Wireless network security management method and system

Abstract

The invention discloses a wireless network security management method and system. In the method, a system initialization module completes initialization, calls a key management module to generate signatures of a platform end and wireless equipment and encrypts asymmetric key pairs, and a wireless equipment management module records basic information of storage equipment. Before wireless equipment accesses, an authentication request containing first encryption information and first signature information is initiated through a request gateway module, after a platform end decrypts and verifies the signature to complete equipment authentication, second encryption information and second signature information are returned, and an equipment end decrypts and verifies the signature to complete bidirectional authentication. And network access is allowed in combination with the white list and the equipment registration state, and an administrator completes identity authentication and authority verification through the user authority management module and the request gateway module. After the equipment accesses the network, heartbeat communication and bidirectional authentication are carried out at regular intervals, equipment communication is controlled through a network communication strategy, and operation monitoring, situation analysis and log auditing are synchronously carried out. According to the invention, the problems of high access and operation and maintenance management security risk and the like in the prior art are solved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of wireless network management, in particular to a wireless network security management method and system. BACKGROUND

[0002] The current identity authentication mechanism of wireless network device management mainly relies on two types of mainstream application schemes: one type is to adopt the combination of device unique identifier and static password, and to complete identity confirmation by verifying the consistency of device exclusive identifier and preset static password; the other type is to construct a complex algorithm based on device unique identifier and random number, and to realize identity verification by comparing whether the operation results of device end and server end match. These two types of schemes are widely used in network access authentication and operation and maintenance management scenarios of various wireless devices such as core network, base station, CPE, wireless terminal, etc., and are common technical means to protect the security of wireless network basic access.

[0003] However, the existing technical schemes have significant security defects and application limitations: in the first type of scheme, the static password is easily obtained by illegal means due to improper management, transmission leakage, etc., and once the password is leaked, the attacker can directly fake the device identity to access the network; the second type of scheme introduces a complex algorithm to improve the cracking difficulty, but if the algorithm itself has design flaws or is reverse cracked, the entire authentication mechanism will be invalid. The common risk of the two types of schemes is that they both rely on the security of a single authentication dimension, lack of bidirectional verification and dynamic protection mechanism, and once the password or algorithm is broken, the authentication process is at risk of being bypassed, which poses a serious security threat to the access control, data transmission and operation and maintenance management of wireless network, and cannot meet the high security requirements of wireless network for device identity authentication.

[0004] Therefore, there is an urgent need for a wireless network security management method to solve the high security risk problems of access and operation and maintenance management in the existing technology. SUMMARY

[0005] Therefore, the present application provides a wireless network security management method and system to solve the problems of existing wireless network device authentication relying on a single dimension, lacking bidirectional and dynamic protection, being easily broken due to password or algorithm leakage, and high security risk of access and operation and maintenance management.

[0006] In order to achieve the above purpose, the present application provides the following technical scheme: a wireless network security management method, characterized in that it comprises:

[0007] The system initialization module initializes the key management system parameters and administrator user information of the platform end; the key management module generates and configures the platform end signature asymmetric key pair and the platform end encryption asymmetric key pair; the key management module generates the device end signature asymmetric key pair and the device end encryption asymmetric key pair for the wireless device to be accessed; the wireless device management module enters and stores the basic information of the wireless device;

[0008] Based on the device end and platform end signature asymmetric key pair and encryption asymmetric key pair, the wireless device initiates a bidirectional identity authentication request to the platform end through the request gateway module before accessing the wireless network; the authentication request includes first encryption information and first signature information;

[0009] The platform end decrypts the first encryption information in the authentication request through the platform end encryption private key, obtains the device unique identifier, queries the corresponding device end signature public key based on the device unique identifier, and verifies the first signature information in the authentication request through the device end signature public key, thereby completing the identity authentication of the wireless device;

[0010] After the device end identity authentication is passed, the platform end generates a second random number, concatenates the second random number with the device unique identifier to form second concatenated information, encrypts and signs the second concatenated information through the device end encryption public key and the platform end signature private key, respectively, to form second encryption information and second signature information, and returns the second encryption information and the second signature information to the device end through the request gateway module;

[0011] The device end decrypts the second encryption information through the device end encryption private key, and verifies the second signature information through the platform end signature public key, thereby completing the identity authentication of the platform end;

[0012] After the bidirectional identity authentication is completed, the wireless device is allowed to access the wireless network in combination with the device access whitelist configured in the security policy configuration module and the device registration state in the wireless device management module; the system administrator logs in to the system through the user permission management module, and performs identity authentication and permission verification of the administrator in combination with the request gateway module; after the wireless device accesses, the device performs heartbeat communication and bidirectional identity authentication process with the platform end at a set frequency;

[0013] Based on the state of the wireless device accessing the wireless network, the network communication strategy configured by the security policy configuration module is used to control and manage the communication between devices; the running state monitoring, security situation analysis, user operation and device log auditing of the wireless device are performed by the monitoring and alarm module, the security situation analysis module and the log audit module, respectively.

