technology can prevent legal wireless terminals from associating with illegal APs only in the coverage area of ​​legal APs. When wireless terminals are not in the coverage area of ​​legal wireless terminals, it is impossible to restrict legal wireless terminals from associating with illegal APs. For example, a child takes a tablet (pad) away from home to play online games on free WLAN somewhere else.

[0069] In addition, the following scenario can be used to illustrate the protection of wireless terminal security through static SSID whitelist. For example, in a densely populated office building environment, enterprise A establishes a WLAN on its office floor. However, when enterprise A's wireless terminals associate with the AP of a public WLAN or an AP of a personal malicious WLAN, enterprise A's wireless terminals and the internal network of the enterprise face huge network security risks. Therefore, in order to protect the wireless terminals and internal network security of enterprise A, an SSID whitelist can be configured in advance in the wireless terminals of enterprise A under authorization, and the SSID identifiers allowed to be associated can be entered in the whitelist. When a wireless terminal needs to associate with an AP, it is first filtered through the SSID whitelist control. Only the SSIDs in the whitelist are allowed to associate with the Internet, otherwise the association is prohibited, thereby protecting enterprise A's wireless terminals from associating with illegal APs.

[0070] Since the SSID whitelist is statically configured in advance, if the WLAN that the wireless terminal needs to access changes dynamically, the SSID whitelist needs to be reconfigured, resulting in a slow response speed for the wireless terminal to access the WLAN.

[0071] Based on this, an embodiment of the present application provides a method for accessing a network. In the embodiment of the present application, a method of collaboration between a cloud service end and a wireless terminal is adopted, whereby the cloud service end remotely collects network information of an AP associated or previously associated with a wireless terminal in real time through networking, and dynamically authorizes the wireless terminal to have access to the AP, so as to ensure the terminal security of the wireless terminal.

[0072] Figure 3 Schematic diagram of a communication network architecture provided by an embodiment of the present application. Figure 3As shown, the communication network 30 includes a wireless terminal 31, a first AP 32 and a cloud server 33. The first AP 32 and the cloud server 33 are connected to communicate via wired or wireless means, and the wireless terminal 31 is associated with the first AP 32 to access the WLAN.

[0073] In some embodiments, after associating with the first AP 32 , the wireless terminal 31 also collects network information of the currently associated first AP 32 , and reports the network information of the first AP 32 to the cloud server 33 , so as to dynamically adjust the access rights of the wireless terminal 31 to the first AP 32 through the cloud server 33 .

[0074] Alternatively, if Figure 4 As shown, the communication network 30 may further include a monitoring terminal 34. The monitoring terminal 34 is a terminal bound to the wireless terminal 31, so as to monitor the network access status of the wireless terminal 31 through the monitoring terminal 34. The wireless terminal 31 communicates with the cloud service end 33 through the first link, and the monitoring terminal 34 communicates with the cloud service end 33 through the second link.

[0075] In this scenario, the wireless terminal 31 collects network information of the currently associated first AP 32 and reports the network information of the first AP 32 to the cloud server 33, so as to dynamically adjust the access rights of the wireless terminal 31 to the first AP 32 through the linkage between the cloud server 33 and the monitoring terminal 34.

[0076] exist Figure 3 or Figure 4 In the communication network shown, the first AP 32 can be connected to the cloud service end 33 via an open Internet. In other words, the cloud service end 33 can be deployed on a public cloud.

[0077] Optionally, the first AP 32 may also be connected to the cloud server 33 via a dedicated line such as an enterprise private network. In other words, the cloud server 33 may be deployed on a private cloud.

[0078] Figure 5 Schematic diagram of another communication network architecture provided by an embodiment of the present application. Figure 5 As shown, the communication network 30 includes a wireless terminal 31, a first AP 32, a cloud service end 33 and a second AP 35. The cloud service end 33 and the second AP 35 are connected to communicate via a wired or wireless method. The wireless terminal 31 can be associated with the first AP 32 to access the WLAN, and can also be associated with the second AP 35 to access the WLAN.

[0079] In some embodiments, the wireless terminal 31 may be associated with the first AP to access the WLAN corresponding to the first AP. After the wireless terminal 31 is associated with the first AP, it switches to associate with the second AP 35 to access the WLAN. After switching to the second AP 35, the network information of the first AP that was once associated is reported to the cloud service end 33, so that the cloud service end 33 dynamically adjusts the access rights of the wireless terminal 31 to the first AP 32.

[0080] exist Figure 5 In the communication network shown, the second AP 35 can be connected to the cloud server 33 via a dedicated line such as an enterprise private network. In other words, the cloud server 33 is deployed on a private cloud.

[0081] Optionally, the second AP 35 may be connected to the cloud server 33 via an open Internet. In other words, the cloud server 33 may be deployed on a public cloud.

[0082] In addition, Figure 5 The communication network 30 shown may also include a monitoring terminal 34 , so that the access authority of the wireless terminal 31 to the first AP 32 that was once associated is dynamically determined through the linkage of the monitoring terminal 34 , the cloud service end 33 and the wireless terminal 31 .

[0083] In addition, if Figures 3 to 5 As shown, a WiFi terminal security monitoring agent module can be configured on the wireless terminal 31, a WiFi terminal security monitoring service module can be configured on the cloud service end 33, and a WiFi terminal security monitoring client can be configured on the monitoring terminal 34, thereby realizing the method for accessing the network provided in the embodiment of the present application.

[0084] Among them, the WiFi terminal security monitoring agent module, the WiFi terminal security monitoring service module and the WiFi terminal security monitoring client can be understood as software modules to implement the corresponding functions of the wireless terminal 31, the cloud service terminal 33 and the monitoring terminal 34 in the method provided in the embodiment of the present application. The relevant functions are described in detail in the subsequent embodiments and will not be elaborated here.

