WAPI certificate management data transmission method and system

Abstract

The invention discloses a wireless authentication and privacy infrastructure (WAPI) certificate management data transmission method and system, and relates to the technical field of wireless communication, and the method comprises the following steps: a wireless terminal receives a WAI message sent by a client, packages the WAI message in a first extended WAI message, and sends the first extended WAI message to a currently connected access point; after receiving the first extended WAI message, the access point de-encapsulates the first extended WAI message to obtain first load data in the first extended WAI message and sends the first load data to the CIS server; the CIS server sends the first load data reply message to the first proxy process; after receiving the first load data reply message, the first agent process encapsulates the first load data reply message in a second extended WAI message and sends the second extended WAI message to the corresponding wireless terminal; and after receiving the second extended WAI message, the second agent process de-encapsulates the second extended WAI message to obtain second load data in the second extended WAI message and sends the second load data to the client. According to the method, a network path is provided for online application and online updating operation of the online certificate.

Description

Technical Field

[0001] The present invention relates to the technical field of wireless communications, and in particular to a WAPI certificate management data transmission method and system. Background Art

[0002] The power industry is currently deploying a large number of WAPI wireless networks in substations and other scenarios, effectively supporting mobile operations, online monitoring, and intelligent inspection services within these substations. WAPI (Wireless LAN Authentication and Privacy Infrastructure) is a wireless network security standard and technology specified in China's national standard GB15629.11. Like infrared, Bluetooth, GPRS, and CDMA1X, WAPI is a wireless transmission protocol, but differs from it in that it is a transmission protocol for wireless local area networks (WLANs), similar to the 802.11B transmission protocol. The WAPI mechanism has been reviewed and approved by the ISO / IEC-authorized IEEE Registration Authority and has been assigned the Ethernet type number (IEEE EtherType Field) 0x88b4. WAPI uses digital certificates to identify wireless access points (APs) and wireless terminals (STAs), authenticating APs and STAs based on a ternary authenticator system, ensuring secure wireless access authentication.

[0003] With the widespread deployment of WAPI wireless networks, online updates of WAPI digital certificates (WAPI certificates) for WAPI wireless terminals (STAs) have become an unresolved issue. This is because security management requires periodic online updates of WAPI certificates for a large number of terminals, or because security incidents may trigger updates to terminal digital certificates.

[0004] To this end, the WAPI Wireless Standards Committee has developed standards for online application and online update of WAPI certificates. The standards clearly define the interactive protocol by which terminals / AP devices can submit certificate update requests to CIS through clients (such as browsers or APP programs). The transmission protocol is HTTPS, and the message format is encapsulated in JSON.

[0005] The WAPI Wireless Standards Committee has developed standards for online WAPI certificate application and renewal, but it does not specify how wireless terminals / APs communicate with the certificate issuance server (CIS server). (1) For online certificate application, since the wireless terminal does not have a WAPI certificate when it is first deployed, it cannot connect to the WAPI wireless network. At this time, the wireless terminal cannot access the WAPI wireless network, cannot transmit business data through the wireless network, and cannot access HTTPS through the network. Although HTTPS is a management action at this time, the communication is still treated as ordinary data by the wireless terminal and the wireless access point.

[0006] (2) Since the AP device and the CIS server are connected via a wired network, they are in the same management VLAN network, so there is no problem with related network communication. However, there is a practical problem for the terminal device to achieve network communication with the CIS server: after the wireless terminal accesses the WAPI wireless network, it cannot access the CIS server due to VLAN isolation.