[0014] As a preferred solution of the wireless network security management method, the platform-side signature asymmetric key pair comprises a platform-side signature public key and a platform-side signature private key; the platform-side encryption asymmetric key pair comprises a platform-side encryption public key and a platform-side encryption private key; the device-side signature asymmetric key pair comprises a device-side signature public key and a device-side signature private key; and the device-side encryption asymmetric key pair comprises a device-side encryption public key and a device-side encryption private key.

[0015] As a preferred solution of the wireless network security management method, the basic information of the wireless device comprises a device name, a device type, a device unique identifier, a device serial number, a device international mobile equipment identity (IMEI), a device IP address, a device MAC address, and device manufacturer information.

[0016] As a preferred solution of the wireless network security management method, the device unique identifier is spliced with a first random number to generate first spliced information; the first spliced information is encrypted by the platform-side encryption public key to generate the first encrypted information; and the first spliced information is signed by the device-side signature private key to generate the first signature information.

[0017] As a preferred solution of the wireless network security management method, after the request gateway module receives the bidirectional identity authentication request, the wireless device is preliminarily verified by the device network access whitelist; and after the verification passes, the request gateway module forwards the bidirectional identity authentication request to the platform side for an authentication process.

[0018] As a preferred solution of the wireless network security management method, in the process of controlling the communication between devices by the network communication strategy configured by the security strategy configuration module, the network communication strategy controls the communication between devices by configuring five-tuple information of a source device IP, a source device port, a destination device IP, a destination device port, and a communication protocol.

[0019] As a preferred solution of the wireless network security management method, after the wireless device accesses the wireless network, each time of heartbeat communication is initiated by the request gateway module, and a bidirectional identity authentication process is performed.

[0020] As a preferred solution of the wireless network security management method, in the process of performing security situation analysis on the wireless device by the security situation analysis module, the security situation analysis module generates a device network topology graph by collecting, aggregating, and statistically processing running state information, alarm information, and communication traffic information of the wireless device; and the device network topology graph is displayed and supports information drilling query.

[0021] As a preferred scheme of the wireless network security management method, the log recorded by the log auditing module includes: a user operation log, an authentication log of a wireless device and a running log; the log auditing module supports a query auditing operation on the log.

[0022] The application further provides a wireless network security management system, comprising:

[0023] a request gateway module, a system initialization module, a device management module, a security policy configuration module, a monitoring and alarming module, a key management module, a security posture analysis module, a user permission management module and a log auditing module;

[0024] The request gateway module is configured to receive https requests of wireless devices and clients; forward the https requests to designated modules after white list verification, identity authentication and permission verification, and return response data to the requestor;

[0025] The system initialization module is configured to initialize key management system parameters and administrator user information of a platform end, and call the key management module to generate and configure a platform end asymmetric key pair;

[0026] The device management module is configured to input, store and manage the basic information of wireless devices; support adding, deleting, modifying and inquiring the basic information, and support device end key query and device registration state verification functions;

[0027] The security policy configuration module is configured to configure a device network access white list, control wireless device access through the device network access white list, configure a network communication policy based on the five-tuple information, and control device-to-device communication through the network communication policy;

[0028] The monitoring and alarming module is configured to collect running state data and alarm information of wireless devices in real time; after data fusion of the running state data and the alarm information, notify management personnel to handle;

[0029] The key management module is configured to generate a platform end signature asymmetric key pair and a platform end encryption asymmetric key pair for a platform end, generate a device end signature asymmetric key pair and a device end encryption asymmetric key pair for each wireless device to be accessed, and realize key application, destruction, update and synchronization;

[0030] The security posture analysis module is configured to aggregate the running state information, the alarm information and the communication traffic information of wireless devices to generate a device network topology graph; the device network topology graph is displayed, and information drilling query and security risk positioning are supported;

[0031] The user permission management module is used for managing system user account and role information; and the request gateway module is used for user identity authentication and permission checking.

