Identity authentication method, key agreement method, dynamic route switching method and system

Abstract

The present application relates to the field of communication technology, and discloses an identity authentication method, a key agreement method, a dynamic route switching method and system, the authentication method comprising: forwarding an initial response message from a STA to a security module; receiving a first response code generated by the security module based on an AP private key and a STA identifier in the initial response message, the AP private key being stored in the security module; forwarding the first response code to the STA to generate a second response code based on the first response code and the STA identifier and send a final response message; receiving the final response message; generating a verification response code based on the first response code and the STA identifier in the final response message; and if the second response code in the final response message is consistent with the verification response code, determining that the STA identity authentication is successful, thereby achieving the security and reliability of communication data by introducing a security module to assist the AP to complete identity authentication and key agreement, and achieving adaptive switching of dynamic routes.

Description

Technical Field

[0001] This invention relates to the field of communication technology, and specifically to an authentication method, a key negotiation method, a dynamic routing switching method, and a system. Background Technology

[0002] In the power distribution field, while existing single-mode communication between operating equipment and remote control platforms can meet certain information transmission needs in specific environments, it still has many shortcomings. For example, the high voltage and strong current electromagnetic environment of live power lines severely interferes with the communication system of the operating equipment. On the one hand, effective electrical isolation is required between live lines and the control system of the operating equipment; wired connections are limited by cable length, making wiring complex and dangerous. On the other hand, traditional single-mode wireless communication, due to its inherent communication characteristics, is easily affected by the complex electromagnetic environment of live lines, resulting in slower transmission, transmission interruptions, or unclear transmitted video images.

[0003] For wireless communication networks, authentication is mainly performed between access points (APs) and stations (STAs). However, with the increasing openness of networks, security risks such as unauthorized access and man-in-the-middle attacks are becoming increasingly prominent. Summary of the Invention

[0004] The purpose of this invention is to provide an authentication method, a key negotiation method, a dynamic routing switching method and system, which introduces a security module to assist the AP in completing authentication and key negotiation to achieve the security and reliability of communication data, and can realize adaptive switching of dynamic routing.

[0005] To achieve the above objectives, a first aspect of the present invention provides an authentication method applied to an Access Point (AP). The authentication method includes: forwarding an initial response message corresponding to a local authentication request from a STA to a security module; receiving a first response code generated by the security module based on an AP private key and an STA identifier in the initial response message, wherein the AP private key is stored in the security module; forwarding the first response code to the STA, so that the STA generates a second response code based on the first response code and the STA identifier and sends a final response message, wherein the final response message includes the second response code and the STA identifier; receiving the final response message; generating a verification response code based on the first response code and the STA identifier in the final response message; and determining that the STA's authentication is successful if the second response code matches the verification response code.

[0006] Through the above technical solution, this invention creatively stores the AP private key in the security module. The security module uses the AP private key and the STA identifier in the initial response message corresponding to the local authentication request sent by the STA to generate a response code. The STA uses the generated response code and the STA identifier to generate a new response code and sends the new response code and the STA identifier to the AP. The AP generates a verification response code based on the response code generated by the security module and the received STA identifier, and confirms the successful authentication of the STA when the new response code generated by the STA matches the verification response code. Thus, the management and updating of the AP private key are centralized in the security module, reducing the management complexity of the AP device, achieving physical isolation of the private key, and ensuring the legitimacy of the STA's identity through the verification response code, thereby achieving secure data access.

[0007] A second aspect of the present invention provides an authentication method applied to a STA (Stationary Entity). The authentication method includes: sending an initial response message corresponding to a local authentication request to an AP (Access Point), wherein the AP forwards the initial response message to a security module, wherein the initial response message includes an STA identifier, the security module generates a first response code based on an AP private key and the STA identifier in the initial response message, and sends the first response code to the AP, wherein the AP private key is stored in the security module; receiving the first response code forwarded by the AP; generating a second response code based on the first response code and the STA identifier stored locally by the STA; and sending a final response message to the AP, wherein the AP generates a verification response code based on the first response code and the STA identifier in the final response message, and determines that the STA's authentication is successful if the second response code in the final response message matches the verification response code.

[0008] Through the above technical solution, this invention creatively stores the AP private key in the security module. The security module uses the AP private key and the STA identifier in the initial response message corresponding to the local authentication request sent by the STA to generate a response code. The STA uses the generated response code and the STA identifier to generate a new response code and sends the new response code and the STA identifier to the AP. The AP generates a verification response code based on the response code generated by the security module and the received STA identifier, and confirms the successful authentication of the STA when the new response code generated by the STA matches the verification response code. Thus, the management and updating of the AP private key are centralized in the security module, reducing the management complexity of the AP device, achieving physical isolation of the private key, and ensuring the legitimacy of the STA's identity through the verification response code, thereby achieving secure data access.

[0009] A third aspect of the present invention provides a key negotiation method applied to an Access Point (AP). The key negotiation method includes: performing identity authentication according to the identity authentication method; forwarding key information corresponding to a key negotiation request from a STA to a security module, so that the security module performs: generating a session key based on a second random number generated by the STA and a random number generated by the AP; generating a negotiation response code based on the session key, a second STA ciphertext in the key information, and an STA identifier, and sending a response message to the AP, wherein the response message includes the negotiation response code and the STA identifier; in response to receiving the response message, generating a negotiation verification code based on the session key, the second STA ciphertext, and the STA identifier in the response message; and confirming that the key negotiation is successful if the negotiation response code and the negotiation verification code are consistent.

[0010] Through the above technical solution, the present invention creatively introduces a security module to assist the AP in completing key negotiation after the STA and AP have established identity authentication and confirmation. Furthermore, a new session key is generated for each session to ensure the freshness of the session key and improve the security and reliability of key exchange.

[0011] A fourth aspect of the present invention provides a switching method for dynamic routing, the switching method comprising: performing key negotiation according to the key negotiation method; determining multiple weights corresponding to multiple communication indicators according to a fuzzy consistency matrix; determining the indicator weighting value of each single communication mode and the indicator weighting value of each combined communication mode according to multiple indicator values ​​and multiple weights corresponding to the multiple communication indicators in a single communication mode among multiple communication modes; and adaptively selecting the single communication mode or the combined communication mode corresponding to the maximum indicator weighting value according to a specific scenario.

[0012] Through the above technical solution, the present invention creatively adopts an intelligent routing selection algorithm based on fuzzy hierarchical analysis, which comprehensively considers multiple factors such as bandwidth, latency, packet loss rate, security and network load, and dynamically and adaptively switches routes.

[0013] A fifth aspect of the present invention provides an access point (AP), the AP comprising: an execution device for executing the authentication method, the key negotiation method, or the dynamic routing switching method.

[0014] A sixth aspect of the present invention provides a STA, the STA comprising: an execution device for executing the authentication method or the dynamic routing switching method.

[0015] A seventh aspect of the present invention provides an identity authentication system applied to an Access Point (AP), the identity authentication system comprising: a first forwarding device for forwarding an initial response message corresponding to a local authentication request from a Station (STA) to a security module; a first receiving device for receiving a first response code generated by the security module based on an AP private key and an STA identifier in the initial response message, wherein the AP private key is stored in the security module; a second forwarding device for forwarding the first response code to the STA, so that the STA generates a second response code based on the first response code and the STA identifier and sends a final response message, wherein the final response message includes the second response code and the STA identifier; a second receiving device for receiving the final response message; a generating device for generating a verification response code based on the first response code and the STA identifier in the final response message; and a determining device for determining that the STA's identity authentication is successful if the second response code matches the verification response code.

[0016] For specific details and benefits of the identity authentication system provided in the embodiments of the present invention, please refer to the above description of the identity authentication method, which will not be repeated here.

[0017] An eighth aspect of the present invention provides an identity authentication system applied to a STA, the identity authentication system comprising: a first sending device for sending an initial response message corresponding to a local authentication request to an AP, wherein the AP forwards the initial response message to a security module, wherein the initial response message includes an STA identifier, the security module generates a first response code based on an AP private key and the STA identifier in the initial response message and sends the first response code to the AP, wherein the AP private key is stored in the security module; a receiving device for receiving the first response code forwarded by the AP; a generating device for generating a second response code based on the first response code and the STA identifier stored locally by the STA; and a second sending device for sending a final response message to the AP, wherein the AP generates a verification response code based on the first response code and the STA identifier in the final response message, and determines that the STA's identity authentication is successful if the second response code in the final response message matches the verification response code.

[0018] For specific details and benefits of the identity authentication system provided in the embodiments of the present invention, please refer to the above description of the identity authentication method, which will not be repeated here.

[0019] A ninth aspect of the present invention provides a key negotiation system applied to an Access Point (AP), the key negotiation system comprising: the authentication system for performing authentication; a forwarding device for forwarding key information corresponding to a key negotiation request from a STA to a security module, wherein the security module performs: generating a session key based on a second random number generated by the STA and a random number generated by the AP; generating a negotiation response code based on the session key, a second STA ciphertext in the key information, and an STA identifier, and sending a response message to the AP, wherein the response message includes the negotiation response code and the STA identifier; a generation device for generating a negotiation verification code based on the session key, the second STA ciphertext, and the STA identifier in the response message in response to receiving the response message; and a confirmation device for confirming successful key negotiation if the negotiation response code matches the negotiation verification code.

[0020] For specific details and benefits of the key negotiation system provided in the embodiments of the present invention, please refer to the above description of the key negotiation method, which will not be repeated here.

[0021] The tenth aspect of the present invention provides a dynamic routing switching system, the switching system comprising: the key negotiation system for performing key negotiation; a first determining device for determining multiple weights corresponding to multiple communication indicators based on a fuzzy consistency matrix; a second determining device for determining the indicator weighting value of each single communication mode and the indicator weighting value of each combined communication mode based on multiple indicator values ​​and multiple weights corresponding to the multiple communication indicators in a single communication mode among multiple communication modes; and a selecting device for adaptively selecting the single communication mode or the combined communication mode corresponding to the maximum indicator weighting value according to a specific scenario.

[0022] For specific details and benefits of the dynamic routing switching system provided in the embodiments of the present invention, please refer to the above description of the dynamic routing switching method, which will not be repeated here.

[0023] The eleventh aspect of the present invention provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the authentication method, the key negotiation method, or the dynamic routing switching method.

[0024] Other features and advantages of the present invention will be described in detail in the following detailed description section. Attached Figure Description

[0025] The accompanying drawings are provided to further illustrate embodiments of the present invention and form part of the specification. They are used together with the following detailed description to explain the embodiments of the present invention, but do not constitute a limitation thereof. In the drawings:

[0026] Figure 1 This is a flowchart of an identity authentication method provided in an embodiment of the present invention;

[0027] Figure 2 This is a structural diagram of a multimodal communication system provided in an embodiment of the present invention;

[0028] Figure 3 This is an interactive flowchart of the identity authentication process provided in an embodiment of the present invention;

[0029] Figure 4 This is a flowchart of an identity authentication method provided in an embodiment of the present invention;

[0030] Figure 5 This is a flowchart of a key negotiation method provided in an embodiment of the present invention;

[0031] Figure 6 This is an interactive flowchart of the key negotiation process provided in an embodiment of the present invention;

[0032] Figure 7 This is a flowchart of a dynamic routing switching method provided in an embodiment of the present invention; and

[0033] Figure 8 This is a flowchart of a multimodal communication method provided in an embodiment of the present invention. Detailed Implementation

[0034] The specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings. It should be understood that the specific embodiments described herein are for illustration and explanation only and are not intended to limit the present invention.

[0035] Establishing an initial connection between the STA and AP is a prerequisite for authentication and secure communication. First, the STA selects the wireless communication method with the best signal quality, actively scans the surrounding wireless environment, and sends probe requests to find available WAPI access points. Each AP, upon receiving a probe request from the STA, replies with a probe response containing basic AP information such as SSID (Service Set Identifier), supported frequency bands, and channels. Once the STA identifies a target AP, it sends an association request to that AP. If the AP accepts the association request, it allocates necessary resources to the STA, such as channels and bandwidth, and generates a temporary Association ID (AID) for subsequent communication management. Then, the AP sends an association response to the STA, informing it whether the connection has been successfully established. If the association is successful, the response will include the AID and other necessary configuration information; if it fails, the response will explain the reason. After successful association, a basic communication link is established between the STA and AP, at which point unencrypted data exchange can occur.

[0036] Through the above process, the STA and AP establish a preliminary communication link, preparing for subsequent identity authentication and key negotiation.

[0037] Example 1

[0038] Figure 1 This is a flowchart of an identity authentication method provided in an embodiment of the present invention, wherein the identity authentication method is applied to an AP. Figure 1 As shown, the authentication method includes: step S101, forwarding an initial response message corresponding to the local authentication request from the STA to the security module; step S102, receiving a first response code generated by the security module based on the AP private key and the STA identifier in the initial response message, wherein the AP private key is stored in the security module; step S103, forwarding the first response code to the STA, so that the STA generates a second response code based on the first response code and the STA identifier and sends a final response message, wherein the final response message includes the second response code and the STA identifier; step S104, receiving the final response message; step S105, generating a verification response code based on the first response code and the STA identifier in the final response message; and step S106, determining that the STA's authentication is successful if the second response code matches the verification response code.

[0039] Before introducing the various embodiments of the present invention, a brief introduction will be given to the multimodal communication system involved in the identity authentication method, key negotiation method, and dynamic routing switching method provided by the present invention, such as... Figure 2 As shown.

[0040] The hardware system may include an AS (Application Server) 10, an AP (Access Point) 20, a STA (Station) 30, a security module 40, etc.

[0041] AS 10 (e.g., a remote cloud platform) is located in a remote data center or cloud server cluster. It is responsible for the remote storage, computation, and analysis of large amounts of data, and provides core business logic support and services such as remote monitoring functions to ensure the normal operation of the system. It communicates with AP 20 (e.g., a local control terminal, static access point, etc., the specific AP depends on the application scenario and requirements, such as: router, smartphone / tablet, IoT gateway, embedded system) and STA (e.g., one or more of STA 30-1, 30-2, 30-3...30-N, where STA can be a local execution terminal, such as a robot receiving device, camera, drone, smart wearable device, IoT device) through remote broadband (4G / 5G) communication.

[0042] AP 20 communicates with STAs (such as one or more of STAs 30-1, 30-2, 30-3...30-N) via local narrowband, local broadband, and remote broadband. It is responsible for sending field operation commands, remotely controlling one or more STAs (such as one or more of STAs 30-1, 30-2, 30-3...30-N) to carry out their work, and collecting status information, environmental data, operation video images, and other information from STAs (such as one or more of STAs 30-1, 30-2, 30-3...30-N). This information is stored on AP 20 for easy copying and transfer to AS 10 later. It can also directly connect to AS 10 via 4G / 5G communication when not in use and upload the data to AS 10 for analysis.

[0043] STA (such as one or more of STA30-1, 30-2, 30-3...30-N) is responsible for continuously monitoring the working environment and equipment status of the operating equipment, collecting raw data, receiving instructions from AP 20, executing corresponding actions, and feeding back the execution results or equipment status to AP 20 in real time.

[0044] Security module 40 can be a third-party trusted mobile security medium that connects directly to AP 20 via an external port. It stores the AP's certificate and key, is responsible for generating response codes, and can communicate with AS 10 to update certificate information and keys when not in use.

[0045] Specifically, the STA sends an initial response message (Response) to the AP:

[0046] Response = (ID)STA ID AP ),

[0047] Among them, ID STA It is the STA identifier, ID AP It is the AP identifier.

[0048] Then, the AP receives the initial response message Response, and the AP forwards the initial response message to the security module.

[0049] Next, the security module generates a first response code S based on the received initial response message. AP :

[0050] ,

[0051] Among them, SK AP It is the AP private key stored in the security module, where F HMAC It's the HMAC algorithm, representing Hash-based Message Authentication Code. The security module's first response code S... AP The AP forwards the message to the STA.