[0007] In actual deployment, the WAPI wireless network uses different SSIDs (Service Set Identifiers) to divide logically isolated business wireless networks on the air interface wireless side. A wireless terminal can only connect to one business wireless network at a time. On the wired side of the WAPI wireless network, the wired part corresponding to the business wireless network is usually isolated using VLANs, and network management related to certificate management is usually divided into a separate VLAN on the wired side. As a result, wireless terminals cannot access the CIS server in the management VLAN through the business wireless network. Figure 1 As shown in the figure, the wired parts of the AP and the three network elements of the WAPI wireless network, CIS, AS (WAPI certificate authenticator), and AC (access controller), communicate with each other through the management VLAN network. Wireless terminal 1 and service server 1 communicate with each other through service VLAN 1, and wireless terminal 2 and service server 2 communicate with each other through service VLAN 2. However, wireless terminal 1 and wireless terminal 2 cannot communicate with network elements in the management VLAN network. Usually, wireless LANs isolate the management VLAN and service VLAN. Summary of the Invention

[0008] The purpose of the present invention is to provide a WAPI certificate management data transmission method and system to solve the problem that there is no way to transmit relevant management data when a WAPI wireless terminal performs online certificate application and online update.

[0009] The present invention is achieved through the following technical solutions: In a first aspect, a first embodiment of the present invention provides a WAPI certificate management data transmission method, comprising the following steps: The wireless terminal runs a second proxy process, receives a WAI message sent by the client, encapsulates the WAI message in a first extended WAI message, and sends the message to the currently connected access point through the air interface; The access point runs a first agent process, and after receiving the first extended WAI message, decapsulates the message to obtain first payload data in the first extended WAI message, connects to the CIS server via TCP / IP, and sends the first payload data to the CIS server. The CIS server sends the first payload data reply message to the first agent process via TCP / IP; After receiving the first payload data reply message, the first proxy process encapsulates the first payload data reply message in a second extended WAI message and sends it to the corresponding wireless terminal via the air interface; After receiving the second extended WAI message, the second proxy process decapsulates the message to obtain the second payload data in the second extended WAI message, and sends the second payload data to the client through TCP / IP.

[0010] Furthermore, the format of the first extended WAI message includes an Ethernet header, a protocol number, a WAI message header, and first payload data; the format of the second extended WAI message includes an Ethernet header, a protocol number, a WAI message header, and second payload data.

[0011] Furthermore, the specific method of receiving the WAI message sent by the client includes: The second proxy process opens a second Socket listening on the TCP port and receives the WAI message sent by the client through the Raw Socket interface.

[0012] Furthermore, the specific method of connecting to the CIS server through TCP / IP and sending the first payload data to the CIS server includes: The first agent process opens a first Socket and connects to the TCP port of the CIS server via TCP / IP. After the first Socket establishes a TCP connection with the CIS server, the received payload data is sent to the CIS server, and a corresponding relationship table between the first Socket and the MAC address of the wireless terminal is established.

[0013] Furthermore, after receiving the first payload data reply message, the first agent process encapsulates the first payload data reply message in a second extended WAI message and sends it to the corresponding wireless terminal via the air interface. The specific method includes: After receiving the first payload data reply, the first socket in the first proxy process searches the corresponding MAC address of the target wireless terminal in the correspondence table, encapsulates the first payload data reply message in the second extended WAI message, and sends it to the target wireless terminal through the air interface.

[0014] In a second aspect, another embodiment of the present invention provides a WAPI certificate management data transmission system, comprising: a wireless terminal, an access point, and a CIS server, wherein the wireless terminal runs a second agent process, receives a WAI message sent by a client, encapsulates the WAI message in a first extended WAI message, and sends the message to a currently connected access point via an air interface; The access point runs a first agent process, and after receiving the first extended WAI message, decapsulates the message to obtain first payload data in the first extended WAI message, connects to the CIS server via TCP / IP, and sends the first payload data to the CIS server; The CIS server sends the first payload data reply message to the first agent process via TCP / IP; After receiving the first payload data reply message, the first proxy process in the access point encapsulates the first payload data reply message in a second extended WAI message and sends it to the corresponding wireless terminal through the air interface; After receiving the second extended WAI message, the second agent process in the wireless terminal decapsulates the message to obtain the second payload data in the second extended WAI message, and sends the second payload data to the client through TCP / IP.

[0015] Furthermore, the format of the extended WAI message includes an Ethernet header, a protocol number, a WAI message header, and payload data.

[0016] Furthermore, the wireless terminal includes a receiving unit, which is configured to open a second Socket listening function on a TCP port and receive a WAI message sent by a client through a Raw Socket interface.