[0032] The log audit module is used for recording user operation logs, device authentication logs and running logs, and supporting log query and audit operations.

[0033] The present application has the following advantages:

[0034] Firstly, the present application adopts asymmetric key two-way identity authentication, combines with device network access and heartbeat communication full-process checking, strengthens the security of identity authentication from the root, and eliminates the risk of single authentication dimension being broken.

[0035] Secondly, the present application realizes precise authorization of device access and communication through network access whitelist and five-tuple network communication strategy double control, reduces illegal access and illegal communication hidden dangers.

[0036] Thirdly, the present application realizes the integration of device management, security monitoring, situation analysis and log audit through multi-module cooperation, fully covers the network security management scene, and improves the operation and maintenance efficiency and risk disposal speed.

[0037] Fourthly, the key management system of the present application supports key full life cycle management, ensures the uniqueness and dynamic update of the key, and further strengthens the network security protection barrier. BRIEF DESCRIPTION OF DRAWINGS

[0038] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following will briefly introduce the drawings needed to be used in the embodiments or prior art description. Obviously, the drawings in the following description are only exemplary, and for those skilled in the art, other drawings can be derived from the provided drawings without creative labor.

[0039] The structures, proportions, sizes, etc. shown in the specification are only used to cooperate with the content disclosed in the specification, to be understood and read by those skilled in the art, and are not used to limit the limiting conditions of the embodiments of the present application, so they do not have technical significance. Any modification of structure, change of proportion relationship or adjustment of size, without affecting the effect and purpose that can be achieved by the present application, should still fall within the scope of the technical content disclosed by the present application.

[0040] Figure 1 A flowchart of a wireless network security management method provided in embodiment 1 of the present application is shown in the figure.

[0041] Figure 2A two-way identity authentication flowchart based on asymmetric keys in a wireless network security management method provided in Embodiment 1 of the present application;

[0042] Figure 3 A structure diagram of a wireless network security management system provided in Embodiment 2 of the present application. DETAILED DESCRIPTION

[0043] The embodiments of the present application will be described in detail by specific embodiments, and those skilled in the art can easily understand other advantages and effects of the present application from the content disclosed in the specification. Obviously, the described embodiments are part of the embodiments of the present application, not all. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the present application.

[0044] Embodiment 1

[0045] Reference Figure 1 Embodiment 1 of the present application provides a wireless network security management method, comprising the following steps:

[0046] S1, initializing the key management system parameters and administrator user information of the platform end through the system initialization module; generating and configuring the platform end signature asymmetric key pair and the platform end encryption asymmetric key pair by calling the key management module; generating the device end signature asymmetric key pair and the device end encryption asymmetric key pair for the wireless device to be accessed through the key management module; and entering and storing the basic information of the wireless device through the wireless device management module;

[0047] S2, based on the device end and platform end signature asymmetric key pair and encryption asymmetric key pair, the wireless device initiates a two-way identity authentication request to the platform end through the request gateway module before accessing the wireless network; the authentication request includes first encryption information and first signature information;

[0048] S3, the platform end decrypts the first encryption information in the authentication request through the platform end encryption private key, obtains the device unique identifier, queries the corresponding device end signature public key based on the device unique identifier, and verifies the first signature information in the authentication request through the device end signature public key, to complete the identity authentication of the wireless device;

[0049] S4, after the device end identity authentication is passed, the platform end generates a second random number, and splices the second random number with the device unique identifier to form second splicing information; the second splicing information is encrypted and signed through the device end encryption public key and the platform end signature private key respectively to form second encryption information and second signature information, which are returned to the device end through the request gateway module.

[0050] S5, the device end decrypts the second encryption information by using a device end encryption private key, and verifies the second signature information by using a platform end signature public key, to complete identity authentication of the platform end;

[0051] S6, after the two-way identity authentication is completed, the wireless device is allowed to access the wireless network in combination with a device access white list configured in a security policy configuration module and a device registration state in the wireless device management module; a system administrator logs in the system through a user authority management module, and identity authentication and authority verification of the administrator are performed in combination with the request gateway module; after the wireless device accesses, heartbeat communication and the two-way identity authentication process are performed between the wireless device and the platform end according to a set frequency;

[0052] S7, based on a state that the wireless device accesses the wireless network, network communication strategies configured by the security policy configuration module are used to control and manage the communication between devices; the running state monitoring, the security situation analysis, the user operation and the device log auditing of the wireless device are performed by the monitoring and alarming module, the security situation analysis module and the log auditing module respectively.