[0052] STA received the first response code S AP Then, add its own relevant information ID to the first response code again. STA Generate its own response information (i.e., the second response code). :

[0053] .

[0054] STA sends a final response message (Final Response) to AP:

[0055] Final Response = ( ID STA ).

[0056] The AP receives the final response message and, based on the first response code... Generate a verification response code using the STA identifier in the final response message:

[0057] .

[0058] if If the STA's authentication is successful, the STA is allowed to temporarily access the network; otherwise, the STA's authentication is unsuccessful, access is denied, thus ensuring the STA's identity security.

[0059] In this embodiment, the AP's private key is stored in the security module during the authentication process, rather than directly on the AP device, achieving physical isolation of the private key. When the independent security module is removed, the network is automatically disconnected and the certificate is deleted, improving security. The security module, as an independent security medium, is logically isolated from the AP device, further enhancing system security. This simplifies management: private key management and updates can be centralized in the security module, reducing the management complexity of the AP device; the AP device can be replaced while the security module remains unchanged, improving system flexibility and maintainability.

[0060] In other words, a security module is used as an external security medium to store the access point (AP)'s certificate and key, and is responsible for authenticating the terminal (STA). During the authentication process, the HMAC (Hash-based Message Authentication Code) algorithm is used to improve the security of authentication.

[0061] In this embodiment, the AP verifies the STA identification information to ensure that the response code is generated by a specific STA, preventing STA impersonation; and it supports multiple STAs connecting to the same AP, allowing the AP to distinguish different STAs through the STA identification information, ensuring that the identity of each STA is legitimate.

[0062] Example 2

[0063] Based on the above embodiment one, the final response message also includes the first STA ciphertext and the first HMAC generated by the STA.

[0064] Accordingly, the authentication method further includes: generating a local verification HMAC based on the AP private key, the first STA ciphertext in the final response message and the AP identifier; and confirming whether the local verification HMAC is consistent with the first HMAC generated by the STA in the final response message.

[0065] The step of generating the verification response code is performed if the local verification HMAC matches the first HMAC generated by the STA in the final response message.

[0066] Specifically, the STA sends an initial response message (Response) to the AP.

[0067] Response = (C STA ID STA HMAC STA ID AP ),

[0068] Among them, C STA It is the first STA ciphertext, IDSTA It's the STA identifier, HMAC. STA It is the first HMAC generated by STA, ID AP It is the AP identifier.

[0069] Then, the AP receives the initial response message Response, and the AP forwards the initial response message to the security module.

[0070] Next, the security module generates a first response code S based on the received initial response message. AP .

[0071] ,

[0072] Among them, SK AP It is the AP private key stored in the security module. Security module first response code S AP The AP forwards the message to the STA.

[0073] STA received the first response code S AP Then, add its own relevant information ID to the first response code again. STA Generate its own response information (i.e., the second response code). :

[0074] .

[0075] STA sends a final response message (Final Response) to AP:

[0076] Final Response = (C STA , ID STA HMAC STA ).

[0077] After receiving the Final Response message from the STA, the AP uses its private key SK. AP Decrypt the ciphertext C sent by STA STA Extract the decryption result r:

[0078] r=D(SK AP C STA ),

[0079] Where D represents the decryption operation, and SK AP It is the AP private key.

[0080] AP generates local authentication HMAC (i.e., HMAC) AP-check-STA ):

[0081] ,

[0082] If HMAC AP-check-STA =HMAC STA If so, the STA's identity has been initially verified successfully.

[0083] The AP receives the final response message and, based on the first response code... Generate a verification response code using the STA identifier in the final response message:

[0084] .

[0085] if If the STA's authentication is successful, the STA is allowed to temporarily access the network; otherwise, the STA's authentication is unsuccessful, access is denied, thus ensuring the STA's identity security.

[0086] The AP distinguishes different STAs by verifying their identification information, enabling multiple STAs to connect to the same AP simultaneously and ensuring that each STA is legitimate.

[0087] This embodiment can achieve tamper-proof protection: the security module is responsible for generating the response code, ensuring that the response code is generated by a legitimate security module, preventing man-in-the-middle attacks and tampering; the AP uses its own private key to verify the HMAC, ensuring the integrity and authenticity of the message.

[0088] Example 3

[0089] Based on the above embodiment two, before executing step S101, the authentication method further includes: receiving the initial response message from the STA, wherein the initial response message includes an AP identifier, a STA identifier, a first STA ciphertext, and a first HMAC generated by the STA; and verifying whether the AP identifier in the initial response message is consistent with the AP identifier in the local authentication request. Accordingly, the step of forwarding the initial response message corresponding to the local authentication request from the STA to the security module is performed if the AP identifier in the initial response message is consistent with the AP identifier in the local authentication request.

[0090] Specifically, the STA sends an initial response message (Response) to the AP:

[0091] Response = (C STA ID STA HMAC STA ID AP ),

[0092] Among them, C STA It is the first STA ciphertext, ID STA It's the STA identifier, HMAC. STAIt is the first HMAC generated by STA, ID AP It is the AP identifier.

[0093] Then, the SP receives the initial response message Response and verifies the ID within it. AP Whether it matches the AP identifier in the local authentication request. Only if they match will the AP forward the initial response message to the security module.

[0094] Next, the security module generates a first response code S based on the received initial response message. AP :

[0095] ,

[0096] Among them, SK AP It is the AP private key stored in the security module. Security module first response code S AP The AP forwards the message to the STA.

[0097] STA received the first response code S AP Then, add its own relevant information ID to the first response code again. STA Generate its own response information (i.e., the second response code). :

[0098] .

[0099] STA sends a final response message (Final Response) to AP:

[0100] Final Response = (C STA , ID STA HMAC STA ).

[0101] After receiving the Final Response message from the STA, the AP uses its private key SK. AP Decrypt the ciphertext C sent by STA STA Extract the decryption result r:

[0102] r=D(SK AP C STA ),

[0103] Where D represents the decryption operation, and SK AP It is the AP private key.

[0104] AP generates local authentication HMAC (i.e., HMAC) AP-check-STA ):

[0105] ,

[0106] If HMAC AP-check-STA =HMAC STA If so, the STA's identity has been initially verified successfully.

[0107] The AP receives the final response message and, based on the first response code... Generate a verification response code using the STA identifier in the final response message:

[0108] .

[0109] if If the STA's authentication is successful, the STA is allowed to temporarily access the network; otherwise, the STA's authentication is unsuccessful, access is denied, thus ensuring the STA's identity security.

[0110] Example 4

[0111] Based on any of the above embodiments, while or after forwarding the initial response message corresponding to the local authentication request from the STA to the security module (i.e., step S101), the authentication method further includes: retaining the STA identifier in the initial response message; and verifying whether the STA identifier in the final response message is consistent with the STA identifier in the initial response message. Accordingly, the step of generating the local verification HMAC (i.e., executing step S105) is executed if the STA identifier in the final response message is consistent with the STA identifier in the initial response message.

[0112] After receiving the initial response message from the STA, the AP first verifies the ID in the initial response message. AP If the STA's identifier matches the AP's own AP identifier, and the initial response message is forwarded to the security module after confirmation, the STA's identifier ID is retained. STA Then, the AP verifies the stored ID. STA Does it match the ID in the final response message? STA Consistency is crucial to ensuring the legitimacy of the STA. Only when consistency is achieved can the AP use its own private key SK. AP Decrypt the ciphertext C sent by STA STA To obtain the decryption result, the AP verifies the STA's HMAC to ensure message integrity and the authenticity of its source.

[0113] Example 5

[0114] Based on any of the above embodiments, the identity authentication method further includes: sending the local authentication request to generate a first HMAC by the STA based on the AP identifier in the local authentication request and a first random number generated by the STA, and sending the initial response message by the STA, wherein the initial response message includes the first HMAC generated by the STA, the local authentication request further includes the AP public key, and the first STA ciphertext is generated based on the AP public key and the first random number generated by the STA.

[0115] For step S105, generating the local verification HMAC includes: decrypting the first STA ciphertext in the final response message based on the AP private key to obtain a random number; and generating the local verification HMAC based on the obtained random number and the AP identifier in the final response message.

[0116] Specifically, first, the AP sends a local authentication request:

[0117] Request=(ID AP PK AP ), where ID AP It is the AP identifier, PK AP It is the AP public key.

[0118] Alternatively, AP generates a random number r AP Then, the AP sends a local authentication request:

[0119] Request=(ID AP ,r AP PK AP ),

[0120] Among them, ID AP It is the AP identifier, r AP It is a random number generated by AP, PK AP It is the AP public key.

[0121] Secondly, STA generates the first random number r. STA Then, STA generates the first STA ciphertext C. STA :

[0122] C STA = E(PK AP ,r STA ),

[0123] Where C STA This is the first STA ciphertext generated by STA, where E represents the encryption operation and PK... AP It is the AP public key, r STA It is the first random number generated by STA.

[0124] Upon receiving a local authentication request, the STA generates the first HMAC:

[0125] ,

[0126] Where F HMAC It is the HMAC algorithm, which stands for Hash-based Message Authentication Code. HMAC is used to verify that a message has not been tampered with during transmission.

[0127] Alternatively, upon receiving a local authentication request, the STA generates the first HMAC:

[0128] ,

[0129] Where F HMAC It's the HMAC algorithm, which stands for Hash-based Message Authentication Code; K STA It is the STA's key; the STA uses its own key K. STA Generate a hash-based message authentication code (HMAC) to ensure message integrity and authenticity. HMAC is used to verify that the message has not been tampered with during transmission and to ensure that the message does indeed come from a legitimate STA.

[0130] After receiving the Final Response message from the STA, the AP uses its private key SK. AP Decrypt the first STA ciphertext C sent by STA STA To extract the first random number r generated by STA STA :

[0131] r STA =D(SK AP C STA ),

[0132] Where D represents the decryption operation, and SK AP It is the AP private key.

[0133] AP generates local authentication HMAC (i.e., HMAC) AP-check-STA ):

[0134] .

[0135] If HMAC AP-check-STA =HMAC STA If so, the STA's identity has been initially verified successfully.

[0136] Example 6

[0137] Based on the above embodiments two or three, when the security module generates the first response code based on the AP private key and the first STA ciphertext, STA identifier, AP's first timestamp and STA's first timestamp in the initial response message, the second response code is generated by the STA based on the first response code, the STA identifier stored locally by the STA and the STA's second timestamp.

[0138] Accordingly, generating a verification response code based on the first response code and the STA identifier in the final response message includes: confirming whether the second timestamp of the STA in the second response code is within a first preset time range; and if the second timestamp is within the first preset time range, generating the verification response code based on the first response code and the STA identifier and the second timestamp of the STA in the final response message.

[0139] Specifically, the security module generates a first response code S based on the received message. AP :

[0140] ,

[0141] Among them SK AP It is the AP private key stored in the security module.

[0142] STA received the first response code S AP Then, add a second timestamp (TS) to the response code. STA-second and their own related information ID STA Generate a second response code :

[0143] .

[0144] STA sends a final response message (Final Response) to AP:

[0145] Final Response = (C STA , ID STA TS STA-first HMAC STA ).

[0146] verify The second timestamp TS in STA STA-second Whether it is within the first preset time range to ensure that the response code is generated within the valid time; at the same time verify the identifier ID. STA The validity of the response code is verified to ensure that it was generated by a specific STA. This two-pronged approach ensures the integrity and freshness of the message and prevents replay attacks.

[0147] According to the first response code The final response message contains the STA identifier and the STA's second timestamp, which together generate a verification response code.

[0148] ,

[0149] if If the STA's authentication is successful, the STA is allowed to temporarily access the network; otherwise, the STA's authentication is unsuccessful, access is denied, thus ensuring the STA's identity security.

[0150] Furthermore, the identity authentication method further includes: sending the local authentication request, wherein the local authentication request includes an AP identifier, an AP public key, the AP's first timestamp, and a first random number generated by the STA, so that the STA generates the first HMAC based on the STA key, the first random number generated by the STA, and the AP identifier and the AP's first timestamp in the local authentication request, and sends the initial response message.

[0151] Accordingly, forwarding the initial response message corresponding to the local authentication request from the STA to the security module includes: if the AP identifier and the first timestamp of the AP in the initial response message are consistent with the AP identifier and the first timestamp of the AP in the local authentication request, respectively, confirming whether the first timestamp of the STA is within a second preset time range; and if the first timestamp of the STA is within the second preset time range, retaining the first timestamp and STA identifier of the STA in the initial response message, and forwarding the initial response message and the first timestamp of the AP to the security module, so that the security module can generate a first response code based on the AP private key, the first STA ciphertext in the initial response message, the first timestamp and STA identifier of the STA, and the first timestamp of the AP, and send the first response code to the AP.

[0152] First, AP generates a random number r. AP and the first timestamp TS AP The AP sends a local authentication request to the STA.

[0153] Request=(ID AP ,r AP ,TS AP-first PK AP ),

[0154] Among them, ID AP It is the AP identifier, r AP It is a random number generated by AP, TS AP-firstIt is the first timestamp generated by AP, PK AP It is the AP public key.

[0155] Then, STA generates the first random number r. STA and the first timestamp TS STA STA generates ciphertext:

[0156] C STA = E(PK AP ,r STA ),

[0157] Where C STA This is the first STA ciphertext generated by STA, where E represents the encryption operation and PK... AP It is the AP public key, r STA It is the first random number generated by STA.

[0158] Next, STA generates the first HMAC:

[0159] ,

[0160] Among them, F HMAC It's the HMAC algorithm, which stands for Hash-based Message Authentication Code; K STA It is the STA key; the STA uses its own key K. STA Generate a hash-based message authentication code (HMAC) to ensure message integrity and authenticity. HMAC is used to verify that the message has not been tampered with during transmission and to ensure that the message does indeed come from a legitimate STA.

[0161] The STA sends an initial response message (Response) to the AP.

[0162] Response = (C STA ID STA ,TS STA-first HMAC STA ID AP ,TS AP-first ),

[0163] ID STA It's the STA logo, TS. STA-first This is the first timestamp generated by STA, HMAC STA It is the message authentication code generated by the STA using its own key (i.e., the STA generates the first HMAC).

[0164] After receiving the initial response message from the STA, the AP first verifies the ID in the response message. AP and TS AP-first Check if it matches the corresponding information in the local authentication request previously sent by the AP, and check the TS.STA-first After verifying the timestamp's freshness, the response message is forwarded to the security module, and the STA's ID is retained. STA and the timestamp TS generated by it STA-first At the same time, AP will generate its first timestamp TS. AP-first It is also sent to the security module, which generates a first response code S based on the received message. AP :

[0165] ,

[0166] Among them SK AP It is the AP private key stored in the security module.

[0167] The security module will use the first response code S AP The AP forwards the message to the STA.

[0168] This embodiment adds timestamp information to the response code, allowing the AP to verify whether the response code was generated within the valid time, preventing replay attacks. At the same time, the timestamp ensures the real-time nature of the authentication process, improving the system's response speed and security.

[0169] Example 7

[0170] Based on the above embodiments, the identity authentication method further includes: sending a remote authentication request to the AS, wherein the remote authentication request includes: a first STA ciphertext, an STA identifier, a first HMAC generated by the STA, and an AP identifier, so that the AS generates a remote verification HMAC based on the STA public key and the first STA ciphertext and AP identifier in the remote authentication request, and the AS confirms that the STA's identity authentication is successful if the remote verification HMAC is consistent with the first HMAC generated by the STA.

[0171] Specifically, the AP generates a remote authentication request Forward, containing the STA's first STA ciphertext C. STA Identifier ID STA The first HMAC generated by STA STA AP Identifier ID AP :

[0172] Forward = (C STA ID STA HMAC STA ID AP ).

[0173] The AP sends the request forward to the AS.