[0017] Furthermore, the access point includes a sending unit and a relationship table establishment unit. The sending unit is used to open a first socket to connect to the TCP port of the CIS server through TCP / IP. After the first socket establishes a TCP connection with the CIS server, the received payload data is sent to the CIS server. The relationship table establishment unit is used to establish a correspondence table between the first socket and the MAC address of the wireless terminal.

[0018] Furthermore, the access point further includes a search unit, which searches for a MAC address of the target wireless terminal corresponding to a correspondence table.

[0019] Compared with the prior art, the present invention has the following advantages and beneficial effects: Embodiments of the present invention provide a WAPI certificate management and data transmission method and system. This method implements payload data transmission and reception by running a TCP / IP port proxy process on a WAPI wireless access point and wireless terminal. By encapsulating the payload data in an extended WAI message and transmitting it over the air interface, this method enables payload data continuity over the air interface and cross-VLAN communication. This provides a network path for online certificate application and update operations, resolving the network channel issue associated with online updates in WAPI wireless networks. Because WAI messages can be sent and received with or without a wireless connection between the WAPI wireless terminal and access point, the system exhibits excellent adaptability. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to more clearly illustrate the technical solutions of the exemplary embodiments of the present invention, the following briefly introduces the drawings required for use in the examples. It should be understood that the following drawings only illustrate certain embodiments of the present invention and should not be considered as limiting the scope. A person of ordinary skill in the art can also derive other relevant drawings based on these drawings without inventive effort. In the drawings: Figure 1 This is a schematic diagram of the existing multi-VLAN WAPI wireless network structure; Figure 2 A flowchart of a WAPI certificate management data transmission method provided by the first embodiment of the present invention; Figure 3 Schematic diagram of the format of the extended WAI message in the first embodiment; Figure 4 A structural block diagram of a WAPI certificate management and data transmission system provided in another embodiment of the present invention; Figure 5 A schematic diagram of a WAPI certificate management data transmission system provided in another embodiment. DETAILED DESCRIPTION

[0021] In order to make the objectives, technical solutions and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with examples and drawings. The exemplary embodiments of the present invention and their descriptions are only used to explain the present invention and are not intended to limit the present invention.

[0022] like Figure 2 As shown, a WAPI certificate management data transmission method provided by the first embodiment of the present invention includes the following steps: The wireless terminal runs a second proxy process, receives a WAI message sent by the client, encapsulates the WAI message in a first extended WAI message, and sends the message to the currently connected access point through the air interface; The access point runs a first agent process, and after receiving the first extended WAI message, decapsulates the message to obtain first payload data in the first extended WAI message, connects to the CIS server via TCP / IP, and sends the first payload data to the CIS server. The CIS server sends the first payload data reply message to the first agent process via TCP / IP; After receiving the first payload data reply message, the first proxy process encapsulates the first payload data reply message in a second extended WAI message and sends it to the corresponding wireless terminal via the air interface; After receiving the second extended WAI message, the second proxy process decapsulates the message to obtain the second payload data in the second extended WAI message, and sends the second payload data to the client through TCP / IP.

[0023] A first proxy process is run on the access point, and a second proxy process is run on the wireless terminal. The first proxy process and the second proxy process can send and receive HTTPS protocol messages through TPC / IP, and can send and receive extended WAI messages. Extended WAI messages are extended based on WAPI authentication protocol messages (i.e., WAI messages). Preferably, a new WAI message type is defined, and HTTPS protocol data is used as the payload data of the WAI message, such as Figure 3 As shown, the format of an extended WAI message includes an Ethernet header, a protocol number, a WAI message header, and payload data. A WAI message is an Ethernet message of type 0x88B4. The WAI message header contains a one-byte message type, illustratively 0xF1 in this embodiment. After receiving a WAI message, the proxy process determines that it is an extended WAI message by checking that the WAI message header type number is 0xF1. Specifically, the format of a first extended WAI message includes an Ethernet header, a protocol number, a WAI message header, and first payload data. The format of a second extended WAI message also includes an Ethernet header, a protocol number, a WAI message header, and second payload data.