[0053] In the embodiment, in step S1, the key management system parameters and the administrator user information of the platform end are initialized by the system initialization module; the platform end signature asymmetric key pair and the platform end encryption asymmetric key pair are generated and configured by calling the key management module; the device end signature asymmetric key pair and the device end encryption asymmetric key pair of the wireless device to be accessed are generated by the key management module; and the basic information of the wireless device is input and stored by the wireless device management module.

[0054] Specifically, after the system initialization module is started, the core running parameters of the platform end key management system, such as the key generation algorithm, the key validity period, and the basic information of the administrator user, such as the account and the initial authority, are initialized in a standardized manner in priority, to ensure that the system core components have running conditions. Then, the system calls the key management module, generates the platform end exclusive signature asymmetric key pair and the encryption asymmetric key pair according to a preset encryption standard, and completes the binding configuration of the keys on the platform end. At the same time, the key management module generates an exclusive and unique device end signature asymmetric key pair and a device end encryption asymmetric key pair for each wireless device to be accessed, to ensure that the identity authentication of the device and the platform has a unique identifier. Finally, the basic information of the wireless device is input and stored by the wireless device management module, to provide data support for subsequent device identity recognition and authority control.

[0055] The platform-side signature asymmetric key pair includes: a platform-side signature public key and a platform-side signature private key; the platform-side encryption asymmetric key pair includes: a platform-side encryption public key and a platform-side encryption private key; the device-side signature asymmetric key pair includes: a device-side signature public key and a device-side signature private key; the device-side encryption asymmetric key pair includes: a device-side encryption public key and a device-side encryption private key.

[0056] The basic information of a wireless device includes: device name, device type, device unique identifier, device serial number, device International Mobile Equipment Identity (IMEI), device IP address, device MAC address, and device manufacturer information.

[0057] In this embodiment, in step S2, based on the signature asymmetric key pair and encryption asymmetric key pair of the device and the platform, the wireless device initiates a two-way authentication request to the platform through the request gateway module before accessing the wireless network; the authentication request includes first encryption information and first signature information.

[0058] Specifically, based on the asymmetric key pair between the device and the platform generated in step S1, before initiating a network access request, the wireless device first generates a first random number, concatenates its own unique identifier with the first random number to form first concatenated information, and then encrypts this first concatenated information using the platform's encryption public key to generate first encrypted information; simultaneously, it signs the first concatenated information using its own device-side signing private key to generate first signed information. Subsequently, the wireless device uses the first encrypted information and the first signed information as core parameters to initiate a two-way authentication request to the platform through the request gateway module. After receiving the two-way authentication request, the request gateway module performs a preliminary verification of the wireless device using the device network access whitelist; after successful verification, the request gateway module forwards the two-way authentication request to the platform for authentication.

[0059] In this embodiment, in step S3, the platform decrypts the first encrypted information in the authentication request using the platform's encrypted private key to obtain a unique device identifier; it then queries the corresponding device signature public key based on the unique device identifier and verifies the first signature information in the authentication request using the device signature public key to complete the authentication of the wireless device.

[0060] Specifically, after receiving the authentication request forwarded in step S2, the platform first uses its stored platform-side encrypted private key to decrypt the first encrypted information in the request. If decryption is successful, it extracts the device's unique identifier and a first random number; if decryption fails, it directly determines that the device authentication has failed. Subsequently, based on the device's unique identifier obtained through decryption, the platform queries the corresponding device-side signature public key through the wireless device management module. It then uses this device-side signature public key to verify the first signature information in the authentication request, confirming whether the first concatenated information has been tampered with and whether it was genuinely initiated by the device. When decryption and signature verification are successful, the wireless device's identity authentication is completed; failure at any step terminates the authentication process.

[0061] In this embodiment, in step S4, after the device authentication is successful, the platform generates a second random number and concatenates the second random number with the device's unique identifier to form second concatenated information. The second concatenated information is then encrypted and signed using the device's encryption public key and the platform's signing private key, respectively, to form second encrypted information and second signed information, which are then returned to the device via the request gateway module.

[0062] Specifically, after confirming the device's identity in step S3, the platform generates a second random number and concatenates it with the device's unique identifier to form second concatenated information, ensuring the uniqueness and relevance of the feedback information. Subsequently, the platform encrypts the second concatenated information using the device's public encryption key configured in step S1, generating second encrypted information. Simultaneously, it signs the second concatenated information using its own platform-side signing private key, generating second signed information. Finally, the platform returns the second encrypted information and the second signed information to the device via the request gateway module, providing the device with decryptable and signature-verifiable credentials to verify the platform's identity.