[0174] AS uses the STA public key Decrypting the first STA ciphertext The AS then uses the STA key to extract the decryption result; ( It is a pre-shared key, which the AS owns. The remote authentication HMAC of the STA is recalculated (i.e.,...). ), and the first HMAC generated by STA (i.e. Compare:

[0175] r=D(PK STA C STA ),

[0176]

[0177] FHMAC stands for HMAC algorithm, which represents a hash-based message authentication code.

[0178] if If so, then STA's authentication is successful.

[0179] Example 8

[0180] Based on the above embodiment six, the identity authentication method further includes: sending a remote authentication request to the AS, wherein the remote authentication request includes: a first STA ciphertext, an STA identifier, a first HMAC generated by the STA, an AP identifier, and a second timestamp of the STA, so that the AS generates a remote verification HMAC based on the STA public key and the first STA ciphertext and AP identifier in the remote authentication request, and the AS confirms that the STA's identity authentication is successful when the remote verification HMAC is consistent with the first HMAC generated by the STA and the second timestamp of the STA is within a first preset time range.

[0181] Specifically, the AP generates a remote authentication request Forward, containing the STA's first STA ciphertext C. STA With ID STA The first HMAC generated by STA STA AP Identifier ID AP STA's second timestamp TS STA-second :

[0182] Forward = (C STA ID STA ,TS STA-second HMAC STA ID AP ).

[0183] The AP sends the request forward to the AS.

[0184] AS uses the STA public key PKSTA to decrypt the first STA ciphertext CSTA of the STA to extract the decryption result; then, AS uses the STA key KSTA to recalculate the STA's remote authentication HMAC (i.e., ), and the first HMAC generated by STA (i.e. Compare:

[0185] r=D(PK STA C STA ),

[0186]

[0187] in It is the HMAC algorithm, which stands for Hash-based Message Authentication Code.

[0188] if If so, then STA's authentication is successful.

[0189] Alternatively, in Embodiment 7 or Embodiment 8 above, the decryption result r is a random number generated by STA.

[0190] Example 9

[0191] Based on any of the above embodiments, the identity authentication method further includes: sending a remote authentication request to the AS, wherein the remote authentication request includes: STA identifier, HMAC generated by the AP, random number generated by the AP, and a second timestamp of the AP, so that the AS generates a remote verification HMAC based on the STA identifier in the remote authentication request and the second timestamp of the AP, and confirms that the identity authentication of the AP is successful if the remote verification HMAC is consistent with the HMAC generated by the AP.

[0192] Specifically, the AP generates a remote authentication request Forward, which includes the STA identifier (i.e., ID). STA ), random number r generated by AP AP-new The HMAC generated by the AP (i.e., HMAC) AP AP's second timestamp TS AP-second :

[0193] ,

[0194] Forward = (ID) STA HMAC AP , r AP-new TS AP-second ).

[0195] The AS is based on the random number r of AP. AP-newThe STA identifier (ID) STA AP's second timestamp TS AP-second Generate remote verification HMAC:

[0196] ,

[0197] Where K AP It is the AP key, used to generate HMAC.

[0198] If HMAC AS-check-AP = HMAC AP If the authentication of the AP is successful, the AS will subsequently send an authentication message to the AP to allow the STA to access. Otherwise, the AS will notify the AP to deny the STA access.

[0199] This embodiment verifies the identity of the AP through a remote authentication process by the AS, ensuring that the AP received by the STA is legitimate and preventing man-in-the-middle attacks. For example, combined with the STA authentication in Embodiment 1: the AP verifies the STA identification information in the response code forwarded by the STA, ensuring that the STA's identity is legitimate and preventing the STA from being forged, thereby achieving two-way authentication.

[0200] Example 10

[0201] Based on any of the above embodiments, the identity authentication method further includes: receiving a secondary authentication message from an AS, wherein the secondary authentication message includes: a first AP ciphertext, an AP identifier, and an HMAC about the AP generated by the AS; decrypting the first AP ciphertext based on the AP private key to obtain an AS random number; generating a first AS verification HMAC based on the AS random number and the AP identifier in the secondary authentication message; and confirming successful signature verification of the AS if the first AS verification HMAC is consistent with the HMAC about the AP and the AP identifier in the secondary authentication message is consistent with the AP identifier stored locally by the AP.

[0202] Specifically, the AS sends a secondary authentication message (AS Response) to the AP:

[0203] AS Response=(C AP HMAC AS-AP ID AP ),

[0204] AP is based on AP private key SK AP For the first AP ciphertext C AP Decrypt to obtain the random number r of AS. AS :

[0205] r AS=D(SK AP C AP );

[0206] Then, the first AS verification HMAC (i.e., HMAC) is generated based on the AS random number and the AP identifier. AP-check-AS ):

[0207] , where K AS For AS key,

[0208] if If the AP identifier in the secondary authentication message received by the AP matches its own unique identifier, then the signature verification of the AS is successful. The AP receives the remote authentication response from the AS, allowing the STA to access.

[0209] This embodiment enables dual authentication: the AP verifies the identity of the STA locally, and the remote AS performs secondary authentication to ensure the overall security of the system.

[0210] Example 11

[0211] Based on the above embodiment nine, the identity authentication method further includes: receiving a secondary authentication message from the AS, wherein the secondary authentication message includes: a first AP ciphertext, an AP identifier, an HMAC generated by the AS about the AP, an AS timestamp, and a second timestamp of the AP; decrypting the first AP ciphertext based on the AP private key to obtain an AS random number; generating a first AS verification HMAC based on the AS random number, the AP identifier, and the AS timestamp; and confirming successful signature verification of the AS if the first AS verification HMAC matches the HMAC about the AP, the AP identifier in the secondary authentication message matches the AP identifier stored locally by the AP, and the second timestamp of the AP in the secondary authentication message matches the second timestamp of the AP in the remote authentication request.

[0212] Specifically, AS generates the first AP ciphertext of AP and the HMAC (i.e., ...) generated by AS regarding AP. ):

[0213] Where E represents the encryption operation. It is the AP public key.

[0214] .

[0215] in, It is a timestamp generated by AS. It is the HMAC of the newly generated AP by AS.

[0216] AS sends a secondary authentication message AS Response to AP:

[0217] AS Response =( C AP HMAC AS-AP TS AS ID AP TS AP-second ),

[0218] AP is based on AP private key SK AP For the first AP ciphertext C AP Decrypt to obtain the random number r of AS. AS :

[0219] r AS =D(SK AP C AP );

[0220] Then, the first AS verification HMAC (i.e., HMAC) is generated based on the AS random number, AP identifier, and AS timestamp. AP-check-AS ):

[0221] , where K AS For AS key,

[0222] if The AP identifier in the secondary authentication message received by the AP is consistent with its own unique identifier, and the TS in the secondary authentication message... AP-second TS in remote authentication request AP-second If the signatures match, the AS signature verification is successful. The AP receives the AS's remote authentication response, allowing the STA to access. Because the AS may be vulnerable to attack, the AP identifier and / or TS in the secondary authentication request are crucial. AP-second All of these are subject to change, so the security of AS can be confirmed through the above verification.

[0223] In addition, the STA can verify the AS's response in the following ways.

[0224] First, AS generates a random number r. AS Generate timestamp TS AS Generate AS ciphertext C AS and HMAC AS-STA :

[0225] C AS =E(PK STA r AS ),

[0226] ,

[0227] Among them, CAS It is the generated AS ciphertext, K AS It is the AS key, HMAC AS-STA It is the HMAC of the newly generated STA by AS.

[0228] Secondly, the secondary authentication request AS Response may also include: C AS HMAC AS-STA ID STA The AP forwards a portion of the secondary authentication request, Response1, to the STA: Response1 = (C AS HMAC AS-STA ID STA ,TS AS ).

[0229] STA decrypts AS's ciphertext: r AS =D(PK STA C AS );

[0230] STA generates AS verification HMAC STA-check-AS :

[0231] ,

[0232] If HMAC STA-check-AS =HMAC AS-STA If the STA identifier in the secondary authentication request matches the STA's own unique identifier, then the AS signature verification is successful, the secondary authentication process is completed, and the STA accesses the AP network.

[0233] In summary, this invention stores the AP private key in the security module. The security module uses the AP private key and the STA identifier in the initial response message corresponding to the local authentication request sent by the STA to generate a response code. The STA uses the generated response code and the STA identifier to generate a new response code and sends the new response code and the STA identifier to the AP. The AP generates a verification response code based on the response code generated by the security module and the received STA identifier. When the new response code generated by the STA matches the verification response code, the AP confirms that the STA's identity authentication is successful. Thus, the management and updating of the AP private key are centralized in the security module, reducing the management complexity of the AP device, achieving physical isolation of the private key, and ensuring the legitimacy of the STA's identity through the verification response code, thereby achieving secure data access.

[0234] Example 12

[0235] Figure 4 This is a flowchart of an identity authentication method provided in an embodiment of the present invention, which is applied to a STA. Figure 4As shown, the authentication method includes: step S401, sending an initial response message corresponding to a local authentication request to the AP, so that the AP forwards the initial response message to the security module, wherein the initial response message includes an STA identifier, the security module generates a first response code based on the AP private key and the STA identifier in the initial response message and sends the first response code to the AP, wherein the AP private key is stored in the security module; step S402, receiving the first response code forwarded by the AP; step S403, generating a second response code based on the first response code and the STA identifier stored locally by the STA; and step S404, sending a final response message to the AP, so that the AP generates a verification response code based on the first response code and the STA identifier in the final response message, and determines that the STA's authentication is successful if the second response code in the final response message matches the verification response code.

[0236] For details, please refer to the relevant description in Embodiment 1 above, which will not be repeated here.

[0237] Example 13

[0238] Based on the above embodiment twelve, the final response message also includes the first STA ciphertext and the first HMAC generated by the STA.

[0239] Accordingly, the AP performs the following: generating a local verification HMAC based on the AP private key, the first STA ciphertext in the final response message, and the AP identifier; and confirming whether the local verification HMAC is consistent with the first HMAC generated by the STA in the final response message.

[0240] The step of generating the verification response code is performed if the local verification HMAC matches the first HMAC generated by the STA in the final response message.

[0241] For details, please refer to the relevant description in Embodiment 2 above, which will not be repeated here.

[0242] Example 14

[0243] Based on the above embodiment twelve, the identity authentication method further includes: receiving the local authentication request; generating a first HMAC based on the AP identifier in the local authentication request and a first random number generated by the STA, and having the STA send the initial response message, wherein the initial response message includes the first HMAC generated by the STA, and the local authentication request includes the AP public key; and generating the first STA ciphertext based on the AP public key and the first random number generated by the STA.

[0244] Step S404, in which the AP generates a local verification HMAC based on the AP private key, the first STA ciphertext in the final response message, and the AP identifier, includes: decrypting the first STA ciphertext in the final response message based on the AP private key to obtain a random number; and generating the local verification HMAC based on the obtained random number and the AP identifier in the final response message.

[0245] For details, please refer to the relevant description in Embodiment 5 above, which will not be repeated here.

[0246] Example 15

[0247] Based on the above embodiment fourteen, when the security module generates the first response code based on the AP private key and the first STA ciphertext, STA identifier, AP's first timestamp and STA's first timestamp in the initial response message, generating the second response code based on the first response code and the STA identifier stored locally by the STA includes: generating the second response code based on the first response code, the STA identifier stored locally by the STA and the STA's second timestamp.

[0248] The step of generating a verification response code based on the first response code and the STA identifier in the final response message includes: confirming whether the second timestamp of the STA in the second response code is within a first preset time range; and if the second timestamp is within the first preset time range, generating the verification response code based on the first response code and the STA identifier and the second timestamp of the STA in the final response message.

[0249] Furthermore, the identity authentication method further includes: receiving the local authentication request, wherein the local authentication request includes the AP identifier, the AP public key, and the first timestamp of the AP; generating a first HMAC based on the STA key and the first random number generated by the STA in the local authentication request, the AP identifier, and the first timestamp of the AP, and sending the initial response message, wherein the initial response message includes the first HMAC generated by the STA.

[0250] Accordingly, forwarding the initial response message to the security module (by the AP) includes: if the AP identifier and the first timestamp of the AP in the initial response message are consistent with the AP identifier and the first timestamp of the AP in the local authentication request, respectively, confirming whether the first timestamp of the STA is within a second preset time range; and if the first timestamp of the STA is within the second preset time range, retaining the first timestamp and STA identifier of the STA in the initial response message, and forwarding the initial response message and the first timestamp of the AP to the security module, so that the security module generates a first response code based on the AP private key, the first STA ciphertext in the initial response message, the first timestamp and STA identifier of the STA, and the first timestamp of the AP, and sends the first response code to the AP.

[0251] For details, please refer to the relevant description in Embodiment Six above, which will not be repeated here.

[0252] Example 16

[0253] Based on any of the above embodiments, the identity authentication method further includes: receiving a secondary authentication message forwarded by the AP, wherein the secondary authentication message includes: AS ciphertext, STA identifier, and HMAC generated by the AS regarding the STA; decrypting the AS ciphertext based on the STA public key to obtain an AS random number; generating a second AS verification HMAC based on the AS random number and the STA identifier in the secondary authentication message; and confirming successful signature verification of the AS if the second AS verification HMAC is consistent with the HMAC generated by the AS regarding the STA and the STA identifier in the secondary authentication message is consistent with the STA identifier stored locally by the STA.

[0254] First, AS generates a random number r. AS Generate timestamp TS AS Generate AS ciphertext C AS and HMAC AS-STA :

[0255] C AS =E(PK) STA r AS ),

[0256] , where C AS It is the generated AS ciphertext, K AS It is the AS key, HMAC AS-STA It is the HMAC of the newly generated STA by AS.

[0257] Secondly, the secondary authentication request (AS) response may also include: AS ciphertext C AS HMAC (i.e., HMAC) generated by AS for STA AS-STA ID STA The AP forwards a portion of the secondary authentication request, Response1, to the STA: Response1 = (C AS HMAC AS-STA ID STA ).

[0258] STA decrypts AS's ciphertext r AS =D(PK STA C AS ), where PK STA The STA uses the public key; the STA verifies the AS's HMAC. AS-STA ,

[0259] , where K AS For AS key,

[0260] If HMAC STA-check-AS =HMAC AS-STA If the STA identifier in the secondary authentication request matches the STA's own unique identifier, then the AS signature verification is successful, the secondary authentication process is completed, and the STA accesses the AP network.

[0261] Example 17

[0262] Based on the above embodiment 15, the identity authentication method further includes: receiving a secondary authentication message forwarded by the AP, wherein the secondary authentication message includes: AS ciphertext, STA identifier, HMAC generated by the AS about the STA, and AS timestamp; decrypting the AS ciphertext based on the STA public key to obtain an AS random number; generating a second AS verification HMAC based on the AS random number, the STA identifier in the secondary authentication message, and the AS timestamp; and confirming successful signature verification of the AS if the second AS verification HMAC is consistent with the HMAC generated by the AS about the STA and the STA identifier in the secondary authentication message is consistent with the STA identifier stored locally by the STA.

[0263] First, AS generates a random number r. AS Generate timestamp TS AS Generate AS ciphertext C AS and HMAC AS-STA :C AS =E(PK STA ,r AS ), where PK APIt is the AP public key. , where C AS It is the generated AS ciphertext, K AS It is the AS key, HMAC AS-STA It is the HMAC of the newly generated STA by AS.

[0264] Secondly, the secondary authentication request (AS) response may include: AS ciphertext C AS ID STA HMAC (i.e., HMAC) generated by AS for STA AS-STA ), AS timestamp TSAS. The AP forwards partial information from the secondary authentication request, Response1, to the STA: Response1 = (C AS HMAC AS-STA ID STA ,TS AS ).

[0265] STA decrypts AS's ciphertext r AS =D(PK STA C AS ), where PK STA The STA uses the public key; the STA verifies the AS's HMAC. AS-STA ,

[0266] , where K AS For AS key,

[0267] If HMAC STA-check-AS =HMAC AS-STA If the STA identifier in the secondary authentication request matches the STA's own unique identifier, then the AS signature verification is successful, the secondary authentication process is completed, and the STA accesses the AP network.