[0085] Based on the foregoing content, it can be known that in the embodiment of the present application, the wireless terminal and the cloud service end can be linked to implement the method of accessing the network provided in the embodiment of the present application. Optionally, the wireless terminal, the cloud service end and the monitoring terminal can also be linked to implement the method of accessing the network provided in the embodiment of the present application. The following explains these two implementation methods respectively.

[0086] Figure 6 1 is a flow chart of a method for accessing a network provided in an embodiment of the present application. The method is used to explain how the wireless terminal and the cloud service end work together to implement the method for accessing a network provided in an embodiment of the present application. Figure 6As shown, the method includes the following steps.

[0087] Step 601: The wireless terminal reports network information of a first AP to a cloud service end, where the first AP is an AP associated with the wireless terminal or an AP that the wireless terminal has been associated with.

[0088] In an embodiment of the present application, in order to enable the cloud service end to dynamically determine the access rights of the wireless terminal to the first AP, the wireless terminal can report the network information of the associated or previously associated first AP to the cloud service end, so that the cloud service end can determine the access rights of the wireless terminal to the first AP based on the network information of the first AP.

[0089] In some embodiments, such as in Figure 3 In the communication network shown, when the wireless terminal associates with the first AP for the first time, the network information of the first AP can be reported to the cloud service end.

[0090] The first association with the first AP can be understood as: when the wireless terminal detects the first AP, there is no SSID table entry corresponding to the first AP in the locally stored SSID table. The SSID table locally stored by the wireless terminal includes an SSID table entry corresponding to each AP in at least one AP that has been associated, and the SSID table entry is used to store information such as the SSID of the corresponding AP and the wireless terminal's access rights to the AP.

[0091] In the embodiment of the present application, when the wireless terminal associates with the first AP for the first time, the access permission of the first AP can be temporarily set to allow the wireless terminal to associate with the first AP, and the duration of allowing the association with the first AP is the temporary association duration. In this way, when the wireless terminal detects the first AP for the first time, it can be associated with the first AP based on the temporary access permission, so that the network information of the currently associated first AP can be reported to the cloud service end through the first AP, and then the access permission of the wireless terminal to the first AP can be dynamically modified through the cloud service end.

[0092] For example, the wireless terminal is a tablet computer used by children at home. When the child takes the tablet computer out, if the tablet computer detects a new AP, it can first associate with the AP according to temporary access permissions, and then report the network information of the AP to the cloud server, so as to dynamically modify the tablet computer's access permissions to the currently associated AP through the cloud server.

[0093] In other embodiments, such as Figure 5 In the communication network shown, when the wireless terminal switches from associating with a first AP to associating with a second AP, the network information of the first AP that was once associated can be reported to the cloud service end.

[0094] For example, the wireless terminal is a mobile phone used by employees in an enterprise. After the mobile phone is associated with a first AP outside the enterprise private network, it switches to associate with a second AP deployed in the enterprise private network. At this time, the mobile phone can report the network information of the first AP that was once associated to the cloud server, so as to dynamically modify the access rights of the mobile phone to the first AP that was once associated through the cloud server.

[0095] In addition, in some embodiments, the network information of the first AP may include one or more of the SSID of the first AP, the location of the first AP, and the time when the wireless terminal associates with the first AP. In this way, the cloud service end can flexibly configure the wireless terminal's access rights to the first AP based on the network information of the first AP.

[0096] For example, the network information of the first AP may include only the SSID of the first AP, or may include only the location of the first AP, or may include only the time when the wireless terminal associates with the first AP, or may include the SSID of the first AP, the location of the first AP, and the time when the wireless terminal associates with the first AP, etc. These examples will not be described one by one here.

[0097] Step 602: The cloud service end receives the network information of the first AP reported by the wireless terminal.

[0098] In some embodiments, such as in Figure 3 or Figure 4 In the communication network shown, the cloud service end can receive network information of the currently associated first AP reported by the wireless terminal through the first AP.

[0099] Alternatively, in other embodiments, such as Figure 5 In the communication network shown, the cloud service end can receive network information of the first AP that was once associated and reported by the wireless terminal through the second AP.

[0100] After receiving the network information of the first AP, the cloud service end determines the access authority of the wireless terminal to the first AP, so as to subsequently return the access authority to the wireless terminal.

[0101] In some embodiments, the cloud service end may determine the access authority of the wireless terminal to the first AP in such a manner that the cloud service end determines the access authority based on the network information of the first AP and the locally stored security access rules.

[0102] The security access rules locally stored in the cloud server indicate the network information of the AP that allows the wireless terminal to be securely associated.

[0103] For example, the network information of the first AP includes the SSID of the first AP, and the security access rule includes at least one SSID that allows the wireless terminal to be securely associated. In this scenario, if the security access rule includes the SSID of the first AP, the access permission is to allow the wireless terminal to associate with the first AP.

[0104] In another example, the network information of the first AP includes the location of the first AP, and the security access rule includes the location range of the AP that the wireless terminal is allowed to securely associate with. In this scenario, if the location range in the security access rule can cover the location of the first AP, the access permission is to allow the wireless terminal to associate with the first AP.

[0105] In another example, the network information of the first AP includes the time when the wireless terminal associates with the first AP, and the security access rule includes a time period during which the wireless terminal is allowed to securely associate with the AP. In this scenario, if the time when the wireless terminal associates with the first AP is within the time period included in the security access rule, the access permission is to allow the wireless terminal to associate with the first AP.

[0106] In addition, the security access rule may also include one or more of the allowed association duration, allowed association time period, and permission aging duration for the AP that allows security association. In this scenario, if the cloud service determines that the wireless terminal is allowed to associate with the first AP, one or more of the allowed association duration, allowed association time period, and permission aging duration for the first AP may also be determined based on the security access rule. This improves the flexibility of the cloud service to dynamically modify the wireless terminal's access rights to the first AP.