[0024] In this embodiment, the client can be a browser or an app. The payload data is HTTPS protocol data. When the browser (or app) needs to access the HTTPS service of the CIS server's certificate, the browser connects to the wireless terminal's second proxy process using the wireless terminal's IP address. The second proxy process in the wireless terminal receives the browser's HTTPS protocol data, then encapsulates the HTTPS protocol data in a first extended WAI message and sends it over the air interface to the currently connected access point. After receiving the first extended WAI message, the first proxy process on the access point to which the wireless terminal is connected decapsulates the payload data (i.e., HTTPS protocol data) contained therein. Then, the first proxy process connects to the CIS server via TCP / IP and sends the data to the CIS server. The CIS server sends the HTTPS protocol data back to the first proxy process on the access point via TCP / IP. After receiving the HTTPS protocol data, the first proxy process encapsulates the HTTPS protocol data in a second extended WAI message and sends it over the air interface to the corresponding wireless terminal. After receiving the second extended WAI message from the air interface, the wireless terminal decapsulates the payload data (i.e., HTTPS protocol data) contained therein and sends the HTTPS protocol data to the browser via TCP / IP. TCP / IP (Transmission Control Protocol / Internet Protocol) is the core communication protocol suite of the Internet. It defines how electronic devices transmit data, address, route, and ensure data integrity in the network.

[0025] Specifically, a first agent process runs on the access point and listens for and receives WAI messages via a Raw Socket interface. A second agent process runs on the wireless terminal, which opens a second socket on TCP port 443 to listen and receives WAPI wireless network authentication protocol messages (i.e., WAI messages) via a Raw Socket interface. Raw Sockets are a special network programming interface that allow programs to directly operate on underlying network protocols (such as IP and ICMP), bypassing traditional transport layer protocols (TCP / UDP). This allows developers to customize the format and content of data packets, enabling lower-level network control. Sockets are a mechanism used in computer network programming to implement inter-process communication (IPC). They provide an interface for data transmission between different hosts or between different processes within the same host. Programs can send and receive data through sockets.

[0026] When a browser needs to access the HTTPS network service on the CIS server, it connects to the wireless terminal's second proxy process using the wireless terminal's IP address. The browser program then establishes a TCP connection to the wireless terminal's TCP port 443. The second proxy process receives the browser's HTTPS protocol data on the second socket, encapsulates the HTTPS protocol data in an extended WAI message, and sends it over the air interface to the currently connected access point. The second proxy process directly encapsulates the application layer data received on the second socket in the extended WAI message.

[0027] If the online update of the WAPI certificate is implemented by using an APP program inside the wireless terminal, the APP program directly connects to the 443 TCP port of the local loopback address 127.0.0.1, and the APP program establishes a TCP connection with the second agent program.

[0028] After receiving the extended WAI message, the first agent process on the access point decapsulates the payload, namely the HTTPS protocol data. It then opens a first socket and connects to TCP port 443 of the CIS server via TCP / IP. After establishing a TCP connection with the CIS server, the first socket sends the received HTTPS protocol data to the CIS server. The first agent process then directly sends the application layer data received by the first socket to the CIS server via TCP. During this process, the access point establishes a table, called the STA table, that maps the first socket to the MAC address of wireless terminals. This table facilitates subsequent lookups of corresponding wireless terminals.

[0029] The CIS server usually uses a web server to receive request messages from the requester on TCP port 443, processes the user's request in the web server's CGI (Common Gateway Interface) program, and generates a reply message to send to the requester. For the CIS server, the requester is the access point device because the first agent process on the access point establishes a TCP connection with the CIS server.

[0030] After receiving the CIS reply message, the first socket in the first proxy process on the access point obtains the MAC address of the target wireless terminal by searching the STA table, encapsulates the reply message in an extended WAI message, and sends it to the target wireless terminal through the air interface.

[0031] After receiving the extended WAI message from the air interface, the wireless terminal decapsulates the WAI message to obtain the payload data, and then sends the HTTPS protocol data to the browser through TCP / IP.

[0032] If there are multiple message interactions when the browser (or APP) performs a certificate update operation, the above process will be repeated.