[0268] Example 18

[0269] like Figure 3 As shown, the interaction process between AP, STA, and security module may include steps 1-9, as detailed below.

[0270] 1. AP generates random numbers and timestamps

[0271] AP generates random number r AP and timestamps (TS) AP .

[0272] 2. AP sends authentication request

[0273] The AP sends the authentication request to the STA.

[0274] Request=(ID AP ,rAP ,TS AP-first PK AP )

[0275] Among them, ID AP It is the AP identifier, r AP It is a random number generated by AP, TS AP-first It is the first timestamp generated by AP, PK AP It is the AP public key.

[0276] 3. STA generates random numbers and timestamps.

[0277] STA generates random numbers r STA and timestamps (TS) STA .

[0278] 4. STA generates ciphertext

[0279] C STA = E(PK AP ,r STA )

[0280] Where C STA It is the ciphertext generated by STA, E is the encryption operation, and PK AP It is the AP public key, r STA It is a random number generated by STA.

[0281] 5. STA generates HMAC

[0282] ,

[0283] Where F HMAC It's the HMAC algorithm, which stands for Hash-based Message Authentication Code. STA It is the STA key; the STA uses its own key K. STA Generate a hash-based message authentication code (HMAC) to ensure message integrity and authenticity. HMAC is used to verify that the message has not been tampered with during transmission and to ensure that the message does indeed come from a legitimate STA.

[0284] 6. STA sends its first response message.

[0285] The STA sends a response message (Response) to the AP.

[0286] Response = (C STA ID STA ,TS STA-first HMAC STA ID AP ,TS AP-first ),

[0287] IDSTA It's the STA logo, TS. STA-first This is the first timestamp generated by STA, HMAC STA It is a message authentication code generated by the STA using its own key.

[0288] 7. The security module generates response codes.

[0289] After receiving the first response message from the STA, the AP first verifies the ID in the response message. AP and TS AP-first Check if it matches the authentication request previously sent by the AP, and check the TS. STA-first After verifying the timestamp's freshness, the AP forwards the response message to the security module. Furthermore, the AP retains the STA's ID. STA and its first timestamp TS generated STA-first At the same time, AP will generate its first timestamp TS. AP-first It is also sent to the security module. The security module generates a response code S based on the received message. AP :

[0290] ,

[0291] Among them SK AP It is the AP private key stored in the security module.

[0292] The security module will respond with code S AP The AP forwards the message to the STA. At the same time, the AP will also retain the ID. STA The first timestamp (TS) generated by itself AP-first The first timestamp TS generated by STA STA-first Send to STA:

[0293] Forward=(S AP ID STA ,TS STA-first ,TS AP-first ).

[0294] 8. STA sends the final response message.

[0295] STA received response code S AP After processing the response message, verify the ID. STA and TS STA-first After confirming that the response code contains the STA's own unique identifier and the timestamp generated the first time, add a second timestamp TS. STA-second and their own related information ID STA Generate a new response code. :

[0296] .

[0297] STA sends a final response message (Final Response) to AP:

[0298] Final Response = (C STA , ID STA TS STA-first HMAC STA ).

[0299] 9. AP performs local response verification.

[0300] After receiving the Final Response message from the STA, the AP first verifies the STA identifier ID. STA and timestamps (TS) STA-first To verify the legitimacy of the STA and distinguish different STAs, the AP uses its own private key SK to check if the key matches the previously stored key (used to verify the STA's legitimacy and distinguish different STAs). AP Decrypt the ciphertext C sent by STA STA To extract the random number r generated by STA STA Finally, the AP verifies the STA's HMAC to ensure message integrity and the authenticity of its origin.

[0301] r STA =D(SK AP C STA ),

[0302] Where D represents the decryption operation, and SK AP It is the AP private key.

[0303] AP verifies STA's HMAC:

[0304] ,

[0305] Among them, K STA It is the STA key.

[0306] If HMAC AP-check-STA =HMAC STA If so, the STA's identity has been initially verified successfully.

[0307] AP verification response code :

[0308] verify The timestamp ensures that the response code is generated within a valid time and also verifies the identifier ID. STAThe validity of the response code is verified to ensure that it was generated by a specific STA. This two-pronged approach ensures the integrity and freshness of the message and prevents replay attacks.

[0309] ,

[0310] if If the STA's authentication is successful, temporary access is granted; otherwise, access is denied. This process involves two responses from the STA, ultimately culminating in the AP completing the local authentication process, ensuring the STA's identity security.

[0311] The remote authentication process may include the following steps 1-9.

[0312] 1. The AP sends a remote authentication request (i.e., a remote authentication request) to the AS.

[0313] The AP generates a remote authentication request forward, which includes a new timestamp TS. AP-second HMAC AP STA's ciphertext C STA STA Identifier ID STA The second timestamp TS generated by STA STA-second HMAC generated by STA STA HMAC generated by AP AP AP Identifier ID AP The random number r generated by AP AP-new and the second timestamp TS AP-second Information such as:

[0314] Forward = (C STA ID STA ,TS STA-second HMAC STA HMAC AP ID AP ,r AP-new ,TS AP-second ),

[0315] in, .

[0316] The AP forwards the remote authentication request to the AS.

[0317] 2. AS generates new random numbers and timestamps.

[0318] AS generates random number r AS Generate timestamp TS AS .

[0319] 3. AS verifies the identity of STA.

[0320] Verifying the legitimacy of HMACSTA: AS uses the STA public key. Decrypting STA's ciphertext C STA To extract the random number r generated by STA STA Then, AS uses the STA key K STA Recalculate local verification HMAC AS-check-STA and the HMAC sent by STA STA Comparison:

[0321] r STA =D(PK STA C STA ),

[0322] ,

[0323] Where F HMAC It's the HMAC algorithm, which stands for Hash-based Message Authentication Code; K STA It is the STA key, used to generate HMAC.

[0324] If HMAC AS-check-STA =HMAC STA And timestamp TS STA-second If valid, then STA's authentication is successful.

[0325] 4. AS verifies the identity of AP

[0326] Verify HMAC AP Validity: AS uses the random number r generated by AP. AP-new and the second timestamp TS AP-second Recalculate local verification HMAC AS-check-AP :

[0327] ,

[0328] Where K AP It is the AP key, used to generate HMAC.

[0329] If HMAC AS-check-AP =HMAC AP If the authentication of the AP is successful, the AS will subsequently send an authentication message to the AP to allow the STA to access. Otherwise, the AS will notify the AP to deny the STA access.

[0330] 5. AS generates new ciphertext and a new HMAC for STA.

[0331] AS generates random number r AS Generate timestamp TS AS Generate a new ciphertext C AS and HMACAS-STA :

[0332] C AS =E(PK) STA r AS ),

[0333] ,

[0334] Where C AS It is the newly generated ciphertext, K AS It is the AS key, HMAC AS-STA It is the HMAC generated by AS regarding ST A.

[0335] 6. AS generates new ciphertext and new HMAC for AP:

[0336] C AP =E(PK AP r AS ), where E represents the encryption operation,

[0337] ,

[0338] Among them, TS AS It is the timestamp generated by AS, HMAC AS-AP It is the HMAC generated by AS regarding AP.

[0339] 7. AS sends a secondary authentication message to AP

[0340] The AS response for the second authentication message is:

[0341] AS Response=(C AS C AP HMAC AS-STA HMAC AS-AP ID STA ,TS AS ID AP ,TS AP-second ),

[0342] The secondary authentication message may include in Figure 3 The remote authentication response shown may further include the AS's authentication result for the AP and the AS's authentication result for the STA.

[0343] 8. AP verifies AS's response

[0344] AP decrypts AS's verification ciphertext: r AS =D(SK AP C AP ),

[0345] ,

[0346] If HMAC AP-check-AS =HMAC AS-AP The AP receives its own identifier and ID. AP Consistent, and the TS received by the AP AP-second If the second timestamp information matches the one generated by the AS, then the signature verification of the AS is successful. The AP receives the verification result from the AS for the STA and allows the STA to access.

[0347] At the same time, the AP forwards the AS's remote authentication response (i.e., part of the secondary authentication message, Response1) to the STA:

[0348] Response1 =(C AS HMAC AS-STA ID STA ,TS AS ).

[0349] 9. STA verifies AS's response.

[0350] STA decrypts AS's ciphertext: r AS =D(PK STA C AS ),

[0351] STA generates AS verification HMAC STA-check-AS :

[0352] ,

[0353] If HMAC STA-check-AS =HMAC AS-STA And the STA receives its own identifier and ID. STA If the signatures match, the AS signature verification is successful, the secondary authentication process is completed, and the STA connects to the AP network.

[0354] Before connecting to the local execution terminal and the local control terminal, authentication is required. During the authentication process, both the STA and AP use digital certificates as their identity credentials, and each STA and AP needs to install the public key certificate issued by the AS. When the STA connects to or reconnects to the local broadband wireless network, both the STA and AP need to perform local authentication and remote authentication by the AS; otherwise, the association is terminated. This invention sets the AP to send authentication activation information to the STA to initiate the authentication process. The authentication process is as follows: Figure 3 As shown.

[0355] In summary, this invention stores the AP private key in the security module. The security module uses the AP private key and the STA identifier in the initial response message corresponding to the local authentication request sent by the STA to generate a response code. The STA uses the generated response code and the STA identifier to generate a new response code and sends the new response code and the STA identifier to the AP. The AP generates a verification response code based on the response code generated by the security module and the received STA identifier. When the new response code generated by the STA matches the verification response code, the AP confirms that the STA's identity authentication is successful. Thus, the management and updating of the AP private key are centralized in the security module, reducing the management complexity of the AP device, achieving physical isolation of the private key, and ensuring the legitimacy of the STA's identity through the verification response code, thereby achieving secure data access.

[0356] Example 19

[0357] Figure 5 This is a flowchart of a key negotiation method provided in an embodiment of the present invention, wherein the key negotiation method is applied to an AP. Figure 5 As shown, the key negotiation method includes: step S501, performing identity authentication according to the identity authentication method; step S502, forwarding the key information corresponding to the key negotiation request from the STA to the security module, so that the security module can perform: generating a session key based on the second random number generated by the STA and the random number generated by the AP, generating a negotiation response code based on the session key, the second STA ciphertext in the key information and the STA identifier, and sending a response message to the AP, wherein the response message includes the negotiation response code and the STA identifier; step S503, in response to receiving the response message, generating a negotiation verification code based on the session key, the second STA ciphertext and the STA identifier in the response message; and step S504, confirming that the key negotiation is successful if the negotiation response code and the negotiation verification code are consistent.

[0358] For step S501, identity authentication is performed according to the identity authentication methods described in the above embodiments. The specific process will not be repeated here.

[0359] For step S502, AP generates a random number r. AP_key The AP generates a key negotiation request (e.g., KeyRequest) and sends it to the STA.

[0360] Key Request=(ID AP , r AP_key ),

[0361] ID AP It is the AP identifier.

[0362] The STA sends key information (e.g., Key Material) corresponding to the key negotiation request to the AP, wherein the key information (e.g., Key Material) includes the second STA ciphertext (C STA_key ) and STA identifier (ID) STA ):

[0363] Key Material=(C STA_key ID STA ).

[0364] The AP forwards key information (such as key material) to the security module.

[0365] After receiving the key information (e.g., Key Material) forwarded by the AP, the security module uses a key derivation function (KDF) to generate a second random number r from the STA. STA_key The random number r generated by the AP AP_key Derive session key from :

[0366] ,

[0367] KDF stands for Key Derivation Function, an algorithm used to generate one or more keys from the original key material. Its main purpose is to increase the strength and security of the keys. KDF ensures that the generated session keys have sufficient randomness and unpredictability, making them suitable for subsequent encrypted communication.

[0368] The security module is based on the session key. The second STA ciphertext C in the key information STA_key With STA ID STA Generate negotiation response code S AP_key :

[0369]

[0370] Furthermore, the security module will use the negotiation response code S AP_key With the STA identifier ID STA Included in the response message:

[0371] Response=(S AP_key ID STA ).

[0372] Then, the security module sends the response message to the AP.

[0373] For step S503, the AP generates a negotiation verification code. :

[0374] .

[0375] For step S504, if S AP_key = S AP_key_check If so, then key negotiation is successful.

[0376] In this embodiment, a new session key is generated for each session to ensure the freshness of the session key and prevent replay attacks; the session key message is confirmed by encryption and decryption to ensure the consistency and validity of the session key.

[0377] In this embodiment, a new session key is generated for each session to ensure the freshness of the session key and prevent replay attacks.

[0378] Example 20

[0379] Based on the above embodiment nineteen, the key negotiation method further includes: sending the key negotiation request, wherein the key negotiation request includes the AP public key, and the STA generates key material based on the second random number generated by the STA and encrypts the key material using the AP public key to generate the second STA ciphertext.

[0380] For step S502, AP generates a random number r. AP_key The AP generates a key negotiation request (e.g., KeyRequest) and sends it to the STA.

[0381] Key Request=(ID AP , r AP_key PK AP ),

[0382] ID AP It is the AP identifier, PK AP It is the public key of the AP.

[0383] After receiving the key negotiation request from the AP, the STA generates a second random number r. STA_key STA generates key material M based on the second random number. STA and use the AP public key PK AP Encrypt it to generate the second STA ciphertext C STA_key :

[0384] M STA =r STA_key ;

[0385] C STA_key =E(PK AP M STA ).

[0386] Example 21

[0387] Based on Embodiment Nineteen or Embodiment Twenty, the key negotiation method further includes: encrypting the combination formed by the fixed string, the AP identifier, and the STA identifier in the key information using the session key to generate a key confirmation code; and sending the key confirmation message to the STA, wherein the key confirmation message includes the key confirmation code, the AP identifier, and the STA identifier, so that the STA generates a key verification code based on the session key, the AP identifier and the STA identifier in the key confirmation message, and the fixed string, and confirms that the key negotiation is successful if the key confirmation code matches the key verification code.

[0388] AP uses session key Encrypt the fixed string "Confirmation" to generate a key confirmation code. .

[0389] ,

[0390] The AP sends a key confirmation message (e.g., Key Confirmation) to the STA, which contains the following information:

[0391] Key Confirmation =( ID AP ID STA ),

[0392] in, This confirmation message is used to verify the success of key negotiation between the AP and STA and to ensure that both parties use the same session key. This is the session key, and "Confirmation" is a fixed string used for confirmation.

[0393] After receiving the key confirmation message from the AP, the STA uses the session key. Generate key verification code .

[0394] ,

[0395] if The STA then confirms that the key negotiation was successful and prepares to use the session key. To conduct subsequent encrypted communication.

[0396] Example 22

[0397] Based on the above embodiment nineteen, the key information also includes the third timestamp of the AP and the third timestamp of the STA.

[0398] Accordingly, the session key is generated based on the second random number generated by the STA, the random number generated by the AP, and the third timestamp of the STA and the third timestamp of the AP in the key information, and the negotiation response code is generated based on the session key, the second STA ciphertext, the STA identifier, and the third timestamp of the STA and the third timestamp of the AP in the key information.

[0399] The response message includes the negotiation response code, the STA identifier, the third timestamp of the STA, and the third timestamp of the AP.

[0400] The generation of the negotiation response code (by the security module) includes: in response to receiving the response message, generating the negotiation verification code based on the session key, the second STA ciphertext, the STA identifier in the response message, the third timestamp generated by the STA and the third timestamp of the AP.

[0401] For step S501, identity authentication is performed according to the identity authentication methods described in the above embodiments. The specific process will not be repeated here.

[0402] For step S502, AP generates a random number r. AP_key The AP generates a key negotiation request (e.g., KeyRequest) and sends it to the STA.