[0107] The permission aging time can be understood as the effective time of the access permission determined by the cloud server at the wireless terminal. For example, the association time is allowed to be 2 hours and the permission aging time is one week. Then, within the last week when the wireless terminal receives the access permission, if it associates with the first AP each time, the association time is allowed to be 2 hours. After one week, the access permission will be invalid at the wireless terminal, and the wireless terminal needs to go through step 601 again to obtain the access permission dynamically determined by the cloud server.

[0108] In addition, the cloud service end locally stores a first mapping relationship, and the first mapping relationship indicates the corresponding relationship between the wireless terminal and the security access rule. Based on this, after receiving the network information of the first AP reported by a wireless terminal, the cloud service end first finds the security access rule corresponding to the wireless terminal based on the first mapping relationship, and determines the access permission of the wireless terminal to the first AP based on the found security access rule.

[0109] The security access rules corresponding to each wireless terminal may be pre-configured by the user at the cloud service end.

[0110] Optionally, in other embodiments, the cloud service end may determine the access right of the wireless terminal to the first AP by: the cloud service end determines the access right based on the network information of the first AP and the historical association behavior of the wireless terminal.

[0111] The historical association behavior of the wireless terminal indicates the behavior of other APs associated with the wireless terminal before the current time.

[0112] For example, the cloud service end can determine the main geographical location range of the APs that the wireless terminal has historically associated with based on the historical association behavior of the wireless terminal, and if the first AP is within the main geographical location range, the access permission is set to allow the wireless terminal to associate with the first AP. The main geographical location range can be understood as the range consisting of the geographical locations of most of the APs that the wireless terminal has historically associated with.

[0113] As another example, the cloud service end can determine the main time period of the AP historically associated with the wireless terminal based on the historical association behavior of the wireless terminal, and if the time when the wireless terminal associates with the first AP is within the main time period, the access permission is set to allow the wireless terminal to associate with the first AP. The main time period can be understood as a time period consisting of the association time of most of the APs historically associated with the wireless terminal.

[0114] Step 603: The cloud service end sends access rights to the first AP to the wireless terminal, where the access rights are based on the network information of the first AP.

[0115] Based on step 602, it can be known that the access right includes a right type, and the right type indicates whether the wireless terminal is allowed or prohibited to associate with the first AP.

[0116] Furthermore, the access right may also include one or more of an allowed association duration, an allowed association time period, and an ageing time of the right.

[0117] Step 604: The wireless terminal receives the access permission to the first AP sent by the cloud service end.

[0118] Based on step 601, it can be known that when the first AP is the first AP currently associated with the wireless terminal, the wireless terminal reports the network information of the first AP to the cloud service end when it first associates with the first AP, and the wireless terminal associates with the first AP based on temporary access authority. Therefore, within the temporary association duration after associating with the first AP, if the access authority is received from the cloud service end, and the access authority indicates that the wireless terminal is prohibited from accessing the first AP, the wireless terminal disconnects the association with the first AP. And the access authority is updated as the SSID table entry of the first AP in the SSID table of the wireless terminal, so that the wireless terminal is prohibited from associating with the first AP when the first AP is detected again in the future.

[0119] Accordingly, within the temporary association duration after associating with the first AP, if an access permission is received from the cloud service end, and the access permission indicates that the wireless terminal is allowed to access the first AP, the wireless terminal maintains the association with the first AP, and updates the access permission as the SSID table entry of the first AP to the SSID table of the wireless terminal.

[0120] In this scenario, if the access right also includes an allowed association duration, then the time to disconnect the association between the wireless terminal and the first AP is determined based on the allowed association duration.

[0121] Optionally, if the access right further includes a right aging time, the time to delete the SSID entry of the first AP from the SSID table of the wireless terminal is determined based on the right aging time.

[0122] In addition, if the duration of the first association with the first AP exceeds the temporary association duration and the access authority is still not received from the cloud service end, the association between the wireless terminal and the first AP is also disconnected.

[0123] In addition, when the first AP is the first AP that the wireless terminal has been associated with, the wireless terminal reports the network information of the first AP to the cloud service end when switching from the first AP to the second AP. In this scenario, if the access permission is received from the cloud service end, the access permission is updated as the SSID table entry of the first AP to the SSID table of the wireless terminal, so that the first AP can be associated with the first AP based on the access permission when it needs to be associated with the first AP again in the future.

[0124] Below Figure 7 and Figure 8 The network shown in the figure is used as an example. Figure 6 The embodiments shown are illustrative only.

[0125] like Figure 7 As shown, the wireless terminal is a tablet computer used by children in the family. When the tablet computer is associated with an AP with SSID Home-Free, the network information of the AP can be reported to a cloud server deployed in a public cloud, so as to dynamically modify the access rights of the AP through the cloud server.

[0126] For example, the parent pre-configures a security access rule for the wireless terminal at the cloud service end, and the cloud service end can determine the access authority to the AP based on the security access rule.

[0127] like Figure 8As shown, the wireless terminal is a WiFi customer premise equipment (CPE) deployed in the enterprise. The WiFi CPE can access the enterprise private cloud through the second AP. The SSID of the second AP is Manufacture-Line, and a cloud server is deployed on the enterprise private cloud. In some scenarios, the WiFi CPE is associated with the first AP to access the public cloud network through the first AP. The SSID of the first AP is Factory-Free. Later, when the administrator finds that the WiFi CPE is associated with the first AP, in order to avoid leakage of internal enterprise data, the WiFi CPE is re-associated with the second AP. At this time, after the WiFi CPE is associated with the second AP, it reports the network information of the first AP that was once associated to the cloud server on the enterprise private cloud, so as to dynamically modify the WiFi CPE's access rights to the first AP through the cloud server.