[0063] In this embodiment, in step S5, the device decrypts the second encrypted information using its private encryption key and verifies the second signature information using the platform's public signature key, thus completing the authentication of the platform's identity.

[0064] Specifically, after receiving the second encrypted information and the second signature information returned in step S4, the device first uses its stored device-side encryption private key to decrypt the second encrypted information. If decryption is successful, it extracts the second random number and the device's unique identifier to confirm that the information source is related to itself. If decryption fails, it determines that the platform's identity is illegitimate and terminates the network access process. Subsequently, the device verifies the second signature information using the platform's signature public key configured in step S1 to verify whether the second concatenated information has been tampered with and whether it was genuinely sent by the target platform. When decryption is successful and signature verification is passed, the identity authentication of the platform is completed, and the two-way identity authentication between the device and the platform is now complete.

[0065] In this embodiment, in step S6, after the two-way authentication is completed, the wireless device is allowed to access the wireless network by combining the device access whitelist configured in the security policy configuration module and the device registration status in the wireless device management module; the system administrator logs into the system through the user permission management module and performs administrator identity authentication and permission verification in combination with the request gateway module; after the wireless device accesses the network, it performs heartbeat communication and two-way authentication process with the platform at a set frequency.

[0066] Specifically, after two-way authentication is completed, the system first queries the device whitelist in the security policy configuration module and simultaneously verifies the device's registration status in the wireless device management module. Only when the device is both on the whitelist and its registration status is valid is it allowed to access the wireless network. At the same time, the system administrator needs to initiate a login request by entering account information through the user permission management module, requesting the gateway module to collaborate with the user permission management module to complete the administrator's identity authentication and permission verification, authorizing only the administrator to perform operations such as whitelist modification and policy configuration. After the wireless device successfully accesses the network, it will conduct heartbeat communication with the platform at preset time intervals. During each heartbeat communication, the two-way authentication process of steps S2-S5 is repeated to ensure the continued validity of the device's identity after access.

[0067] Each heartbeat communication is initiated through the request gateway module.

[0068] In this embodiment, in step S7, based on the status of the wireless device accessing the wireless network, the network communication policy configured by the security policy configuration module is used to control the communication between devices; the monitoring and alarm module, security situation analysis module, and log auditing module are used to monitor the operating status of the wireless device, analyze the security situation, and audit user operations and device logs, respectively.

[0069] Specifically, based on the network connectivity status of wireless devices, the security policy configuration module precisely controls communication behavior between devices through preset network communication policies, allowing only policy-compliant communication to proceed normally, while blocking unauthorized communication. Simultaneously, the monitoring and alarm module collects real-time device operating status data and alarm information, and promptly notifies administrators after data fusion. The security situation analysis module aggregates device operating status, alarm information, and communication traffic information, displaying it in the form of a network topology map, supporting administrators to drill down and locate security vulnerabilities. The log auditing module comprehensively records user operation logs, device authentication logs, and operation logs, and supports querying and auditing these logs, providing complete data support for security incident tracing and compliance auditing.

[0070] The network communication strategy controls communication between devices by configuring a five-tuple of information: source device IP, source device port, destination device IP, destination device port, and communication protocol.

[0071] In this embodiment, the two-way authentication process based on asymmetric keys is as follows: Figure 2 As shown, the specific authentication steps are as follows:

[0072] T1. The device generates a random number RandomA, and concatenates the device's unique identifier DeviceId with RandomA to form concatenated information (DeviceId|RandomA). First, the concatenated information is encrypted with the platform's encryption public key to obtain the EncA value, and then the concatenated information is signed with its own signing private key to obtain the SigA value.

[0073] T2. The device initiates a two-way authentication request to the wireless network security management system platform (hereinafter referred to as the "platform"), submitting the EncA value and SigA value as core parameters together.

[0074] T3. After receiving the two-way authentication request, the platform immediately parses out the EncA and SigA values.

[0075] T4. The platform calls its own encrypted private key to decrypt the EncA value: if decryption is successful, the concatenated information (DeviceId|RandomA) is extracted; if decryption fails, the device authentication is directly determined to be unsuccessful, and the process jumps to step T6.

[0076] T5. The platform queries the signature public key and encryption public key value corresponding to the device based on the DeviceId obtained by decryption, and uses the signature public key value of the device to verify the concatenated information (DeviceId|RandomA) and SigA value: if the verification is successful, the device authentication is successful; if the verification fails, the device authentication is deemed unsuccessful.