[0403] Key Request=(ID AP ,r AP_key ),

[0404] ID AP It is the AP identifier.

[0405] The STA sends key information (e.g., Key Material) corresponding to the key negotiation request to the AP, wherein the key information (e.g., Key Material) includes the second STA ciphertext (C STA_key STA identifier (ID) STA (and the third timestamp TS of the STA in the key information) STA_key The third timestamp of AP (TS) AP_key :

[0406] Key Material=(C STA_key ID STA ,TS STA_key ,TSAP_key ).

[0407] The AP forwards key information (such as key material) to the security module.

[0408] After receiving the key information (e.g., Key Material) forwarded by the AP, the security module uses a key derivation function (KDF) to generate a second random number r from the STA. STA_key The random number r generated by the AP AP_key The third timestamp of the STA in the key information The third timestamp with AP Derive session key K from session :

[0409] ,

[0410] The security module is based on the session key K session The second STA ciphertext C in the key information STA_key STA Identifier ID STA The third timestamp of the STA in the key information The third timestamp with AP Generate negotiation response code S AP_key :

[0411] .

[0412] Furthermore, the security module will use the negotiation response code S AP_key The STA identifier ID STA The third timestamp of the STA in the key information The third timestamp with AP Included in the response message:

[0413] Response=(S AP_key ID STA ,TS STA_key ,TS AP_key ).

[0414] Then, the security module sends the response message to the AP.

[0415] For step S503, the AP generates a negotiation verification code. :

[0416] .

[0417] For step S504, if S AP_key = SAP_key_check If so, then key negotiation is successful.

[0418] Example 23

[0419] Based on the above embodiment 21, the key negotiation method further includes: sending the key negotiation request, wherein the key negotiation request includes the AP public key and the AP's third timestamp, so that the STA generates key material based on the second random number generated by the STA and the third timestamp generated by the STA, and encrypts the key material using the AP public key to generate the second STA ciphertext.

[0420] For step S502, AP generates a random number r. AP_key and timestamps (TS) AP_key This is used to ensure message freshness and prevent replay attacks. The AP generates a key negotiation request (e.g., Key Request) and sends it to the STA.

[0421] Key Request=(ID AP , r AP_key ,TS AP_key PK AP ),

[0422] ID AP It is the AP identifier, PK AP It is the public key of the AP.

[0423] After receiving the key negotiation request from the AP, the STA generates a second random number r. STA_key and timestamps (TS) STA_key STA generates key material M based on the second random number. STA and use the AP public key PK AP Encrypt it to generate the second STA ciphertext C STA_key :

[0424] ;

[0425] .

[0426] Example 24

[0427] Based on embodiments twenty-two or twenty-three above, the key negotiation method further includes: encrypting a fixed string, an AP identifier, and a combination of the STA identifier, the third timestamp generated by the STA, and the third timestamp of the AP in the key information using the session key to generate a key confirmation code; and sending a key confirmation message to the STA, wherein the key confirmation message includes the key confirmation code, the AP identifier, the STA identifier, the third timestamp generated by the STA, and the third timestamp of the AP, so that the STA generates a key verification code based on the key confirmation code, the AP identifier, the STA identifier, the third timestamp generated by the STA, the third timestamp of the AP, and the fixed string in the key confirmation message, and confirms that the key negotiation is successful if the key confirmation code matches the key verification code.

[0428] AP uses session key K session Encrypt the fixed string "Confirmation" to generate a key confirmation code K. confirm :

[0429] ,

[0430] The AP sends a key confirmation message (e.g., Key Confirmation) to the STA, which contains the following information:

[0431] Key Confirmation =( ID AP ID STA ,TS AP_key TS STA_key ),

[0432] in, This confirmation message is used to verify the success of key negotiation between the AP and STA and to ensure that both parties use the same session key; K session This is the session key, and "Confirmation" is a fixed string used for confirmation.

[0433] After receiving the key confirmation message from the AP, the STA uses the session key. Generate key verification code :

[0434] ,

[0435] if The STA then confirms that the key negotiation was successful and prepares to use the session key. To conduct subsequent encrypted communication.

[0436] Example 25

[0437] Based on any of the above embodiments nineteen to twenty-four, the key information further includes a second HMAC generated by the STA.

[0438] The security module uses the STA public key to decrypt the second STA ciphertext to obtain key material; based on the key material, the STA public key, and the AP identifier, it generates an HMAC for the STA; and if the HMAC for the STA is consistent with the second HMAC generated by the STA, it generates a session key based on a second random number generated by the STA and a random number generated by the AP.

[0439] Specifically, STA uses its own public key PK. STA Generate a hash-based message authentication code to ensure message integrity and authenticity; the input to HMAC includes key material M. STA Timestamp TS STA_key Other relevant information is used to verify that the message has not been tampered with during transmission and to ensure that the message indeed comes from a legitimate STA:

[0440] ,

[0441] Where F HMAC It's the HMAC algorithm, which stands for Hash-based Message Authentication Code. STA This is the STA public key.

[0442] The STA sends the Key Material information to the AP:

[0443] Key Material=(C STA_key ID STA ,TS STA_key ,TS AP_key HMAC STA_key ).

[0444] Then, AP can verify TS. AP_key If the timestamp matches the one it sent, the AP will forward the key information to the security module.

[0445] After receiving the key information forwarded by the AP, the security module uses the STA public key to encrypt the second STA ciphertext C. STA_key Decryption operation yields M STA ( ).

[0446] Further use of STA public key PK STA Recalculate the HMAC value of STA (i.e., HMAC). STA_key_check ).

[0447] HMAC STA_key_check = F HMAC (PK STA M STA ID AP ),

[0448] If HMAC STA_key_check =HMAC STA_key Then, the random number r generated from the STA is obtained using the key derivation function (KDF). STA_key and timestamps (TS) STA_key Derive session key K from session :

[0449] .

[0450] The specific description of this embodiment includes timestamp-related content. Of course, this embodiment is also applicable to situations where timestamp-related content is not included, which will not be elaborated here.

[0451] In this embodiment, a new session key is generated for each session to ensure the freshness of the session key and prevent replay attacks; the session key message is confirmed by encryption and decryption to ensure the consistency and validity of the session key.

[0452] Example 26

[0453] like Figure 6 The interaction process of key negotiation between AP, STA, and security module is shown in the figure. See the description below for details.

[0454] 1. AP sends a key negotiation request.

[0455] AP generates a random number r AP_key and timestamps (TS) AP_key This is used to ensure the freshness of messages and prevent replay attacks.

[0456] The AP generates a key negotiation request and sends the key negotiation request to the STA:

[0457] Key Request =(ID AP ,r AP_key ,TS AP_key PK AP ),

[0458] ID AP It is the AP identifier, PK AP It is the AP public key.

[0459] 2. STA generates key materials and ciphertext.

[0460] After receiving the key negotiation request from the AP, the STA generates a random number r. STA_key and timestamps (TS) STA_key STA combines these two values ​​into key material M. STA and use the AP public key PK AP Encrypt it to generate ciphertext C STA_key :

[0461] Generate key materials ;

[0462] Generate ciphertext ,

[0463] Where E represents the encryption operation.

[0464] 3. STA generates HMAC

[0465] STA uses its own key PK STA Generate a hash-based message authentication code to ensure message integrity and authenticity; the input to HMAC includes key material M. STA Timestamp TS STA_key Other relevant information is used to verify that the message has not been tampered with during transmission and to ensure that the message indeed comes from a legitimate STA:

[0466] ,

[0467] Where F HMAC It's the HMAC algorithm, which stands for Hash-based Message Authentication Code. STA This is the STA public key.

[0468] 4. STA sends key information

[0469] The STA sends the Key Material information to the AP:

[0470] Key Material=(C STA_key ID STA ,TS STA_key ,TS AP_key HMAC STA_key ).

[0471] 5. The AP forwards the key information to the security module.

[0472] First, verify TS. AP_key If the timestamp in the key information matches the timestamp in the key negotiation request it sent, then the key information is forwarded to the security module.

[0473] Key Material =(C STA_key IDSTA ,TS STA_key ,TS AP_key HMAC STA_key ) .

[0474] 6. The security module generates session keys and response codes.

[0475] After receiving the key information forwarded by the AP, the security module processes the ciphertext C. STA_key Decryption operation yields M STA .

[0476] Further use of STA public key PK STA Recalculate the HMAC value of STA (i.e., HMAC). STA_key_check ).

[0477] HMAC STA_key_check = F HMAC (PK STA M STA ID AP ),

[0478] If HMAC STA_key_check =HMAC STA_key Then, the random number r generated from the STA is obtained using the key derivation function (KDF). STA_key and timestamps (TS) STA_key Derive session key from :

[0479] ,

[0480] KDF stands for Key Derivation Function, an algorithm used to generate one or more keys from the original key material. Its main purpose is to increase the strength and security of the keys. KDF ensures that the generated session keys have sufficient randomness and unpredictability, making them suitable for subsequent encrypted communication.

[0481] The security module generates response code S AP_key :

[0482] ,

[0483] ID STA This is the STA identifier.

[0484] The security module will respond with code S AP_key Includes sending the response message to the AP:

[0485] Response =(S AP_key ID STA ,TS STA_key ,TS AP_key ).

[0486] 7. AP Authentication Response Code

[0487] ,

[0488] If S AP_key = S AP_key_check If so, then key negotiation is successful.

[0489] 8. AP generates key confirmation message

[0490] AP uses session key K session Encrypt the fixed string "Confirmation" to generate a key confirmation code K. confirm :

[0491] .

[0492] The AP sends a Key Confirmation message to the STA, which includes the following information:

[0493] Key Confirmation =( ID AP ID STA TS AP_key TS STA_key ),

[0494] in, Used to verify the success of key negotiation between AP and STA, and to ensure that both parties use the same session key; "Confirmation" is a fixed string used for confirmation.

[0495] 9. STA verification key confirmation code

[0496] After receiving the key confirmation message from the AP, the STA uses the session key K. session Generate key verification code K confirm_check :

[0497] .

[0498] if The STA then confirms that the key negotiation was successful and prepares to use the session key. To conduct subsequent encrypted communication.

[0499] To ensure long-term system security, the security module periodically communicates with the AS to update authentication information and session keys. The key update frequency can be configured according to actual needs, typically set to update every 24 hours. When the security module detects a potential security threat or discovers that an existing key may have been compromised, it immediately triggers a key update to prevent security risks arising from the long-term use of the same key. Furthermore, as long as the security module is legitimate, the legitimacy of the access point can be ensured, making the system more flexible and supporting switching between different access points without the need to regenerate key pairs.

[0500] After the STA and AP establish identity authentication, session key negotiation takes place. A security module is introduced to assist the AP in completing key negotiation, improving the security and reliability of key exchange. The key negotiation request is now sent first by the AP node, and the generated key is verified during the negotiation process. The key negotiation flowchart is as follows: Figure 4 As shown.

[0501] Both the identity authentication and key negotiation processes are completed with the help of the security medium security module, which ensures the security of the system. As long as the security module is legitimate, the legitimacy of the access point can be ensured. This makes the system more flexible and can switch between different access points without the need to regenerate key pairs.

[0502] In summary, after the STA and AP establish identity authentication and confirmation, a security module is introduced to assist the AP in completing key negotiation. A new session key is generated for each session to ensure the freshness of the session key and improve the security and reliability of key exchange.

[0503] To improve the robustness and flexibility of communication systems, this invention proposes a multimodal converged networking communication scheme that combines the advantages of three communication methods: local broadband communication (using WAPI as an example), local narrowband communication (using LoRa as an example), and long-distance broadband communication (using 4G as an example, including but not limited to 4G and 5G). To select the optimal routing path in different application scenarios, this invention uses the Fuzzy Hierarchical Analysis (FAHP) algorithm, comprehensively considering factors such as bandwidth (B), delay (D), packet loss rate (P), security (S), and network load (L). By constructing a fuzzy consistent matrix and using a scaling method of 0.1 to 0.9 to evaluate the indicators, the optimal routing path can be selected in different application scenarios.

[0504] The wireless communication network of the multimodal communication system described in this invention includes local broadband communication, local narrowband communication, and long-range broadband communication. Local broadband communication, with its high bandwidth and encryption capabilities, is suitable for scenarios requiring large-volume data transmission, such as transmitting high-definition video, images, and audio data, ensuring local signal transmission and stable communication. Local narrowband communication, due to its low latency, strong anti-interference capabilities, and long-distance transmission capabilities, is suitable for low-power, long-distance data transmission, such as monitoring data and local control commands, which are small-volume data. Long-range broadband communication, including but not limited to 4G / 5G communication, provides medium bandwidth and is suitable for mobility and wide-area coverage requirements, such as remote control command transmission. It can also serve as a backup communication method for emergency operation of equipment by a local remote control platform.

[0505] Example 27

[0506] Figure 7 This is a flowchart of a dynamic routing switching method provided in an embodiment of the present invention, as shown below. Figure 7 As shown, the switching method includes: step S701, performing key negotiation according to the key negotiation method; step S702, determining multiple weights corresponding to multiple communication indicators according to the fuzzy consistency matrix; step S703, determining the indicator weighting value of each single communication mode and the indicator weighting value of each combined communication mode according to the multiple indicator values ​​and multiple weights corresponding to the multiple communication indicators in a single communication mode among multiple communication modes; and step S704, adaptively selecting the single communication mode or combined communication mode corresponding to the maximum indicator weighting value according to a specific scenario.

[0507] This embodiment of adaptive routing switching based on fuzzy hierarchical analysis can comprehensively consider multiple factors affecting routing selection (such as bandwidth, latency, packet loss rate, security, and network load) to ensure that the selected route is optimal in multiple aspects.

[0508] Example 28

[0509] For step S702, determining the multiple weights corresponding to the multiple communication indicators includes: transforming the fuzzy consistency matrix to obtain a fuzzy complementary judgment matrix; normalizing the fuzzy complementary judgment matrix to obtain a normalized matrix; determining the eigenvector corresponding to the largest eigenvalue based on the normalized matrix; and determining the multiple elements in the eigenvector corresponding to the multiple communication indicators as the multiple weights corresponding to the multiple communication indicators.

[0510] For step S701, key negotiation can be performed according to any of the above embodiments 19 to 26, which will not be described in detail here.

[0511] Before performing step S702, a fuzzy consistency matrix A can be constructed:

[0512] The fuzzy consistency matrix A is an n×m matrix, where n is the number of criteria and m is the number of schemes.

[0513] ,

[0514] Where, matrix element a ij Let represent the relative importance of criterion i with respect to criterion j, with a value range of [0.1, 0.9], and satisfy a ij + a ji = 1, a ii =0.5 (meaning that comparisons between the same criteria are equal).

[0515] For the weight calculation in step S702: Based on the fuzzy consistency matrix A, the weights of each criterion are calculated using the eigenvector method. The specific steps are as follows:

[0516] ① Normalization process: Normalize the fuzzy consistency matrix A into a fuzzy complementary judgment matrix. This makes the sum of the elements in each row equal to 1.

[0517] ,

[0518] in, .

[0519] Further, the fuzzy complementary judgment matrix Each column is also normalized so that the sum of the elements in each column equals 1, resulting in the final normalized matrix C. This further eliminates bias and ensures the symmetry and consistency of the matrix.

[0520] .

[0521] ② Calculate the eigenvectors: Find the largest eigenvalue of the normalized matrix C. And its corresponding eigenvector w, the formula for calculating the eigenvector w is:

[0522] ;

[0523] The eigenvector w can be calculated using the following formula:

[0524] ,

[0525] Find the eigenvector corresponding to the largest eigenvalue of the normalized matrix C. .

[0526] in It is the largest eigenvalue, and w is the eigenvector (w i(where k is the feature vector element of the i-th criterion), and k is an index used to identify one of several possible schemes. For example, if k=1, then "scheme k" refers to the first scheme, which may be WAPI; if k=2, then "scheme k" may refer to LoRa, and so on.