[0128] For example, the cloud server stores the following security access rules locally: the SSID of the wireless network of the manufacturing plant: Manufacture-Line allows permanent access, the SSID of the temporary operation and maintenance: Maintaining-Temp allows temporary access for 2 hours, and no other SSID allows access. Based on this, the cloud server stores the security access rules and the network information of the first AP locally, and determines that the access permission to the first AP is to prohibit the WiFi CPE from associating with the first AP. The WiFi CPE receives the access permission and updates the access permission to the local SSID table. When the WiFi CPE detects the first AP again, it will not associate with the first AP.

[0129] In summary, in the embodiment of the present application, the wireless terminal can be linked with the cloud server to dynamically modify the access rights of the first AP associated or previously associated with the wireless terminal through the cloud server. On the one hand, it is possible to manage the access rights of the AP associated or previously associated with the wireless terminal without configuring a special monitoring AP for the WLAN, and on the other hand, the access rights can be quickly determined through the cloud server for the scenario of dynamic changes in the WLAN.

[0130] Fig. 9 1 is a flowchart of another method for accessing a network provided by an embodiment of the present application. The method is used to explain how the wireless terminal, the cloud service end, and the monitoring terminal work together to implement the method for accessing a network provided by an embodiment of the present application. Fig. 9 As shown, the method includes the following steps.

[0131] Step 901: The wireless terminal reports network information of a first AP to a cloud service end, where the first AP is an AP associated with the wireless terminal or an AP that the wireless terminal has been associated with.

[0132] Correspondingly, the cloud service end receives the network information of the first AP reported by the wireless terminal.

[0133] For related implementation methods, please refer to Figure 6 Step 601 and step 602 in the embodiment.

[0134] Step 902: The cloud server sends the network information of the first AP to the monitoring terminal, the monitoring terminal is a terminal bound to the wireless terminal, and the wireless terminal communicates with the cloud server through a first link, and the monitoring terminal communicates with the cloud server through a second link.

[0135] After receiving the network information of the first AP reported by the wireless terminal, the cloud service end may forward the network information of the first AP to the monitoring terminal bound to the wireless terminal, so as to dynamically determine the access authority of the wireless terminal to the first AP through the monitoring terminal.

[0136] The wireless terminal communicates with the cloud server via a first link, and the monitoring terminal communicates with the cloud server via a second link. In other words, the wireless terminal and the monitoring terminal exchange information with the cloud server via different links.

[0137] For example, the wireless terminal accesses the network through a first AP to communicate with the cloud service end, and the monitoring terminal accesses the network through a third AP to communicate with the cloud service end.

[0138] For example, for Figure 4 In the communication network shown, the wireless terminal is a tablet computer used by children at home, the monitoring terminal is a mobile phone used by parents, and the tablet computer and the mobile phone communicate with the cloud server based on different links.

[0139] In addition, after receiving the network information of the first AP from the wireless terminal, the cloud service end can search the monitoring terminal bound to the wireless terminal from the second mapping relationship stored locally, wherein the second mapping relationship is used to store the corresponding relationship between the wireless terminal and the monitoring terminal.

[0140] In some embodiments, the user corresponding to the monitoring terminal may pre-store the identifier of the wireless terminal bound to the monitoring terminal at the cloud service end, that is, store the corresponding relationship between the monitoring terminal and the bound wireless terminal in the second mapping relationship.

[0141] In addition, after receiving the network information of the first AP, the monitoring terminal may display the network information of the first AP, and then obtain the access authority of the wireless terminal to the first AP in response to the authority configuration operation of the user.

[0142] Through the above method, the user corresponding to the monitoring terminal can dynamically modify the access rights of the AP associated or previously associated with the bound wireless terminal. On the one hand, there is no need to configure a special monitoring AP for the WLAN to manage the access rights of the AP associated or previously associated with the wireless terminal. On the other hand, for the scenario of dynamically changing WLAN, the access rights can be quickly determined through the cloud service end and the monitoring terminal.

[0143] Table 1 is a schematic table of a monitoring terminal configuration access permission provided by an embodiment of the present application. As shown in Table 1, for the first AP whose SSID is Home-Myself, the user on the monitoring terminal can set the wireless terminal's access permission to the first AP to allow the wireless terminal to associate with the first AP, set the allowed association time to 2 hours per day, and set the allowed association time period to 7:00 am to 9:00 pm every day. For the setting of access permissions for other APs in Table 1, please refer to Table 1, and no examples will be given here one by one.

[0144] Table 1

[0145] SSID Name Allow / disable association Allowed association time Allow association time period Home-Myself allow 2 hours per day 7:00-21:00 Home-Free prohibit Garden-Free allow Temporary single access for 30 minutes 7:00-21:00 P50pro-WiFi allow 30 minutes per day 7:00-21:00

[0146] In addition, in some embodiments, in addition to forwarding the network information of the first AP to the monitoring terminal, the cloud server can also generate risk information based on the network information of the first AP and locally stored security access rules, or generate risk information based on the network information of the first AP and the historical association behavior of the wireless terminal, wherein the risk information indicates the risk of the wireless terminal associating with the first AP; and send the risk information to the monitoring terminal.

[0147] The cloud service sends the risk information and the network information of the first AP to the monitoring terminal, so that the user corresponding to the monitoring terminal can set the access authority of the wireless terminal to the first AP based on more information, further improving the security of the wireless terminal.

[0148] The security access rules locally stored in the cloud server indicate the network information of the AP that allows the wireless terminal to be securely associated.

[0149] For example, the network information of the first AP includes the SSID of the first AP, and the security access rule includes at least one SSID that allows the wireless terminal to be securely associated. For example, in this scenario, if the security access rule does not include the SSID of the first AP, the risk information may indicate that the first AP is not an AP that has been authorized for secure access.