[0077] T6. The platform stores and records the authentication result of this device.

[0078] T7. Only when the device authentication is successful, the platform generates a random number RandomB, concatenates DeviceId and RandomB to form concatenated information (DeviceId|RandomB), first encrypts the concatenated information with the device's public key to obtain the EncB value, and then signs the concatenated information with its own signing private key to obtain the SigB value.

[0079] T8. The platform returns a response result to the device: If the authentication process is normal, it returns the EncB value and SigB value; if an error occurs in step T4 or step T5, it returns the corresponding error code and error description.

[0080] T9. After receiving the response data from the platform, the device parses out the EncB and SigB values ​​(if it is an abnormal response, it directly records the authentication failure).

[0081] T10. The device calls its own encrypted private key to decrypt the EncB value: If decryption is successful, the concatenated information (DeviceId|RandomB) is extracted; if decryption fails, the two-way authentication is determined to have failed, and the process jumps to step T12.

[0082] T11. The device uses the platform's signature public key value to verify the concatenated information (DeviceId|RandomB) and SigB value: if the verification is successful, the two-way authentication is successful; if the verification fails, the two-way authentication fails.

[0083] T12. The device stores the result of this two-way authentication to provide a basis for subsequent network access, communication and other operations.

[0084] The application scenarios of this invention are as follows:

[0085] In the operation and maintenance scenario of wireless network in enterprise parks, this invention accurately identifies legitimate devices and blocks unauthorized access through two-way identity authentication and whitelist management, ensuring the security of internal core data transmission.

[0086] In the scenario of interconnection of wireless devices in the Industrial Internet of Things, this invention uses key lifecycle management and communication policy configuration to achieve secure access and compliant communication of devices such as sensors and controllers, and prevents devices from being hijacked and tampered with.

[0087] In public area wireless network service scenarios, this invention monitors the status of access devices in real time through dynamic heartbeat authentication and situational analysis, quickly handles abnormal access behavior, and reduces the risk of network attacks.

[0088] In the scenario of network deployment of operator base stations and terminal equipment, this invention relies on multi-module collaboration and log auditing functions to realize full-process security management of base stations, CPE and other equipment, and ensure the stability and security of wireless network coverage;

[0089] In the scenario of wireless terminal access in smart campuses, this invention regulates the network access behavior of teachers' and students' terminals and teaching equipment through user permission hierarchy and device communication control, thereby preventing the abuse of campus network resources.

[0090] It should be noted that the method of this embodiment can be applied to a distributed scenario, where multiple devices cooperate to complete the task. In such a distributed scenario, one of these devices may execute only one or more steps of the method in this embodiment, and the multiple devices will interact with each other to complete the method described.

[0091] It should be noted that the above description describes some embodiments of this disclosure. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in a different order than that shown in the above embodiments and still achieve the desired result. Furthermore, the processes depicted in the drawings do not necessarily require a specific or sequential order to achieve the desired result. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0092] Example 2

[0093] See Figure 3 Embodiment 2 of the present invention also provides a wireless network security management system, comprising:

[0094] The system requests the following modules: Gateway Module 001, System Initialization Module 002, Device Management Module 003, Security Policy Configuration Module 004, Monitoring and Alarm Module 005, Key Management Module 006, Security Situation Analysis Module 007, User Access Management Module 008, and Log Audit Module 009.

[0095] The request gateway module 001 is used to receive HTTPS requests from wireless devices and clients; after passing whitelist verification, identity authentication, and permission verification, it forwards the HTTPS request to the designated module and returns the response data to the requester;

[0096] The system initialization module 002 is used to initialize the key management system parameters and administrator user information on the platform side, and call the key management module to generate and configure asymmetric key pairs on the platform side.

[0097] The device management module 003 is used to input, store and manage the basic information of the wireless device; it supports adding, deleting, modifying and querying the basic information, and supports device key query and device registration status verification functions.

[0098] The security policy configuration module 004 is used to configure the device network access whitelist, and to manage the access of wireless devices through the device network access whitelist; to configure the network communication policy based on the five-tuple information; and to manage communication between devices through the network communication policy.