[0527] ③ Normalized eigenvectors: To ensure that the sum of the weights is 1, the eigenvector w needs to be normalized to obtain the weight vector W for each criterion:

[0528] ,

[0529] in ,

[0530] in Let represent the normalized weight of the i-th criterion, and n be the number of criteria.

[0531] Assume that, based on experimental measurements, the bandwidth (B), delay (D), packet loss rate (P), security (S), and network load (L) of three communication methods—local broadband communication (using WAPI as an example), local narrowband communication (using LoRa as an example), and long-distance broadband communication (using 4G as an example, including but not limited to 4G and 5G)—are as follows:

[0532] Bandwidth (B): WAPI=300Mbps, LoRa=0.4Mbps, 4G=60Mbps;

[0533] Latency (D): WAPI=10ms, LoRa=80ms, 4G=20ms;

[0534] Packet loss rate (P): WAPI=0.2%, LoRa=0.1%, 4G=0.3%;

[0535] Security (S): WAPI=90%, LoRa=70%, 4G=80%;

[0536] Network load (L): WAPI=50%, LoRa=20%, 4G=40%;

[0537] That is, the measurement table is presented as Table 1.

[0538] Table 1 Measurement Table

[0539]

[0540] First, assuming that based on experience and actual needs, the following fuzzy consistency matrix A is constructed, as shown in Table 2 below.

[0541] Table 2 Fuzzy Consistency Matrix A

[0542]

[0543] Transform the fuzzy consistency matrix A into a fuzzy complementary judgment matrix. The normalized matrix C is shown in Table 3 below.

[0544] Table 3 Matrix C

[0545]

[0546] The maximum eigenvalue of the normalized matrix C is obtained using the formula. And its corresponding eigenvector w. The calculated eigenvector w is:

[0547] w=[0.300,0.200,0.200,0.200,0.100],

[0548] Normalizing the feature vector w yields the final weight vector W:

[0549] W=[0.300,0.200,0.200,0.200,0.100].

[0550] Example 29

[0551] For step S703, determining the index weighting value under each single communication mode and the index weighting value under each combined communication mode includes: determining multiple index values ​​corresponding to the multiple communication indicators under each combined communication mode based on multiple index values ​​corresponding to the multiple communication indicators under each single communication mode; determining the index weighting value under each single communication mode based on the multiple index values ​​corresponding to the multiple communication indicators and the multiple weights corresponding to the multiple communication indicators under each single communication mode; and determining the index weighting value under each combined communication mode based on the multiple index values ​​corresponding to the multiple communication indicators and the multiple weights corresponding to the multiple communication indicators under each combined communication mode.

[0552] Standardized Performance Scoring: Before calculating the comprehensive evaluation value, the original scores of each scheme under different criteria need to be standardized. This involves converting indicators with different dimensions (such as bandwidth and latency) to the same dimension for comparison. In other words, the original scores of each scheme need to be standardized. The standardization formula is:

[0553] ,

[0554] Where, xkj It is the original score of the k-th scheme on the j-th criteria, min(x j ) and max(x j P represents the minimum and maximum values ​​of the j-th criterion among all possible solutions. kj It is the standardized score of the k-th scheme on the j-th criterion, with a value range of [0,1].

[0555] Calculation of overall evaluation value:

[0556] Overall evaluation value V k It is obtained by multiplying the weight vector W by the standardized performance score. The specific formula for the comprehensive evaluation value is:

[0557] ,

[0558] Among them, V k w is the comprehensive evaluation value of the k-th scheme. i P is the weight of the i-th criterion. ik It is the standardized score of the k-th scheme on the i-th criterion, and the scheme with the highest comprehensive evaluation value is finally selected as the optimal routing path.

[0559] Based on the weight vector W and the performance scores of each scheme on each criterion, calculate the comprehensive score V for each scheme. k .

[0560] ① Single communication method

[0561] For a single communication method (WAPI, LoRa, 4G), the performance score of each communication method is standardized to the [0,1] range. This method is simple, intuitive, and easy to implement.

[0562] Based on the normalization formula, the standardized performance scores are shown in Table 4 below.

[0563] Table 4 Standardized performance scores

[0564]

[0565] Calculate the overall score for each option:

[0566] V WAPI =0.300×1.000+0.200×0.667+0.200×0.667+0.200×1.000+0.100 ×0.667=0.867;

[0567] V LoRa=0.300×0.000+0.200×0.000+0.200×1.000+0.200×0.500+0.100 ×0.000=0.300;

[0568] V 4G =0.300×0.200+0.200×0.333+0.200×0.333+0.200×0.833+0.100 ×0.333=0.467.

[0569] ② Combined communication method

[0570] For combined communication methods (WAPI+LoRa, WAPI+4G, LoRa+4G, WAPI+LoRa+4G), it can be assumed that the combined performance score is a weighted average of the individual communication methods. To more accurately reflect the performance of the combined communication methods, the following method is adopted: bandwidth (B) is set to the maximum value, latency (D) is set to the minimum value, packet loss rate (P) is set to the minimum value, security (S) is set to the maximum value, and network load (L) is set to the minimum value. The combined performance score is assumed to be as shown in Table 5 below.

[0571] Table 5 Performance scores after combination

[0572]

[0573] The standardized performance scores based on the formula are shown in Table 6 below.

[0574] Table 6 Standardized Performance Scores

[0575]

[0576] Calculate the overall score for each combination scheme:

[0577] V WAPI+LoRa =0.300×1.000+0.200×0.667+0.200×1.000+0.200×1.000+0.100 ×0.000=0.933;

[0578] V WAPI+4G =0.300×1.000+0.200×0.667+0.200×0.667+0.200×1.000+0.100 ×0.333=0.867;

[0579] V LoRa+4G =0.300×0.200+0.200×0.333+0.200×1.000+0.200×0.833+0.100×0.000=0.533;

[0580] VWAPI+LoRa+4G =0.300×1.000+0.200×0.667+0.200×1.000+0.200×1.000+0.100×0.000 =0.933.

[0581] The calculation results above show that: for single communication methods, WAPI has the highest overall score of 0.867; for combined communication methods, WAPI+LoRa and WAPI+LoRa+4G both have an overall score of 0.933, making them the optimal choices.

[0582] Therefore, in specific scenarios, if a single communication method is chosen, WAPI is the optimal choice; if a combination of communication methods is chosen, WAPI+LoRa and WAPI+LoRa+4G are both optimal choices.

[0583] The above embodiments 27 to 29 can be executed by an AP or a STA. For example, when the AP needs to send information to the STA, the AP executes the above dynamic routing switching process; when the STA needs to send information to the AP, the STA executes the above dynamic routing switching process.

[0584] The multimodal communication system described in this invention has multi-protocol communication conversion capabilities, and can handle the conversion and adaptation between local broadband communication, local narrowband communication and remote broadband communication protocols, supporting the interconnection and data exchange of the three.

[0585] In summary, the intelligent routing algorithm based on fuzzy hierarchical analysis comprehensively considers multiple factors such as bandwidth, latency, packet loss rate, security, and network load, and dynamically and adaptively switches routes.

[0586] Addressing the unique communication needs of remote control platforms and operational equipment in complex electromagnetic environments, this invention proposes a multimodal communication data security access and fusion networking method, device, and system. This ensures the secure, orderly, and efficient transmission of video, images, and interactive commands during equipment operation. The proposed multimodal communication data security access and fusion networking method, device, and system employ a fusion networking approach combining local broadband, local narrowband, and long-range broadband communication modes to meet the needs of various application scenarios in power distribution networks, improving work efficiency and reducing investment costs. Combined with the security module, it ensures the legitimacy of the remote control platform and allows switching between different control platforms, making the system more flexible.

[0587] Example 30

[0588] The multimodal communication system proposed in this embodiment can perform the following four processes: connection establishment, authentication, key negotiation, and converged communication, such as... Figure 8 As shown.

[0589] The above embodiments can be applied to Figure 2 The multimodal communication system shown.

[0590] Example 31

[0591] An embodiment of the present invention provides an access point (AP), the AP comprising: an execution device for executing the authentication method, the key negotiation method, or the dynamic routing switching method.

[0592] Example 32

[0593] One embodiment of the present invention provides a STA, the STA comprising: an execution device for executing the authentication method or the dynamic routing switching method.

[0594] Example 33

[0595] An embodiment of the present invention provides an identity authentication system applied to an Access Point (AP). The identity authentication system includes: a first forwarding device for forwarding an initial response message corresponding to a local authentication request from a Station (STA) to a security module; a first receiving device for receiving a first response code generated by the security module based on the AP private key and the STA identifier in the initial response message, wherein the AP private key is stored in the security module; a second forwarding device for forwarding the first response code to the STA, so that the STA generates a second response code based on the first response code and the STA identifier and sends a final response message, wherein the final response message includes the second response code and the STA identifier; a second receiving device for receiving the final response message; a first generating device for generating a verification response code based on the first response code and the STA identifier in the final response message; and a determining device for determining that the STA's identity authentication is successful if the second response code matches the verification response code.

[0596] Optionally, the final response message may also include a first STA ciphertext and a first HMAC generated by the STA.

[0597] Accordingly, the identity authentication system further includes: a second generation device, used to generate a local verification HMAC based on the AP private key, the first STA ciphertext in the final response message and the AP identifier; and a first confirmation device, used to confirm whether the local verification HMAC is consistent with the first HMAC generated by the STA in the final response message.

[0598] The step of generating the verification response code is performed if the local verification HMAC matches the first HMAC generated by the STA in the final response message.

[0599] Optionally, the identity authentication system further includes: a third receiving device, configured to receive the initial response message from the STA, wherein the initial response message includes an AP identifier, a STA identifier, a first STA ciphertext, and a first HMAC generated by the STA; and a first verification device, configured to verify whether the AP identifier in the initial response message is consistent with the AP identifier in the local authentication request.

[0600] Accordingly, the step of forwarding the initial response message corresponding to the local authentication request from the STA to the security module is performed if the AP identifier in the initial response message matches the AP identifier in the local authentication request.

[0601] Optionally, while or after forwarding the initial response message corresponding to the local authentication request from the STA to the security module, the identity authentication system further includes: a retention device for retaining the STA identifier in the initial response message; and a second verification device for verifying whether the STA identifier in the final response message is consistent with the STA identifier in the initial response message.

[0602] The step of generating the local verification HMAC is performed if the STA identifier in the final response message matches the STA identifier in the initial response message.

[0603] Optionally, the identity authentication system further includes: a first sending device, configured to send the local authentication request so that the STA generates a first HMAC based on the AP identifier in the local authentication request and a first random number generated by the STA, and the STA sends the initial response message, wherein the initial response message includes the first HMAC generated by the STA, the local authentication request further includes the AP public key, and the first STA ciphertext is generated based on the AP public key and the first random number generated by the STA.

[0604] Accordingly, the second generation device includes: a decoding unit, configured to decrypt the first STA ciphertext in the final response message based on the AP private key to obtain a random number; and a first generation unit, configured to generate the local verification HMAC based on the obtained random number and the AP identifier in the final response message.

[0605] Optionally, when the security module generates the first response code based on the AP private key and the first STA ciphertext, STA identifier, AP's first timestamp and STA's first timestamp in the initial response message, the second response code is generated by the STA based on the first response code, the STA identifier stored locally by the STA and the STA's second timestamp.

[0606] Accordingly, the first generating device includes: a first confirmation unit, configured to confirm whether the second timestamp of the STA in the second response code is within a first preset time range; and a second generating unit, configured to generate the verification response code based on the first response code and the STA identifier and the second timestamp of the STA in the final response message if the second timestamp is within the first preset time range.

[0607] Optionally, the sending device is used to send the local authentication request, wherein the local authentication request includes an AP identifier, an AP public key, and the AP's first timestamp, so that the STA generates the first HMAC based on the STA key, a first random number generated by the STA, and the AP identifier and the AP's first timestamp in the local authentication request, and sends the initial response message.

[0608] Accordingly, the first forwarding device includes: a second confirmation unit, configured to confirm whether the first timestamp of the STA is within a second preset time range if the AP identifier and the first timestamp of the AP in the initial response message are consistent with the AP identifier and the first timestamp of the AP in the local authentication request; and a forwarding unit, configured to retain the first timestamp of the STA and the STA identifier in the initial response message if the first timestamp of the STA is within the second preset time range, and forward the initial response message and the first timestamp of the AP to the security module, so that the security module generates a first response code based on the AP private key, the first STA ciphertext in the initial response message, the first timestamp of the STA and the STA identifier, and the first timestamp of the AP, and sends the first response code to the AP.

[0609] Optionally, the identity authentication system further includes: a second sending device, configured to send a remote authentication request to the AS, wherein the remote authentication request includes: a first STA ciphertext, an STA identifier, a first HMAC generated by the STA, and an AP identifier, so that the AS generates a remote verification HMAC based on the STA public key and the first STA ciphertext and AP identifier in the remote authentication request, and the AS confirms that the STA's identity authentication is successful if the remote verification HMAC matches the first HMAC generated by the STA.

[0610] Optionally, the identity authentication system further includes: a second sending device, configured to send a remote authentication request to the AS, wherein the remote authentication request includes: a first STA ciphertext, an STA identifier, a first HMAC generated by the STA, an AP identifier, and a second timestamp of the STA, so that the AS generates a remote verification HMAC based on the STA public key and the first STA ciphertext and AP identifier in the remote authentication request, and confirms that the STA's identity authentication is successful if the remote verification HMAC is consistent with the first HMAC generated by the STA and the second timestamp of the STA is within a first preset time range.

[0611] Optionally, the identity authentication system further includes: a fourth receiving device, configured to receive a secondary authentication message from the AS, wherein the secondary authentication message includes: a first AP ciphertext, an AP identifier, and an HMAC about the AP generated by the AS; a decryption device, configured to decrypt the first AP ciphertext based on the AP private key to obtain an AS random number; a third generating device, configured to generate a first AS verification HMAC based on the AS random number and the AP identifier in the secondary authentication message; and a second confirmation device, configured to confirm successful signature verification of the AS if the first AS verification HMAC is consistent with the HMAC about the AP and the AP identifier in the secondary authentication message is consistent with the AP identifier stored locally by the AP.

[0612] Optionally, the identity authentication system further includes: a second sending device, configured to send a remote authentication request to the AS, wherein the remote authentication request includes: an STA identifier, an HMAC generated by the AP, a random number generated by the AP, and a second timestamp of the AP, so that the AS generates a remote verification HMAC based on the STA identifier in the remote authentication request and the second timestamp of the AP, and the AS confirms that the AP's identity authentication is successful if the remote verification HMAC is consistent with the HMAC generated by the AP.

[0613] Optionally, the identity authentication system further includes: a fourth receiving device, configured to receive a secondary authentication message from the AS, wherein the secondary authentication message includes: a first AP ciphertext, an AP identifier, an HMAC generated by the AS regarding the AP, an AS timestamp, and a second timestamp of the AP; a decryption device, configured to decrypt the first AP ciphertext based on the AP private key to obtain an AS random number; a third generating device, configured to generate a first AS verification HMAC based on the AS random number, the AP identifier, and the AS timestamp; and a second confirmation device, configured to confirm successful signature verification of the AS if the first AS verification HMAC matches the HMAC regarding the AP, the AP identifier in the secondary authentication message matches the AP identifier stored locally by the AP, and the second timestamp of the AP in the secondary authentication message matches the second timestamp of the AP in the remote authentication request.

[0614] Example 34

[0615] An embodiment of the present invention provides an identity authentication system applied to a STA (Station). The identity authentication system includes: a first sending device, configured to send an initial response message corresponding to a local authentication request to an AP (Access Point), so that the AP forwards the initial response message to a security module, wherein the initial response message includes an STA identifier, and the security module generates a first response code based on the AP private key and the STA identifier in the initial response message and sends the first response code to the AP, wherein the AP private key is stored in the security module; a first receiving device, configured to receive the first response code forwarded by the AP; a first generating device, configured to generate a second response code based on the first response code and the STA identifier stored locally by the STA; and a second sending device, configured to send a final response message to the AP, so that the AP generates a verification response code based on the first response code and the STA identifier in the final response message, and determines that the STA's identity authentication is successful if the second response code in the final response message matches the verification response code.