[0033] Through the method described in the above embodiment, when a wireless terminal does not have a WAPI certificate and cannot establish a wireless connection with a WAPI wireless network, since WAI messages are the only wireless data messages allowed to pass through at this time, the two proxy processes can achieve over-the-air data transmission and transmission of certificate service management messages within the management VLAN by using extended WAI messages encapsulating certificate management messages, thereby enabling the wireless terminal to access the services of the CIS server and complete online certificate application. Once the wireless terminal has established a wireless connection with the WAPI wireless network, the two proxy processes can achieve over-the-air data transmission within the management VLAN by using extended WAI messages encapsulating certificate management messages, thereby enabling the wireless terminal to access the services of the CIS server and complete online certificate update.

[0034] An embodiment of the present invention provides a WAPI certificate management and data transmission method. This method implements payload data transmission and reception by running a TCP / IP port proxy process on a WAPI wireless access point and a wireless terminal. By encapsulating the payload data in an extended WAI message and sending it over the air interface, this method enables payload data continuity over the air interface and cross-VLAN communication. This provides a network path for online certificate application and update operations, resolving the network channel issue associated with online updates in WAPI wireless networks. Because WAI messages can be sent and received with or without a wireless connection between the WAPI wireless terminal and access point, the method exhibits excellent adaptability.

[0035] like Figure 4 5 , another embodiment of the present invention provides a WAPI certificate management data transmission system, including: a wireless terminal, an access point, and a CIS server, wherein the wireless terminal runs a second agent process, receives a WAI message sent by a client, encapsulates the WAI message in a first extended WAI message, and sends the message to the currently connected WAPI access point via an air interface; the access point runs a first agent process, and after receiving the first extended WAI message, decapsulates the message to obtain first payload data in the first extended WAI message, connects to the CIS server via TCP / IP, and sends the first payload data to the CIS server; the CIS server sends a first payload data reply message to the first agent process via TCP / IP; after receiving the first payload data reply message, the first agent process in the access point encapsulates the first payload data reply message in a second extended WAI message, and sends the message to the corresponding wireless terminal via the air interface; after receiving the second extended WAI message, the second agent process in the wireless terminal decapsulates the message to obtain second payload data in the second extended WAI message, and sends the second payload data to the client via TCP / IP.

[0036] The format of the first extended WAI message includes an Ethernet header, a protocol number, a WAI message header, and first payload data; the format of the second extended WAI message includes an Ethernet header, a protocol number, a WAI message header, and second payload data.

[0037] The wireless terminal includes a receiving unit, which is used to open a second Socket listening on the TCP port and receive a WAI message sent by the client through a Raw Socket interface.

[0038] The access point includes a sending unit and a relationship table establishment unit. The sending unit is configured to open a first socket and connect to a TCP port of a CIS server via TCP / IP. After the first socket establishes a TCP connection with the CIS server, the first socket sends received payload data to the CIS server. The relationship table establishment unit is configured to establish a correspondence table between the first socket and the MAC address of a wireless terminal. The access point also includes a search unit that searches the correspondence table for the MAC address of a target wireless terminal.

[0039] The execution process of each module may be performed according to the process steps of the WAPI certificate management data transmission method of the first embodiment, and will not be described in detail in this embodiment.

[0040] The WAPI certificate management and data transmission system provided by the present invention implements payload data transmission and reception by running a TCP / IP port proxy process on a WAPI wireless access point and a wireless terminal. By encapsulating the payload data in an extended WAI message and sending it over the air interface, this system enables payload data continuity over the air interface and cross-VLAN communication, thereby providing a network path for online certificate application and update operations, and resolving the network channel issue associated with online updates in WAPI wireless networks. Because WAI messages can be sent and received with or without a wireless connection between the WAPI wireless terminal and the access point, the system exhibits excellent adaptability.