[0099] The monitoring and alarm module 005 is used to collect the operating status data and alarm information of the wireless device in real time; after fusing the operating status data and alarm information, it notifies the management personnel for processing;

[0100] The key management module 006 is used to generate a platform-side signature asymmetric key pair and a platform-side encryption asymmetric key pair for the platform side; and to generate a device-side signature asymmetric key pair and a device-side encryption asymmetric key pair for each wireless device to be accessed, thereby realizing key application, destruction, update and synchronization;

[0101] The security situation analysis module 007 is used to aggregate the operating status information, alarm information and communication traffic information of the wireless device to generate a device network topology map; the device network topology map is displayed and supports information drill-down query and security risk location;

[0102] The user permission management module 008 is used to manage system user accounts and role information; and works with the request gateway module to perform user identity authentication and permission verification.

[0103] The log auditing module 009 is used to record user operation logs, device authentication logs, and operation logs, and supports log query and auditing operations.

[0104] It should be noted that the information interaction and execution process between the modules of the above system are based on the same concept as the method embodiment in Embodiment 1 of this application, and the resulting technical effects are the same as those in the method embodiment of this application. For details, please refer to the description in the method embodiment shown above in this application, and it will not be repeated here.

[0105] Example 3

[0106] Embodiment 3 of the present invention provides a non-transitory computer-readable storage medium storing program code of a wireless network security management method. The program code includes instructions for executing the wireless network security management method of Embodiment 1 or any possible implementation thereof.

[0107] Computer-readable storage media can be any available medium that a computer can access, or a data storage device such as a server or data center that integrates one or more available media. The available medium can be magnetic media (e.g., floppy disks, hard disks, magnetic tapes), optical media (e.g., DVDs), or semiconductor media (e.g., solid-state drives (SSDs)).

[0108] Example 4

[0109] Embodiment 4 of the present invention provides an electronic device, including: a memory and a processor;

[0110] The processor and the memory communicate with each other via a bus; the memory stores program instructions that can be executed by the processor, and the processor can execute a wireless network security management method according to Embodiment 1 or any possible implementation thereof by calling the program instructions.

[0111] Specifically, a processor can be implemented in hardware or software. When implemented in hardware, the processor can be a logic circuit, an integrated circuit, etc. When implemented in software, the processor can be a general-purpose processor that reads software code stored in memory. This memory can be integrated into the processor or located outside the processor and exist independently.

[0112] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented in software, it can be implemented, in whole or in part, as a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of the present invention are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable system. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means.

[0113] It is obvious to those skilled in the art that the modules or steps of the present invention described above can be implemented using general-purpose computing systems. They can be centralized on a single computing system or distributed across a network of multiple computing systems. Optionally, they can be implemented using program code executable by a computing system, thereby storing them in a storage system for execution by the computing system. In some cases, the steps shown or described can be performed in a different order than those presented herein, or they can be fabricated as separate integrated circuit modules, or multiple modules or steps can be fabricated as a single integrated circuit module. Thus, the present invention is not limited to any particular combination of hardware and software.

[0114] Although the present invention has been described in detail above with general descriptions and specific embodiments, modifications or improvements can be made to it, which will be obvious to those skilled in the art. Therefore, all such modifications or improvements made without departing from the spirit of the present invention fall within the scope of protection claimed by the present invention.

Claims

1. A wireless network security management method, characterized in that, include: The system initialization module initializes the key management system parameters and administrator user information on the platform. The platform-side signature asymmetric key pair and the platform-side encryption asymmetric key pair are generated and configured by calling the key management module. The key management module generates a device-side signature asymmetric key pair and a device-side encryption asymmetric key pair for the wireless device to be connected. Enter and store basic information about wireless devices through the wireless device management module; Based on the signature asymmetric key pair and encryption asymmetric key pair on the device and platform sides, before accessing the wireless network, the wireless device initiates a two-way authentication request to the platform side through the request gateway module; the authentication request includes first encryption information and first signature information. The platform decrypts the first encrypted information in the authentication request using its private encryption key to obtain the device's unique identifier. Based on the unique identifier of the device, the corresponding device-side signature public key is queried, and the first signature information in the authentication request is verified using the device-side signature public key to complete the identity authentication of the wireless device. After the device authentication is successful, the platform generates a second random number and concatenates the second random number with the device's unique identifier to form a second concatenated information. The second concatenated information is then encrypted and signed using the device's encryption public key and the platform's signing private key, respectively, to form a second encrypted information and a second signed information, which are then returned to the device via the request gateway module. The device decrypts the second encrypted information using its private key and verifies the second signature information using the platform's public key, thus completing the authentication of the platform's identity. After two-way authentication is completed, the wireless device is allowed to access the wireless network by combining the device whitelist configured in the security policy configuration module and the device registration status in the wireless device management module; the system administrator logs into the system through the user permission management module and performs administrator identity authentication and permission verification in combination with the request gateway module. After the wireless device is connected, it will perform heartbeat communication and two-way authentication with the platform at the set frequency. Based on the status of wireless devices accessing the wireless network, the network communication policy configured by the security policy configuration module is used to control communication between devices; the monitoring and alarm module, security situation analysis module, and log auditing module are used to monitor the operating status of wireless devices, analyze security situation, and audit user operations and device logs, respectively.