[0150] In another example, the network information of the first AP includes the location of the first AP, and the security access rule includes the location range of the AP that allows the wireless terminal to be securely associated. In this scenario, if the location range in the security access rule cannot cover the location of the first AP, the risk information indicates that the wireless terminal is not associated with the AP in the security area.

[0151] In another example, the network information of the first AP includes the time when the wireless terminal associates with the first AP, and the security access rule includes a time period during which the wireless terminal is allowed to securely associate with the AP. In this scenario, if the time when the wireless terminal associates with the first AP is not within the time period included in the security access rule, the risk information indicates that the wireless terminal is not associated with the AP within the security access time period.

[0152] For a detailed description of the security access rules corresponding to the wireless terminal configured at the cloud service end, please refer to step 602, which will not be repeated here.

[0153] In addition, the historical association behavior of the wireless terminal indicates the behavior of other APs associated with the wireless terminal before the current time.

[0154] For example, the cloud service end can determine the main geographical location range of the APs that the wireless terminal has historically associated with based on the historical association behavior of the wireless terminal. If the first AP is not within the main geographical location range, the risk information indicates that the wireless terminal is not associated with the AP in the regular area. The main geographical location range can be understood as the range consisting of the geographical locations of most of the APs that the wireless terminal has historically associated with.

[0155] As another example, the cloud service end can determine the main time period of the AP historically associated with the wireless terminal based on the historical association behavior of the wireless terminal. If the time when the wireless terminal associates with the first AP is not within the main time period, the risk information indicates that the wireless terminal is not associated with the AP within the regular access time period. The main time period can be understood as a time period consisting of the association time of most of the APs historically associated with the wireless terminal.

[0156] After receiving the risk information and the network information of the first AP from the cloud service end, the monitoring terminal displays the risk information and the network information of the first AP, and obtains the access permission of the wireless terminal to the first AP in response to the user's permission configuration operation.

[0157] Since the risk information is displayed in addition to the network information of the first AP, the user can flexibly configure the access authority of the wireless terminal to the first AP based on the risk information at the monitoring terminal, thereby further improving the security of the wireless terminal.

[0158] Step 903: The monitoring terminal sends the access permission of the wireless terminal to the first AP to the cloud service end.

[0159] Correspondingly, the cloud service end receives the access permission of the wireless terminal to the first AP sent by the monitoring terminal.

[0160] Step 904: The cloud service end sends access rights to the first AP to the wireless terminal.

[0161] Accordingly, the wireless terminal receives the access right to the first AP sent by the cloud service end, and performs corresponding operations on the associated or previously associated first AP based on the access right. The specific implementation method can refer to step 604 and will not be repeated here.

[0162] In addition, in addition to sending the access right to the first AP to the wireless terminal, the cloud service end may also store the access right of the wireless terminal to the first AP locally, so as to manage other associated behaviors of the wireless terminal based on the access right in the future.

[0163] Below Fig.10 and Fig.11 For example Fig. 9 The embodiments shown are illustrative only.

[0164] like Fig.10 As shown, the smartphone used by the child in the family is associated with AP 1 to access the WLAN, and reports the network information of AP 1 to the cloud server on the public cloud. The cloud server forwards the network information of AP 1 to the monitoring terminal bound to the smartphone, which is used by the parent. The parent determines the access permission to allow the smartphone to associate with AP 1 based on the network information of AP 1. The smartphone can continue to associate with AP 1 to access the WLAN.

[0165] When a tablet computer used by a child in a family associates with AP 2 to access the WLAN and reports the network information of AP 2 to the cloud server on the public cloud, the cloud server forwards the network information of AP 2 to the monitoring terminal bound to the smartphone, which is used by the parent. The parent determines the access permission to prohibit the smartphone from associating with AP 1 based on the network information of AP 2. Subsequently, the tablet computer cannot associate with AP 2 to access the WLAN.

[0166] For example, Fig.11 As shown in the figure, when a tablet used by a child in a family associates with a neighbor's free AP (the AP's SSID is Home-Free) to access the WLAN, and reports the AP's network information to the cloud server on the public cloud, the cloud server forwards the AP's network information to the monitoring terminal bound to the smartphone, which is used by the parent. The parent determines the access permission to prohibit the smartphone from associating with the AP based on the AP's network information. Subsequently, the tablet cannot associate with the AP to access the WLAN.

[0167] In summary, in the embodiment of the present application, the wireless terminal can be linked with the cloud service end and the monitoring terminal to dynamically modify the access rights of the first AP associated or previously associated with the wireless terminal through the cloud service end and the monitoring terminal. On the one hand, it is possible to manage the access rights of the AP associated or previously associated with the wireless terminal without configuring a special monitoring AP for the WLAN, and on the other hand, the access rights can be quickly determined through the cloud service end and the monitoring terminal for the scenario of dynamic changes in the WLAN.

[0168] Fig.12 is a schematic diagram of a device for accessing a network provided in an embodiment of the present application, and the device is deployed on a cloud service end, such as Fig.12 As shown, the device 1200 includes the following modules.

[0169] The first receiving module 1201 is used to receive network information of a first access point AP reported by a wireless terminal. The first AP is an AP associated with the wireless terminal or an AP that the wireless terminal has been associated with. For specific implementation methods, please refer to Figure 6 Step 602 of the embodiment, or Fig. 9 Step 901 in the embodiment.

[0170] The first sending module 1202 is used to send the access right to the first AP to the wireless terminal, and the access right is based on the network information of the first AP. For specific implementation methods, please refer to Figure 6 Step 603 in the embodiment, or Fig. 9 Step 904 in an embodiment.

[0171] Optionally, the device further comprises:

[0172] A second sending module is used to send the network information of the first AP to the monitoring terminal, the monitoring terminal is a terminal bound to the wireless terminal, the wireless terminal communicates with the cloud server through the first link, and the monitoring terminal communicates with the cloud server through the second link;

[0173] The second receiving module is used to receive the access authority to the first AP sent by the monitoring terminal.