[0041] The specific implementation methods described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific implementation method of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A WAPI certificate management data transmission method, characterized in that: The following steps are involved: The wireless terminal runs a second proxy process, receives a WAI message sent by the client, encapsulates the WAI message in a first extended WAI message, and sends the message to the currently connected access point through the air interface; The access point runs a first agent process, and after receiving the first extended WAI message, decapsulates the message to obtain first payload data in the first extended WAI message, connects to the CIS server via TCP / IP, and sends the first payload data to the CIS server. The CIS server sends the first payload data reply message to the first agent process via TCP / IP; After receiving the first payload data reply message, the first proxy process encapsulates the first payload data reply message in a second extended WAI message and sends it to the corresponding wireless terminal via the air interface; After receiving the second extended WAI message, the second proxy process decapsulates the message to obtain the second payload data in the second extended WAI message, and sends the second payload data to the client through TCP / IP.

2. The WAPI certificate management data transmission method according to claim 1, characterized in that: The format of the first extended WAI message includes an Ethernet header, a protocol number, a WAI message header, and first payload data. The format of the second extended WAI message includes an Ethernet header, a protocol number, a WAI message header, and second payload data.

3. The WAPI certificate management data transmission method according to claim 1, characterized in that: The specific method of receiving the WAI message sent by the client includes: The second proxy process opens a second Socket listening on the TCP port and receives the WAI message sent by the client through the Raw Socket interface.

4. The WAPI certificate management data transmission method according to claim 3, characterized in that: The specific method of connecting to the CIS server through TCP / IP and sending the first payload data to the CIS server includes: The first agent process opens a first Socket and connects to the TCP port of the CIS server via TCP / IP. After the first Socket establishes a TCP connection with the CIS server, the received payload data is sent to the CIS server, and a corresponding relationship table between the first Socket and the MAC address of the wireless terminal is established.

5. The WAPI certificate management data transmission method according to claim 4, characterized in that: After the first agent process receives the first payload data reply message, the specific method of encapsulating the first payload data reply message in a second extended WAI message and sending it to the corresponding wireless terminal via the air interface includes: After receiving the first payload data reply, the first socket in the first proxy process searches the corresponding MAC address of the target wireless terminal in the correspondence table, encapsulates the first payload data reply message in the second extended WAI message, and sends it to the target wireless terminal through the air interface.

6. A WAPI certificate management data transmission system, characterized in that: include: A wireless terminal, an access point, and a CIS server, wherein the wireless terminal runs a second proxy process, receives a WAI message sent by a client, encapsulates the WAI message in a first extended WAI message, and sends the message to the currently connected access point via an air interface; The access point runs a first agent process, and after receiving the first extended WAI message, decapsulates the message to obtain first payload data in the first extended WAI message, connects to the CIS server via TCP / IP, and sends the first payload data to the CIS server; The CIS server sends the first payload data reply message to the first agent process via TCP / IP; After receiving the first payload data reply message, the first proxy process in the access point encapsulates the first payload data reply message in a second extended WAI message and sends it to the corresponding wireless terminal through the air interface; After receiving the second extended WAI message, the second agent process in the wireless terminal decapsulates the message to obtain the second payload data in the second extended WAI message, and sends the second payload data to the client through TCP / IP.

7. The WAPI certificate management and data transmission system according to claim 6, characterized in that: The format of the first extended WAI message includes an Ethernet header, a protocol number, a WAI message header, and first payload data. The format of the second extended WAI message includes an Ethernet header, a protocol number, a WAI message header, and second payload data.

8. The WAPI certificate management and data transmission system according to claim 6, characterized in that: The wireless terminal includes a receiving unit, which is used to open a second Socket listening on a TCP port and receive a WAI message sent by a client through a Raw Socket interface.

9. The WAPI certificate management data transmission system according to claim 8, characterized in that: The access point includes a sending unit and a relationship table establishment unit. The sending unit is used to open a first socket to connect to the TCP port of the CIS server via TCP / IP. After the first socket establishes a TCP connection with the CIS server, the received payload data is sent to the CIS server. The relationship table establishment unit is used to establish a correspondence table between the first socket and the MAC address of the wireless terminal.

10. The WAPI certificate management data transmission system according to claim 9, characterized in that: The access point further includes a search unit, which searches for a MAC address of a target wireless terminal corresponding to a corresponding relationship table.

Images