[0616] Optionally, the final response message further includes a first STA ciphertext and a first HMAC generated by the STA, which is executed by the AP to: generate a local verification HMAC based on the AP private key, the first STA ciphertext in the final response message, and the AP identifier; and confirm whether the local verification HMAC is consistent with the first HMAC generated by the STA in the final response message.

[0617] Accordingly, the step of generating the verification response code is performed if the local verification HMAC matches the first HMAC generated by the STA in the final response message.

[0618] Optionally, the identity authentication system further includes: a second receiving device for receiving the local authentication request; a third sending device for generating a first HMAC based on the AP identifier in the local authentication request and a first random number generated by the STA, and sending the initial response message, wherein the initial response message includes the first HMAC generated by the STA and the local authentication request includes the AP public key; and a second generating device for generating the first STA ciphertext based on the AP public key and the first random number generated by the STA.

[0619] Accordingly, based on the AP private key, the first STA ciphertext in the final response message and the AP identifier, a local verification HMAC is generated, including: decrypting the first STA ciphertext in the final response message based on the AP private key to obtain a random number; and generating the local verification HMAC based on the obtained random number and the AP identifier in the final response message.

[0620] Optionally, when the security module generates the first response code based on the AP private key and the first STA ciphertext, STA identifier, AP's first timestamp, and STA's first timestamp in the initial response message, the first generating device is used to generate a second response code based on the first response code and the STA identifier stored locally by the STA, which includes generating the second response code based on the first response code, the STA identifier stored locally by the STA, and the STA's second timestamp.

[0621] Accordingly, generating a verification response code based on the first response code and the STA identifier in the final response message includes: confirming whether the second timestamp of the STA in the second response code is within a first preset time range; and if the second timestamp is within the first preset time range, generating the verification response code based on the first response code and the STA identifier and the second timestamp of the STA in the final response message.

[0622] Optionally, the identity authentication system further includes: a second receiving device, configured to receive the local authentication request, wherein the local authentication request includes the AP identifier, the AP public key, and the first timestamp of the AP; and a third sending device, configured to generate a first HMAC based on the STA key and the first random number generated by the STA in the local authentication request, the AP identifier, and the first timestamp of the AP, and send the initial response message, wherein the initial response message includes the first HMAC generated by the STA.

[0623] Accordingly, forwarding the initial response message to the security module includes: if the AP identifier and the first timestamp of the AP in the initial response message are consistent with the AP identifier and the first timestamp of the AP in the local authentication request, confirming whether the first timestamp of the STA is within a second preset time range; and if the first timestamp of the STA is within the second preset time range, retaining the first timestamp and STA identifier of the STA in the initial response message, and forwarding the initial response message and the first timestamp of the AP to the security module, so that the security module can generate a first response code based on the AP private key, the first STA ciphertext, the first timestamp and STA identifier of the STA in the initial response message, and the first timestamp of the AP, and send the first response code to the AP.

[0624] Optionally, the identity authentication system further includes: a third receiving device, configured to receive a secondary authentication message forwarded from the AP, wherein the secondary authentication message includes: AS ciphertext, STA identifier, and HMAC generated by the AS regarding the STA; a decryption device, configured to decrypt the AS ciphertext based on the STA public key to obtain an AS random number; a third generating device, configured to generate a second AS verification HMAC based on the AS random number and the STA identifier in the secondary authentication message; and a confirmation device, configured to confirm successful signature verification of the AS if the second AS verification HMAC matches the HMAC generated by the AS regarding the STA and the STA identifier in the secondary authentication message matches the STA identifier stored locally by the STA.

[0625] Optionally, the identity authentication system further includes: a third receiving device, configured to receive a secondary authentication message forwarded from the AP, wherein the secondary authentication message includes: AS ciphertext, STA identifier, HMAC generated by the AS about the STA, and AS timestamp; a decryption device, configured to decrypt the AS ciphertext based on the STA public key to obtain an AS random number; a third generating device, configured to generate a second AS verification HMAC based on the AS random number, the STA identifier in the secondary authentication message, and the AS timestamp; and a confirmation device, configured to confirm successful signature verification of the AS if the second AS verification HMAC is consistent with the HMAC generated by the AS about the STA and the STA identifier in the secondary authentication message is consistent with the STA identifier stored locally by the STA.

[0626] Example 35

[0627] An embodiment of the present invention provides a key negotiation system applied to an Access Point (AP). The key negotiation system includes: an authentication system for performing identity authentication; a forwarding device for forwarding key information corresponding to a key negotiation request from a Standby STA to a security module, wherein the security module performs the following actions: generating a session key based on a second random number generated by the STA and a random number generated by the AP; generating a negotiation response code based on the session key, a second STA ciphertext in the key information, and an STA identifier, and sending a response message to the AP, wherein the response message includes the negotiation response code and the STA identifier; a generation device for generating a negotiation verification code based on the session key, the second STA ciphertext, and the STA identifier in the response message in response to receiving the response message; and a confirmation device for confirming successful key negotiation if the negotiation response code and the negotiation verification code match.

[0628] Optionally, the key negotiation system further includes: a first sending device for sending the key negotiation request, wherein the key negotiation request includes an AP public key, and the STA generates key material based on a second random number generated by the STA and encrypts the key material using the AP public key to generate the second STA ciphertext.

[0629] Optionally, the key negotiation system further includes: an encryption device for encrypting a combination formed by a fixed string, an AP identifier, and an STA identifier in the key information using the session key to generate a key confirmation code; and a second sending device for sending the key confirmation message to the STA, wherein the key confirmation message includes the key confirmation code, the AP identifier, and the STA identifier, so that the STA generates a key verification code based on the session key, the AP identifier and the STA identifier in the key confirmation message, and the fixed string, and confirms that the key negotiation is successful if the key confirmation code matches the key verification code.

[0630] Optionally, the key information further includes the third timestamp of the AP and the third timestamp of the STA; the session key is generated based on the second random number generated by the STA, the random number generated by the AP, and the third timestamp of the STA and the third timestamp of the AP in the key information; and the negotiation response code is generated based on the session key, the second STA ciphertext, the STA identifier, and the third timestamp of the STA and the third timestamp of the AP in the key information; the response message includes the negotiation response code, the STA identifier, the third timestamp of the STA, and the third timestamp of the AP.

[0631] Accordingly, generating the negotiation response code includes: in response to receiving the response message, generating the negotiation verification code based on the session key, the second STA ciphertext, the STA identifier in the response message, the third timestamp generated by the STA, and the third timestamp of the AP.

[0632] Optionally, the key negotiation system further includes: a first sending device, configured to send the key negotiation request, wherein the key negotiation request includes the AP public key and the AP's third timestamp, so that the STA generates key material based on the second random number generated by the STA and the third timestamp generated by the STA, and encrypts the key material using the AP public key to generate the second STA ciphertext.

[0633] Optionally, the key negotiation system further includes: an encryption device, used to encrypt a fixed string, an AP identifier, and a combination of the STA identifier, the third timestamp generated by the STA, and the third timestamp of the AP in the key information using the session key, to generate a key confirmation code; and a second sending device, used to send a key confirmation message to the STA, wherein the key confirmation message includes the key confirmation code, the AP identifier, the STA identifier, the third timestamp generated by the STA, and the third timestamp of the AP, so that the STA can generate a key verification code based on the key confirmation code, the AP identifier, the STA identifier, the third timestamp generated by the STA, the third timestamp of the AP, and the fixed string in the key confirmation message, and confirm that the key negotiation is successful if the key confirmation code matches the key verification code.

[0634] Optionally, the key information further includes a second HMAC generated by the STA, and the security module performs the following: decrypting the second STA ciphertext using the STA public key to obtain key material; generating an HMAC for the STA based on the key material, the STA public key, and the AP identifier; and generating a session key based on a second random number generated by the STA and a random number generated by the AP if the HMAC for the STA is consistent with the second HMAC generated by the STA.

[0635] Example 36

[0636] An embodiment of the present invention provides a dynamic routing switching system, the switching system comprising: a key negotiation system for performing key negotiation; a first determining device for determining multiple weights corresponding to multiple communication indicators based on a fuzzy consistency matrix; a second determining device for determining the indicator weighting value of each single communication mode and the indicator weighting value of each combined communication mode based on multiple indicator values ​​and multiple weights corresponding to the multiple communication indicators in a single communication mode among multiple communication modes; and a selection device for adaptively selecting the single communication mode or the combined communication mode corresponding to the maximum indicator weighting value according to a specific scenario.

[0637] Optionally, the second determining device includes: a first determining unit, configured to determine multiple indicator values ​​corresponding to the multiple communication indicators in each combined communication mode based on multiple indicator values ​​corresponding to the multiple communication indicators in a single communication mode among multiple communication modes; a second determining unit, configured to determine an indicator weighted value in each single communication mode based on the multiple indicator values ​​corresponding to the multiple communication indicators in a single communication mode among multiple communication modes and multiple weights corresponding to the multiple communication indicators; and a third determining unit, configured to determine an indicator weighted value in each combined communication mode based on the multiple indicator values ​​corresponding to the multiple communication indicators in each combined communication mode and multiple weights corresponding to the multiple communication indicators.

[0638] Optionally, the third determining unit, for determining multiple weights corresponding to multiple communication indicators, includes: transforming the fuzzy consistency matrix to obtain a fuzzy complementary judgment matrix; normalizing the fuzzy complementary judgment matrix to obtain a normalized matrix; determining the eigenvector corresponding to the largest eigenvalue based on the normalized matrix; and determining multiple elements in the eigenvector corresponding to the multiple communication indicators as multiple weights corresponding to the multiple communication indicators.

[0639] Example 37

[0640] One embodiment of the present invention provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the authentication method, the key negotiation method, or the dynamic routing switching method.

[0641] The preferred embodiments of the present invention have been described in detail above with reference to the accompanying drawings. However, the present invention is not limited to the specific details of the above embodiments. Within the scope of the technical concept of the present invention, various simple modifications can be made to the technical solution of the present invention, and these simple modifications all fall within the protection scope of the present invention.

[0642] It should also be noted that the various specific technical features described in the above specific embodiments can be combined in any suitable manner without contradiction. In order to avoid unnecessary repetition, the present invention will not describe the various possible combinations separately.

[0643] Those skilled in the art will understand that all or part of the steps in the methods of the above embodiments can be implemented by a program instructing related hardware. This program is stored in a storage medium and includes several instructions to cause a microcontroller, chip, or processor to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as a USB flash drive, a portable hard drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0644] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0645] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0646] Furthermore, various different embodiments of the present invention can be combined in any way, as long as they do not violate the spirit of the present invention, they should also be regarded as the content disclosed by the present invention.

Claims

1. An identity authentication method, characterized by, The identity authentication method applied to the AP comprises: forwarding an initial response message corresponding to the local authentication request from the STA to a security module; receiving a first response code generated by the security module based on an AP private key and a STA identifier in the initial response message, wherein the AP private key is stored in the security module; forwarding the first response code to the STA, so that a second response code is generated by the STA based on the first response code and the STA identifier and a final response message is sent, wherein the final response message comprises the second response code and the STA identifier; receiving the final response message; generating a verification response code based on the first response code and the STA identifier in the final response message; and determining that the identity authentication of the STA is successful in the case that the second response code is consistent with the verification response code.

2. The identity authentication method of claim 1, wherein, The final response message further comprises a first STA cipher text and a first HMAC generated by the STA, wherein HMAC is a hash-based message authentication code, The identity authentication method further comprises: generating a local verification HMAC based on the AP private key, the first STA cipher text in the final response message and an AP identifier; and confirming whether the local verification HMAC is consistent with the first HMAC generated by the STA, The step of generating the verification response code is executed in the case that the local verification HMAC is consistent with the first HMAC generated by the STA.

3. The identity authentication method of claim 2, wherein, The identity authentication method further comprises: receiving the initial response message from the STA, wherein the initial response message comprises an AP identifier, a STA identifier, a first STA cipher text and a first HMAC generated by the STA; and verifying whether the AP identifier in the initial response message is consistent with the AP identifier in the local authentication request, The step of forwarding the initial response message corresponding to the local authentication request from the STA to the security module is executed in the case that the AP identifier in the initial response message is consistent with the AP identifier in the local authentication request.

4. The identity authentication method of claim 2, wherein, The identity authentication method further comprises: reserving the STA identifier in the initial response message; verifying whether the STA identifier in the final response message is consistent with the STA identifier in the initial response message, The step of generating the local verification HMAC is executed in the case that the STA identifier in the final response message is consistent with the STA identifier in the initial response message.

5. The identity authentication method of claim 2, wherein, The identity authentication method further comprises: sending the local authentication request, so as to generate, by the STA, the first HMAC based on the AP identifier in the local authentication request and a first random number generated by the STA, and send, by the STA, the initial response message, wherein the initial response message comprises the first HMAC generated by the STA, the local authentication request further comprises an AP public key, and the first STA cipher text is generated based on the AP public key and the first random number generated by the STA, the generating the local verification HMAC comprises: decrypting the first STA cipher text in the final response message based on the AP private key to obtain a random number; and generating the local verification HMAC based on the obtained random number and the AP identifier in the final response message.

6. The identity authentication method of claim 5, wherein, in a case where the security module generates the first response code based on the AP private key and the first STA cipher text, the STA identifier, the first time stamp of the AP and the first time stamp of the STA in the initial response message, the second response code is generated, by the STA, based on the first response code, the STA identifier locally stored by the STA and the second time stamp of the STA, the generating the verification response code comprises: confirming whether the second time stamp of the STA in the second response code is within a first preset time range; and in a case where the second time stamp is within the first preset time range, generating the verification response code based on the first response code and the STA identifier and the second time stamp of the STA in the final response message.

7. The identity authentication method of claim 6, wherein, the identity authentication method further comprises: sending the local authentication request, wherein the local authentication request comprises an AP identifier, an AP public key and a first time stamp of an AP, so as to generate, by the STA, the first HMAC based on a STA key, a first random number generated by the STA and the AP identifier and the first time stamp of the AP in the local authentication request, and send the initial response message, the forwarding the initial response message corresponding to the local authentication request from the STA to the security module comprises: in a case where the AP identifier and the first time stamp of the AP in the initial response message are consistent with the AP identifier and the first time stamp of the AP in the local authentication request respectively, confirming whether the first time stamp of the STA is within a second preset time range; and in a case where the first time stamp of the STA is within the second preset time range, retaining the first time stamp of the STA and the STA identifier in the initial response message, and forwarding the initial response message and the first time stamp of the AP to the security module, so as to generate, by the security module, the first response code based on the AP private key, the first STA cipher text in the initial response message, the first time stamp of the STA and the STA identifier and the first time stamp of the AP, and send the first response code to the AP.

8. The identity authentication method of any one of claims 2-7, wherein, the identity authentication method further comprises: sending a remote authentication request to an AS, wherein the remote authentication request comprises: first STA ciphertext, STA identifier, first HMAC generated by the STA, and AP identifier, so as to generate a remote verification HMAC by the AS based on the STA public key and the first STA ciphertext and the AP identifier in the remote authentication request, and to confirm that the identity authentication of the STA is successful in a case that the remote verification HMAC is consistent with the first HMAC generated by the STA.

9. The identity authentication method of claim 6 or 7, wherein, The identity authentication method further comprises: sending a remote authentication request to an AS, wherein the remote authentication request comprises: first STA ciphertext, STA identifier, first HMAC generated by the STA, and AP identifier and second time stamp of the STA, so as to generate a remote verification HMAC by the AS based on the STA public key and the first STA ciphertext and the AP identifier in the remote authentication request, and to confirm that the identity authentication of the STA is successful in a case that the remote verification HMAC is consistent with the first HMAC generated by the STA and the second time stamp of the STA is within a first preset time range.