2. The wireless network security management method according to claim 1, characterized in that, The platform-side signature asymmetric key pair includes: a platform-side signature public key and a platform-side signature private key; the platform-side encryption asymmetric key pair includes: a platform-side encryption public key and a platform-side encryption private key; the device-side signature asymmetric key pair includes: a device-side signature public key and a device-side signature private key; the device-side encryption asymmetric key pair includes: a device-side encryption public key and a device-side encryption private key.

3. The wireless network security management method according to claim 2, characterized in that, The basic information of a wireless device includes: device name, device type, device unique identifier, device serial number, device International Mobile Equipment Identity (IMEI), device IP address, device MAC address, and device manufacturer information.

4. The wireless network security management method according to claim 3, characterized in that, The device's unique identifier is concatenated with a first random number to generate first concatenated information; the first concatenated information is encrypted using the platform's public key to generate first encrypted information; and the first concatenated information is signed using the device's private key to generate first signed information.

5. The wireless network security management method according to claim 4, characterized in that, After receiving the two-way authentication request, the request gateway module performs a preliminary verification of the wireless device through the device network access whitelist; after the verification is successful, the request gateway module forwards the two-way authentication request to the platform for authentication.

6. The wireless network security management method according to claim 5, characterized in that, In the process of controlling communication between devices through the network communication policy configured by the security policy configuration module, the network communication policy controls communication between devices by configuring the five-tuple information of source device IP, source device port, destination device IP, destination device port, and communication protocol.

7. A wireless network security management method according to claim 6, characterized in that, After a wireless device connects to the wireless network, each heartbeat communication is initiated through the request gateway module and undergoes a two-way authentication process.

8. The wireless network security management method according to claim 7, characterized in that, During the process of performing security situation analysis on wireless devices through the security situation analysis module, the security situation analysis module generates a device network topology map by collecting, aggregating, and statistically analyzing the operating status information, alarm information, and communication traffic information of wireless devices. The network topology of the devices is displayed and supports drill-down queries.

9. A wireless network security management method according to claim 8, characterized in that, The logs recorded by the log auditing module include: user operation logs, wireless device authentication logs, and operation logs; the log auditing module supports querying and auditing operations on the logs.

10. A wireless network security management system, characterized in that, include: The system includes a request gateway module, a system initialization module, a device management module, a security policy configuration module, a monitoring and alarm module, a key management module, a security posture analysis module, a user permission management module, and a log auditing module. The request gateway module is used to receive HTTPS requests from wireless devices and clients; after passing whitelist verification, identity authentication, and permission verification, it forwards the HTTPS request to the designated module and returns the response data to the requester; The system initialization module is used to initialize the key management system parameters and administrator user information on the platform side, and to call the key management module to generate and configure asymmetric key pairs on the platform side. The device management module is used to input, store and manage the basic information of wireless devices; it supports adding, deleting, modifying and querying the basic information, and supports device key query and device registration status verification functions. The security policy configuration module is used to configure the device network access whitelist, and to control the access of wireless devices through the device network access whitelist; and to configure the network communication policy based on the five-tuple information. The network connectivity strategy is used to manage and control communication between devices. The monitoring and alarm module is used to collect the operating status data and alarm information of wireless devices in real time. After fusing the operational status data and the alarm information, the administrator is notified to handle the matter. The key management module is used to generate a platform-side signature asymmetric key pair and a platform-side encryption asymmetric key pair for the platform. For each wireless device to be connected, a device-side signature asymmetric key pair and a device-side encryption asymmetric key pair are generated to enable key application, destruction, update and synchronization. The security situation analysis module is used to aggregate the operating status information, alarm information and communication traffic information of the wireless device to generate a device network topology map; The network topology of the devices is displayed and supports drill-down queries and security vulnerability location. The user permission management module is used to manage system user accounts and role information; and works with the request gateway module to perform user identity authentication and permission verification. The log auditing module is used to record user operation logs, device authentication logs, and operation logs, and supports log querying and auditing operations.

Images