[0174] Optionally, the device further comprises:

[0175] A generating module, configured to generate risk information based on the network information of the first AP and the locally stored security access rules, or to generate risk information based on the network information of the first AP and the historical association behavior of the wireless terminal, wherein the risk information indicates a risk of the wireless terminal associating with the first AP;

[0176] The second sending module is also used to send risk information to the monitoring terminal.

[0177] Optionally, the network information of the first AP includes one or more of a service set identifier SSID of the first AP, a location of the first AP, and a time when the wireless terminal associates with the first AP.

[0178] Optionally, the access permission includes a permission type, and the permission type indicates whether the wireless terminal is allowed or prohibited from associating with the first AP.

[0179] Optionally, the access right also includes one or more of an allowed association duration, an allowed association time period, and a right aging duration.

[0180] In summary, in the embodiment of the present application, the wireless terminal can be linked with the cloud server to dynamically modify the access rights of the first AP associated or previously associated with the wireless terminal through the cloud server. On the one hand, it is possible to manage the access rights of the AP associated or previously associated with the wireless terminal without configuring a special monitoring AP for the WLAN, and on the other hand, the access rights can be quickly determined through the cloud server for the scenario of dynamic changes in the WLAN.

[0181] It should be noted that: the network access device provided in the above embodiment only uses the division of the above functional modules as an example when accessing the network. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. In addition, the network access device provided in the above embodiment and the network access method embodiment belong to the same concept, and the specific implementation process is detailed in the method embodiment, which will not be repeated here.

[0182] Fig.13 is a schematic diagram of the structure of another device for accessing a network provided in an embodiment of the present application, the device is deployed in a wireless terminal, such as Fig.13 As shown, the device 1300 includes the following modules.

[0183] The sending module 1301 is used to report the network information of the first AP to the cloud service end. The first AP is the AP associated with the wireless terminal or the AP that the wireless terminal has been associated with. For specific implementation methods, please refer to Figure 6 Step 601 in the embodiment, or Fig. 9 Step 901 in the embodiment.

[0184] The receiving module 1302 is used to receive the access right to the first AP sent by the cloud service end, and the access right is based on the network information of the first AP. Figure 6 Step 604 in the embodiment, or Fig. 9 Step 904 in an embodiment.

[0185] Optionally, the device further comprises:

[0186] A processing module, configured to associate with the first AP when the first AP is detected, if the first AP is an AP that has not been associated before the current time, and allow the duration of association with the first AP to be a temporary association duration;

[0187] The processing module is further configured to disconnect the association with the first AP if access authority is received and the access authority indicates that the wireless terminal is prohibited from associating with the first AP within the temporary association time after associating with the first AP.

[0188] Optionally, the network information of the first AP includes one or more of a service set identifier SSID of the first AP, a location of the first AP, and a time when the wireless terminal associates with the first AP.

[0189] Optionally, the access permission includes a permission type, and the permission type indicates whether the wireless terminal is allowed or prohibited from associating with the first AP.

[0190] Optionally, the access right also includes one or more of an allowed association duration, an allowed association time period, and a right aging duration.

[0191] In summary, in the embodiment of the present application, the wireless terminal can be linked with the cloud server to dynamically modify the access rights of the first AP associated or previously associated with the wireless terminal through the cloud server. On the one hand, it is possible to manage the access rights of the AP associated or previously associated with the wireless terminal without configuring a special monitoring AP for the WLAN, and on the other hand, the access rights can be quickly determined through the cloud server for the scenario of dynamic changes in the WLAN.

[0192] It should be noted that: the network access device provided in the above embodiment only uses the division of the above functional modules as an example when accessing the network. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. In addition, the network access device provided in the above embodiment and the network access method embodiment belong to the same concept, and the specific implementation process is detailed in the method embodiment, which will not be repeated here.

[0193] Fig.14 is a schematic diagram of the structure of another device for accessing a network provided in an embodiment of the present application, the device is deployed in a monitoring terminal, such as Fig.14 As shown, the device 1400 includes the following modules:

[0194] The receiving module 1401 is used to receive network information of a first access point AP sent by the cloud service end, where the first AP is an AP associated with the wireless terminal or an AP that the wireless terminal has been associated with, the monitoring terminal is a terminal bound to the wireless terminal, and the wireless terminal communicates with the cloud service end through a first link, and the monitoring terminal communicates with the cloud service end through a second link; the specific implementation method can be referred to Fig. 9 Step 902 in an embodiment.

[0195] The sending module 1402 is used to send the access rights of the wireless terminal to the first AP to the cloud service end, and the access rights are based on the network information of the first AP. For specific implementation methods, please refer to Fig. 9 Step 903 in the embodiment.

[0196] Optionally, the device further comprises:

[0197] A display module, used to display the network information of the first AP;

[0198] The acquisition module is used to acquire the access permission of the wireless terminal to the first AP in response to the permission configuration operation of the user.

[0199] Optionally, the receiving module is further used to receive risk information sent by the cloud service end, where the risk information indicates a risk of the wireless terminal associating with the first AP, the risk information is based on the network information of the first AP and the security access rules stored by the cloud service end, or the risk information is based on the network information of the first AP and the historical association behavior of the wireless terminal;

[0200] The display module is also used to display risk information.

[0201] Optionally, the network information of the first AP includes one or more of a service set identifier SSID of the first AP, a location of the first AP, and a time when the wireless terminal associates with the first AP.

[0202] Optionally, the access permission includes a permission type, and the permission type indicates whether the wireless terminal is allowed or prohibited from associating with the first AP.

[0203] Optionally, the access right also includes one or more of an allowed association duration, an allowed association time period, and a right aging duration.