10. The identity authentication method of any one of claims 1-7, wherein, The identity authentication method further comprises: receiving a second authentication message from the AS, wherein the second authentication message comprises: first AP ciphertext, AP identifier, and HMAC about the AP generated by the AS, wherein HMAC is a hash-based message authentication code; decrypting the first AP ciphertext based on the AP private key to obtain an AS random number; generating a first AS verification HMAC based on the AS random number and the AP identifier in the second authentication message; confirming that the signature verification of the AS is successful in a case that the first AS verification HMAC is consistent with the HMAC about the AP and the AP identifier in the second authentication message is consistent with the AP identifier stored locally by the AP.

11. The identity authentication method of any one of claims 1-7, wherein, The identity authentication method further comprises: sending a remote authentication request to an AS, wherein the remote authentication request comprises: STA identifier, HMAC generated by the AP, random number generated by the AP, and second time stamp of the AP, so as to generate a remote verification HMAC by the AS based on the STA identifier and the second time stamp of the AP in the remote authentication request, and to confirm that the identity authentication of the AP is successful in a case that the remote verification HMAC is consistent with the HMAC generated by the AP; wherein HMAC is a hash-based message authentication code.

12. The identity authentication method of claim 11, wherein, The identity authentication method further comprises: receiving a second authentication message from the AS, wherein the second authentication message comprises: first AP ciphertext, AP identifier, HMAC about the AP generated by the AS, AS time stamp, and second time stamp of the AP; decrypting the first AP ciphertext based on the AP private key to obtain an AS random number; generating a first AS verification HMAC based on the AS random number, the AP identifier, and the AS time stamp; and In a case that the first AS verifies that the HMAC is consistent with the HMAC about the AP, the AP identification in the second authentication message is consistent with the AP identification stored locally by the AP, and the second time stamp of the AP in the second authentication message is consistent with the second time stamp of the AP in the remote authentication request, it is confirmed that the signature verification of the AS is successful.

13. An identity authentication method characterized by, The identity authentication method applied to the STA comprises: sending an initial response message corresponding to the local authentication request to the AP, so as to forward the initial response message to a security module by the AP, wherein the initial response message comprises a STA identification, the security module generates a first response code based on an AP private key, the STA identification in the initial response message, and sends the first response code to the AP, wherein the AP private key is stored in the security module; receiving the first response code forwarded via the AP; generating a second response code based on the first response code and the STA identification stored locally by the STA; and sending a final response message to the AP, so as to generate a verification response code based on the first response code and the STA identification in the final response message by the AP, and determine that the identity authentication of the STA is successful in a case that the second response code in the final response message is consistent with the verification response code.

14. The identity authentication method of claim 13, wherein, The final response message further comprises a first STA cipher text and a first HMAC generated by the STA, wherein HMAC is a hash-based message authentication code, the AP performs: generating a local verification HMAC based on the AP private key, the first STA cipher text in the final response message, and the AP identification; and confirming whether the local verification HMAC is consistent with the first HMAC generated by the STA in the final response message, the step of generating the verification response code is performed in a case that the local verification HMAC is consistent with the first HMAC generated by the STA in the final response message.

15. The identity authentication method of claim 14, wherein, The identity authentication method further comprises: receiving the local authentication request; generating a first HMAC based on the AP identification in the local authentication request and a first random number generated by the STA, and sending the initial response message, wherein the initial response message comprises the first HMAC generated by the STA, and the local authentication request comprises an AP public key; and generating the first STA cipher text based on the AP public key and the first random number generated by the STA, generating a local verification HMAC based on the AP private key, the first STA cipher text in the final response message, and the AP identification, comprising: decrypting the first STA cipher text in the final response message based on the AP private key to obtain a random number; and generating the local verification HMAC based on the obtained random number and the AP identification in the final response message.

16. The identity authentication method of claim 14, wherein, In a case that the security module generates the first response code based on the AP private key and the first STA cipher text, the STA identity, the first time stamp of the AP and the first time stamp of the STA in the initial response message, the generating the second response code based on the first response code and the STA identity locally stored by the STA comprises: generating the second response code based on the first response code, the STA identity locally stored by the STA and the second time stamp of the STA, The generating the verification response code based on the first response code and the STA identity in the final response message comprises: confirming whether the second time stamp of the STA in the second response code is within a first preset time range; and In a case that the second time stamp is within the first preset time range, generating the verification response code based on the first response code and the STA identity and the second time stamp of the STA in the final response message.

17. The identity authentication method of claim 16, wherein, The identity authentication method further comprises: receiving the local authentication request, wherein the local authentication request comprises the AP identity, the AP public key and the first time stamp of the AP; generating a first HMAC based on the STA key and the first random number generated by the STA, the AP identity and the first time stamp of the AP in the local authentication request and sending the initial response message, wherein the initial response message comprises the first HMAC generated by the STA, forwarding the initial response message to the security module comprises: In a case that the AP identity and the first time stamp of the AP in the initial response message are consistent with the AP identity and the first time stamp of the AP in the local authentication request respectively, confirming whether the first time stamp of the STA is within a second preset time range; and In a case that the first time stamp of the STA is within the second preset time range, reserving the first time stamp of the STA and the STA identity in the initial response message and forwarding the initial response message and the first time stamp of the AP to the security module, so that the security module generates a first response code based on the AP private key and the first STA cipher text, the first time stamp of the STA and the STA identity and the first time stamp of the AP in the initial response message and sends the first response code to the AP.

18. The identity authentication method of any one of claims 13-17, wherein, The identity authentication method further comprises: receiving the secondary authentication message forwarded by the AP, wherein the secondary authentication message comprises: AS cipher text, STA identity, HMAC generated by the AS about the STA, wherein HMAC is a hash-based message authentication code; decrypting the AS cipher text based on the STA public key to obtain an AS random number; generating a second AS verification HMAC based on the AS random number and the STA identity in the secondary authentication message; In a case that the second AS verification HMAC is consistent with the HMAC generated by the AS about the STA and the STA identity in the secondary authentication message is consistent with the STA identity locally stored by the STA, confirming that the signature verification of the AS is successful.

19. The identity authentication method of any one of claims 13-17, wherein, The identity authentication method further comprises: receiving a secondary authentication message forwarded from the AP, wherein the secondary authentication message comprises: an AS ciphertext, a STA identifier, an HMAC about the STA generated by the AS, and an AS timestamp, wherein the HMAC is a hash-based message authentication code; decrypting the AS ciphertext based on a STA public key to obtain an AS random number; generating a second AS verification HMAC based on the AS random number, the STA identifier in the secondary authentication message, and the AS timestamp; and in a case where the second AS verification HMAC is consistent with the HMAC about the STA generated by the AS and the STA identifier in the secondary authentication message is consistent with a STA identifier locally stored by the STA, confirming that signature verification of the AS is successful.

20. A method of key agreement, characterized by, The key agreement method applied to the AP comprises: performing identity authentication according to the identity authentication method in any one of claims 1-12; forwarding key information corresponding to a key agreement request from the STA to a security module to perform, by the security module: generating a session key based on a second random number generated by the STA and a random number generated by the AP, generating a negotiation response code based on the session key, a second STA ciphertext, and a STA identifier in the key information, and sending a response message to the AP, wherein the response message comprises the negotiation response code and the STA identifier; in response to receiving the response message, generating a negotiation verification code based on the session key, the second STA ciphertext, and the STA identifier in the response message; and in a case where the negotiation response code is consistent with the negotiation verification code, confirming that key agreement is successful.

21. The key agreement method of claim 20, wherein, The key agreement method further comprises: sending the key agreement request, wherein the key agreement request comprises an AP public key to enable the STA to generate key material based on a second random number generated by the STA and to encrypt the key material using the AP public key to generate the second STA ciphertext.

22. The key agreement method according to claim 20 or 21, characterized in that, The key agreement method further comprises: encrypting a combination of a fixed string, an AP identifier, and a STA identifier in the key information using the session key to generate a key confirmation code; and sending a key confirmation message to the STA, wherein the key confirmation message comprises the key confirmation code, the AP identifier, and the STA identifier to enable the STA to generate a key verification code based on the session key, the AP identifier and the STA identifier in the key confirmation message, and the fixed string, and to confirm that key agreement is successful in a case where the key confirmation code is consistent with the key verification code.

23. The key agreement method of claim 20, wherein, The key information further comprises a third timestamp of the AP and a third timestamp of the STA, the session key is generated based on a second random number generated by the STA, a random number generated by the AP, and a third time stamp of the STA and a third time stamp of the AP in the key information, and the negotiation response code is generated based on the session key, the second STA cipher text, the STA identifier, and the third time stamp of the STA and the third time stamp of the AP in the key information, the response message includes the negotiation response code, the STA identifier, the third time stamp of the STA, and the third time stamp of the AP, the generating of the negotiation response code includes: in response to receiving the response message, generating the negotiation verification code based on the session key, the second STA cipher text, the STA identifier in the response message, the third time stamp of the STA, and the third time stamp of the AP.

24. The key agreement method of claim 23, wherein, The key negotiation method further includes: sending the key negotiation request, wherein the key negotiation request includes an AP public key and a third time stamp of the AP, so that the STA generates key material based on a second random number generated by the STA and a third time stamp generated by the STA, and encrypts the key material using the AP public key to generate the second STA cipher text.

25. The key agreement method according to claim 23 or 24, characterized in that, The key negotiation method further includes: encrypting a combination of a fixed string, an AP identifier, and the STA identifier, the third time stamp of the STA, and the third time stamp of the AP in the key information using the session key to generate a key confirmation code; and sending a key confirmation message to the STA, wherein the key confirmation message includes the key confirmation code, the AP identifier, the STA identifier, the third time stamp of the STA, and the third time stamp of the AP, so that the STA generates a key verification code based on the key confirmation code, the AP identifier, the STA identifier, the third time stamp of the STA, the third time stamp of the AP in the key confirmation message, and the fixed string, and confirms the key negotiation to be successful if the key confirmation code and the key verification code are consistent.

26. The key agreement method according to any one of claims 20-21, 23-24, wherein, The key information further includes a second HMAC generated by the STA, wherein HMAC is a hash-based message authentication code, the security module decrypts the second STA cipher text using a STA public key to obtain key material, generates an HMAC for the STA based on the key material, the STA public key, and the AP identifier, and generates a session key based on the second random number generated by the STA and the random number generated by the AP if the HMAC for the STA and the second HMAC generated by the STA are consistent.

27. A method of handover of dynamic routing, c h a r a c t e r i z e d b y The switching method includes: performing key negotiation according to the key negotiation method of any one of claims 20-26; determining a plurality of weights corresponding to a plurality of communication indicators according to a fuzzy consistent matrix, wherein the matrix elements in the fuzzy consistent matrix represent the relative importance between the plurality of communication indicators; determining the index weighted values in each single communication mode and the index weighted values in each combined communication mode according to the multiple index values corresponding to the multiple communication indexes in each single communication mode and the multiple weights corresponding to the multiple communication indexes; adaptively selecting the single communication mode or the combined communication mode corresponding to the maximum index weighted value according to a specific scenario.

28. The handover method of claim 27, wherein, The determining the index weighted values in each single communication mode and the index weighted values in each combined communication mode comprises: determining the multiple index values corresponding to the multiple communication indexes in each combined communication mode according to the multiple index values corresponding to the multiple communication indexes in each single communication mode; determining the index weighted values in each single communication mode according to the multiple index values corresponding to the multiple communication indexes in each single communication mode and the multiple weights corresponding to the multiple communication indexes; and determining the index weighted values in each combined communication mode according to the multiple index values corresponding to the multiple communication indexes in each combined communication mode and the multiple weights corresponding to the multiple communication indexes.

29. The handover method of claim 27, wherein, The determining the multiple weights corresponding to the multiple communication indexes comprises: transforming the fuzzy consistent matrix to obtain a fuzzy complementary judgment matrix; normalizing the fuzzy complementary judgment matrix to obtain a normalized matrix; determining a characteristic vector corresponding to a maximum eigenvalue according to the normalized matrix; and determining the multiple elements corresponding to the multiple communication indexes in the characteristic vector as the multiple weights corresponding to the multiple communication indexes.

30. An AP, comprising: The AP comprises: an execution device configured to execute the identity authentication method according to any one of claims 1-12, the key agreement method according to any one of claims 20-26, or the switching method of dynamic routing according to any one of claims 27-29.

31. A STA, comprising: The STA comprises: an execution device configured to execute the identity authentication method according to any one of claims 13-19, or the switching method of dynamic routing according to any one of claims 27-29.

32. An identity authentication system, comprising: The identity authentication system applied to the AP comprises: a first forwarding device configured to forward an initial response message corresponding to a local authentication request from a STA to a security module; a first receiving device configured to receive a first response code generated by the security module based on an AP private key and a STA identifier in the initial response message, wherein the AP private key is stored in the security module; a second forwarding device configured to forward the first response code to the STA, so that the STA generates a second response code based on the first response code and the STA identifier and sends a final response message, wherein the final response message comprises the second response code and the STA identifier; a second receiving device configured to receive the final response message; a generating device configured to generate a verification response code based on the first response code and the STA identifier in the final response message; and a third receiving device configured to receive the verification response code. The determining device is configured to determine that the identity authentication of the STA is successful when the second response code is consistent with the verification response code.

33. An identity authentication system, comprising: The identity authentication system applied to the STA comprises: The first sending device is configured to send an initial response message corresponding to a local authentication request to the AP, so that the AP forwards the initial response message to a security module, wherein the initial response message comprises a STA identifier, the security module generates a first response code based on an AP private key and the STA identifier in the initial response message, and sends the first response code to the AP, and the AP private key is stored in the security module; The receiving device is configured to receive the first response code forwarded via the AP; The generating device is configured to generate a second response code based on the first response code and a STA identifier locally stored by the STA; and The second sending device is configured to send a final response message to the AP, so that the AP generates a verification response code based on the first response code and a STA identifier in the final response message, and determines that the identity authentication of the STA is successful when the second response code in the final response message is consistent with the verification response code.

34. A key agreement system, characterized by The key negotiation system applied to the AP comprises: The identity authentication system of claim 32 is configured to perform identity authentication; The forwarding device is configured to forward key information corresponding to a key negotiation request from the STA to a security module, so that the security module performs the following operations: generating a session key based on a second random number generated by the STA and a random number generated by the AP, generating a negotiation response code based on the session key, a second STA ciphertext and a STA identifier in the key information, and sending a response message to the AP, wherein the response message comprises the negotiation response code and the STA identifier; The generating device is configured to generate a negotiation verification code based on the session key, the second STA ciphertext and the STA identifier in the response message in response to receiving the response message; and The confirming device is configured to confirm that the key negotiation is successful when the negotiation response code is consistent with the negotiation verification code.

35. A dynamic route switching system, comprising: The switching system comprises: The key negotiation system of claim 34 is configured to perform key negotiation; The first determining device is configured to determine a plurality of weights corresponding to a plurality of communication indicators according to a fuzzy consistent matrix, wherein a matrix element in the fuzzy consistent matrix represents a relative importance between the plurality of communication indicators; The second determining device is configured to determine an indicator weighted value in each single communication mode and an indicator weighted value in each combined communication mode according to a plurality of indicator values corresponding to the plurality of communication indicators in the single communication mode and the plurality of weights in a plurality of communication modes; and The selecting device is configured to adaptively select a single communication mode or a combined communication mode corresponding to a maximum indicator weighted value according to a specific scene.

36. A computer-readable storage medium, characterized in that, The computer readable storage medium stores a computer program, and the computer program is executed by the processor to implement the identity authentication method in any one of claims 1-19, the key agreement method in any one of claims 20-26, or the switching method of the dynamic route in any one of claims 27-29.

Images