[0204] In summary, in the embodiment of the present application, the wireless terminal can be linked with the cloud service end and the monitoring terminal to dynamically modify the access rights of the first AP associated or previously associated with the wireless terminal through the cloud service end and the monitoring terminal. On the one hand, it is possible to manage the access rights of the AP associated or previously associated with the wireless terminal without configuring a special monitoring AP for the WLAN, and on the other hand, the access rights can be quickly determined through the cloud service end and the monitoring terminal for the scenario of dynamic changes in the WLAN.

[0205] It should be noted that: the network access device provided in the above embodiment only uses the division of the above functional modules as an example when accessing the network. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. In addition, the network access device provided in the above embodiment and the network access method embodiment belong to the same concept, and the specific implementation process is detailed in the method embodiment, which will not be repeated here.

[0206] Fig.15 Schematic diagram of a computer device provided in an embodiment of the present application. The wireless terminal, cloud service terminal or monitoring terminal in the above embodiments can be Fig.15 The computer device shown is implemented. Fig.15 The computer device includes at least one processor 1501 , a communication bus 1502 , a memory 1503 and at least one communication interface 1504 .

[0207] The processor 1501 may be a general-purpose central processing unit (CPU), an application-specific integrated circuit (ASIC), or one or more integrated circuits for controlling the execution of the program of the present application.

[0208] Communication bus 1502 may include a pathway for transmitting information between the above-mentioned components.

[0209] The memory 1503 may be a read-only memory (ROM) or other types of static storage devices that can store static information and instructions, a random access memory (RAM) or other types of dynamic storage devices that can store information and instructions, or an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compressed optical disc, laser disc, optical disc, digital versatile disc, Blu-ray disc, etc.), a disk or other magnetic storage device, or any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto. The memory 1503 may exist independently and be connected to the processor 1501 via the communication bus 1502. The memory 1503 may also be integrated with the processor 1501.

[0210] Among them, the memory 1503 is used to store the program code for executing the solution of the present application, and the execution is controlled by the processor 1501. The processor 1501 is used to execute the program code stored in the memory 1503. The program code may include one or more software modules. The wireless terminal, cloud service end or monitoring terminal in the aforementioned embodiment can determine the data used to develop the application through the processor 1501 and one or more software modules in the program code in the memory 1503.

[0211] The communication interface 1504 uses any transceiver or other device for communicating with other devices or communication networks, such as Ethernet, radio access network (RAN), wireless local area networks (WLAN), etc.

[0212] In a specific implementation, as an embodiment, a computer device may include multiple processors, such as Fig.15 1501 and processor 1505 shown in FIG. Each of these processors may be a single-CPU processor or a multi-CPU processor. A processor herein may refer to one or more devices, circuits, and / or processing cores for processing data (e.g., computer program instructions).

[0213] In a specific implementation, as an embodiment, the computer device may further include an output device 1506 and an input device 1507. The output device 1506 communicates with the processor 1501 and may display information in a variety of ways. For example, the output device 1506 may be a liquid crystal display (LCD), a light emitting diode (LED) display device, a cathode ray tube (CRT) display device, or a projector. The input device 1507 communicates with the processor 1501 and may receive user input in a variety of ways. For example, the input device 1507 may be a mouse, a keyboard, a touch screen device, or a sensor device.

[0214] The above-mentioned computer device can be a general-purpose computer device or a special-purpose computer device. In a specific implementation, the computer device can be a desktop computer, a portable computer, a network server, a personal digital assistant (PDA), a mobile phone, a tablet computer, a wireless terminal device, a communication device or an embedded device. The embodiment of the present application does not limit the type of computer device.

[0215] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions may be transmitted from a website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server or data center. The computer-readable storage medium may be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integrated. The available medium may be a magnetic medium (eg, a floppy disk, a hard disk, a magnetic tape), an optical medium (eg, a digital versatile disc (DVD)), or a semiconductor medium (eg, a solid state disk (SSD)).

[0216] A person skilled in the art will understand that all or part of the steps to implement the above embodiments may be accomplished by hardware or by instructing related hardware through a program, and the program may be stored in a computer-readable storage medium, and the above-mentioned storage medium may be a read-only memory, a disk or an optical disk, etc.

[0217] The above content is not intended to limit the embodiments of the present application. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the embodiments of the present application should be included in the protection scope of the embodiments of the present application.

Claims

1. A method for accessing a network, characterized in that: The method comprises: The cloud service end receives network information of a first access point AP reported by the wireless terminal, where the first AP is an AP associated with the wireless terminal or an AP that the wireless terminal has been associated with; The cloud service end sends access rights to the first AP to the wireless terminal, where the access rights are based on network information of the first AP.

2. The method according to claim 1, characterized in that Before the cloud service end sends the access right to the first AP to the wireless terminal, the method further includes: The cloud service end sends the network information of the first AP to the monitoring terminal, the monitoring terminal is a terminal bound to the wireless terminal, the wireless terminal communicates with the cloud service end through a first link, and the monitoring terminal communicates with the cloud service end through a second link; The cloud service end receives the access permission to the first AP sent by the monitoring terminal.

3. The method according to claim 2, characterized in that Before the cloud service end receives the access right to the first AP sent by the monitoring terminal, the method further includes: The cloud service end generates risk information based on the network information of the first AP and the locally stored security access rules, or generates risk information based on the network information of the first AP and the historical association behavior of the wireless terminal, wherein the risk information indicates a risk of the wireless terminal associating with the first AP; The cloud service end sends the risk information to the monitoring terminal.

4. A method for accessing a network, characterized in that: The method comprises: The wireless terminal reports network information of a first access point AP to the cloud service end, where the first AP is the AP associated with the wireless terminal or the AP that the wireless terminal has been associated with; The wireless terminal receives access rights to the first AP sent by the cloud service end, where the access rights are based on network information of the first AP.

5. The method according to claim 4, characterized in that The method further comprises: When the wireless terminal detects the first AP, if the first AP is an AP that has not been associated before the current time, the wireless terminal associates with the first AP, and the duration of allowing the association with the first AP is the temporary association duration; Within the temporary association time period after associating with the first AP, if the access authority is received and the access authority indicates that the wireless terminal is prohibited from associating with the first AP, the wireless terminal disconnects from the first AP.

6. A method for accessing a network, characterized in that: The method comprises: The monitoring terminal receives network information of a first access point AP sent by the cloud service end, where the first AP is an AP associated with the wireless terminal or an AP that the wireless terminal has been associated with, the monitoring terminal is a terminal bound to the wireless terminal, and the wireless terminal communicates with the cloud service end through a first link, and the monitoring terminal communicates with the cloud service end through a second link; The monitoring terminal sends the access permission of the wireless terminal to the first AP to the cloud service end, where the access permission is based on the network information of the first AP.

7. The method according to claim 6, characterized in that Before the monitoring terminal sends the access right of the wireless terminal to the first AP to the cloud service end, the method further includes: Display the network information of the first AP; In response to the user's permission configuration operation, the access permission of the wireless terminal to the first AP is obtained.

8. The method according to claim 7, characterized in that Before obtaining the access right of the wireless terminal to the first AP in response to the user's permission configuration operation, the method further includes: receiving risk information sent by the cloud service end, the risk information indicating a risk of the wireless terminal associating with the first AP, the risk information being based on network information of the first AP and security access rules stored by the cloud service end, or the risk information being based on network information of the first AP and historical association behavior of the wireless terminal; The risk information is displayed.

9. The method according to any one of claims 1 to 8, characterized in that: The network information of the first AP includes one or more of a service set identifier SSID of the first AP, a location of the first AP, and a time when the wireless terminal associates with the first AP.

10. The method according to any one of claims 1 to 9, characterized in that: The access permission includes a permission type, and the permission type indicates whether the wireless terminal is allowed or prohibited from associating with the first AP.

11. The method according to claim 10, characterized in that The access rights also include one or more of an allowed association duration, an allowed association time period, and a rights aging duration.

12. A device for accessing a network, characterized in that: The device is deployed on a cloud service end, and the device includes: A first receiving module, configured to receive network information of a first access point AP reported by a wireless terminal, where the first AP is an AP associated with the wireless terminal or an AP that the wireless terminal has been associated with; The first sending module is used to send access rights to the first AP to the wireless terminal, where the access rights are based on network information of the first AP.

13. The device according to claim 12, characterized in that The device also includes: A second sending module is used to send the network information of the first AP to a monitoring terminal, the monitoring terminal is a terminal bound to the wireless terminal, the wireless terminal communicates with the cloud server through a first link, and the monitoring terminal communicates with the cloud server through a second link; The second receiving module is used to receive the access right to the first AP sent by the monitoring terminal.

14. A device for accessing a network, characterized in that: The device is deployed in a wireless terminal, and the device includes: A sending module, configured to report network information of a first access point AP to a cloud service end, where the first AP is an AP associated with the wireless terminal or an AP that the wireless terminal has been associated with; The receiving module is used to receive the access permission to the first AP sent by the cloud service end, where the access permission is based on the network information of the first AP.

15. A device for accessing a network, characterized in that: The device is deployed at a monitoring terminal, and includes: a receiving module, configured to receive network information of a first access point AP sent by a cloud service end, wherein the first AP is an AP associated with a wireless terminal or an AP previously associated with the wireless terminal, the monitoring terminal is a terminal bound to the wireless terminal, and the wireless terminal communicates with the cloud service end via a first link, and the monitoring terminal communicates with the cloud service end via a second link; A sending module is used to send the access permission of the wireless terminal to the first AP to the cloud service end, where the access permission is based on the network information of the first AP.

16. A cloud service terminal, characterized in that: The cloud service end includes a memory and a processor; The memory is used to store a program that supports the cloud server to execute the method described in any one of claims 1-3 and 9-11, and to store data involved in implementing the method described in any one of claims 1-3 or 9-11; The processor is configured to execute the program stored in the memory.

17. A wireless terminal, characterized in that: The wireless terminal includes a memory and a processor; The memory is used to store a program that supports the wireless terminal to execute the method according to any one of claims 4-5 and 9-11, and to store data involved in implementing the method according to any one of claims 4-5 or 9-11; The processor is configured to execute the program stored in the memory.

18. A monitoring terminal, characterized in that: The monitoring terminal includes a memory and a processor; The memory is used to store a program that supports the monitoring terminal to execute the method according to any one of claims 6 to 11, and to store data involved in implementing the method according to any one of claims 6 to 11; The processor is configured to execute the program stored in the memory.

19. A system for accessing a network, characterized in that: The system includes a wireless terminal, a cloud service end and a monitoring terminal, wherein the monitoring terminal is a terminal bound to the wireless terminal, the wireless terminal communicates with the cloud service end through a first link, and the monitoring terminal communicates with the cloud service end through a second link; The wireless terminal is used to report network information of a first access point AP to the cloud service end, where the first AP is an AP associated with the wireless terminal or an AP that the wireless terminal has been associated with; The cloud service end is used to receive the network information of the first AP reported by the wireless terminal, and send the network information of the first AP to the monitoring terminal; The monitoring terminal is used to receive the network information of the first AP sent by the cloud service end, and send the access right of the wireless terminal to the first AP to the cloud service end, where the access right is based on the network information of the first AP; The cloud service end is further used to receive the access permission to the first AP sent by the monitoring terminal, and send the access permission to the first AP to the wireless terminal; The wireless terminal is further used to receive the access permission to the first AP sent by the cloud service end.

20. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores instructions, which, when executed on a computer, enable the computer to execute the method according to any one of claims 1 to 11.

Images