A wireless network security management method and system

Abstract

The application discloses a wireless network security management method and system, wherein a system initialization module completes initialization, a key management module is called to generate a signature and an encryption asymmetric key pair of a platform end and a wireless device, and a wireless device management module enters and stores device basic information. Before the wireless device accesses, a request gateway module initiates an authentication request containing first encryption information and first signature information, the platform end decrypts and verifies the signature to complete device authentication, and returns second encryption information and second signature information, and the device end decrypts and verifies the signature to complete bidirectional authentication. In combination with a white list and a device registration state, network access is allowed, an administrator completes identity authentication and permission verification through a user permission management module and the request gateway module. After the device accesses the network, regular heartbeat communication and bidirectional authentication are carried out, device communication is controlled through a network communication strategy, and operation monitoring, situation analysis and log auditing are synchronously carried out. The application solves the problems of high security risks in access and operation and maintenance management in the prior art.

Description

Technical Field

[0001] This invention relates to the field of wireless network management technology, and more specifically to a wireless network security management method and system. Background Technology

[0002] Current authentication mechanisms for wireless network device management primarily rely on two main application schemes: one uses a combination of a unique device identifier and a static password to verify identity by confirming the consistency between the device's unique identifier and the preset static password; the other uses a complex algorithm built based on the device's unique identifier and random numbers to verify identity by comparing the results of the calculations performed on the device and the server. These two schemes are widely used in network access authentication and operation and maintenance management scenarios for various wireless devices such as core networks, base stations, CPEs, and wireless terminals, and are common technical means to ensure the security of basic wireless network access.

[0003] However, existing technical solutions have significant security flaws and application limitations: In the first type of solution, static passwords are easily obtained illegally due to improper management or transmission leaks. Once the password is leaked, attackers can directly forge device identities to access the network. While the second type of solution introduces complex algorithms to increase the difficulty of cracking, if the algorithm itself has design flaws or can be reverse-engineered, the entire authentication mechanism will fail. The common risk of both types of solutions is that they rely on the security of a single authentication dimension and lack two-way verification and dynamic protection mechanisms. Once the password or algorithm is compromised, the authentication process faces the risk of being bypassed, thus posing a serious security threat to wireless network access control, data transmission, and operation and maintenance management, and failing to meet the high security requirements of wireless networks for device identity authentication.

[0004] Therefore, there is an urgent need for a wireless network security management method to address the high security risks in access and operation and maintenance management of existing technologies. Summary of the Invention

[0005] To address these issues, the present invention provides a wireless network security management method and system that solves the problems of existing wireless network device authentication relying on a single dimension, lacking two-way and dynamic protection, being easily compromised due to password or algorithm leakage, and resulting in high security risks in access and operation and maintenance management.

[0006] To achieve the above objectives, the present invention provides the following technical solution: a wireless network security management method, characterized in that it includes:

[0007] The system initialization module initializes the key management system parameters and administrator user information on the platform side; it generates and configures the platform-side signature asymmetric key pair and the platform-side encryption asymmetric key pair by calling the key management module; it generates the device-side signature asymmetric key pair and the device-side encryption asymmetric key pair for the wireless devices to be connected by the key management module; and it records and stores the basic information of the wireless devices by the wireless device management module.

[0008] Based on the signature asymmetric key pair and encryption asymmetric key pair on the device and platform sides, before accessing the wireless network, the wireless device initiates a two-way authentication request to the platform side through the request gateway module; the authentication request includes first encryption information and first signature information.

[0009] The platform decrypts the first encrypted information in the authentication request using the platform's encrypted private key to obtain the device's unique identifier; it then queries the corresponding device signature public key based on the device's unique identifier and verifies the first signature information in the authentication request using the device signature public key to complete the authentication of the wireless device.

[0010] After the device authentication is successful, the platform generates a second random number and concatenates the second random number with the device's unique identifier to form a second concatenated information. The second concatenated information is then encrypted and signed using the device's encryption public key and the platform's signing private key, respectively, to form a second encrypted information and a second signed information, which are then returned to the device via the request gateway module.

[0011] The device decrypts the second encrypted information using its private key and verifies the second signature information using the platform's public key, thus completing the authentication of the platform's identity.

[0012] After two-way authentication is completed, the wireless device is allowed to access the wireless network by combining the device whitelist configured in the security policy configuration module and the device registration status in the wireless device management module; the system administrator logs into the system through the user permission management module and performs administrator identity authentication and permission verification in combination with the request gateway module; after the wireless device is connected, it performs heartbeat communication and two-way authentication process with the platform at a set frequency.

[0013] Based on the status of wireless devices accessing the wireless network, the network communication policy configured by the security policy configuration module is used to control communication between devices; the monitoring and alarm module, security situation analysis module, and log auditing module are used to monitor the operating status of wireless devices, analyze security situation, and audit user operations and device logs, respectively.

[0014] As a preferred embodiment of a wireless network security management method, the platform-side signature asymmetric key pair includes: a platform-side signature public key and a platform-side signature private key; the platform-side encryption asymmetric key pair includes: a platform-side encryption public key and a platform-side encryption private key; the device-side signature asymmetric key pair includes: a device-side signature public key and a device-side signature private key; the device-side encryption asymmetric key pair includes: a device-side encryption public key and a device-side encryption private key.

[0015] As a preferred solution for wireless network security management, the basic information of the wireless device includes: device name, device type, device unique identifier, device serial number, device International Mobile Equipment Identity (IMEI), device IP address, device MAC address, and device manufacturer information.

[0016] As a preferred solution for wireless network security management, the device's unique identifier is concatenated with a first random number to generate first concatenated information; the first concatenated information is encrypted using the platform's public key to generate first encrypted information; and the first concatenated information is signed using the device's private key to generate first signed information.

[0017] As a preferred solution for wireless network security management, after receiving a two-way authentication request, the request gateway module performs a preliminary verification of the wireless device through the device access whitelist; after the verification is successful, the request gateway module forwards the two-way authentication request to the platform for authentication.

[0018] As a preferred solution for wireless network security management, in the process of controlling communication between devices through the network communication policy configured by the security policy configuration module, the network communication policy controls communication between devices by configuring a five-tuple of information: source device IP, source device port, destination device IP, destination device port, and communication protocol.

[0019] As a preferred solution for wireless network security management, after a wireless device connects to the wireless network, each heartbeat communication is initiated through the request gateway module and a two-way authentication process is performed.

[0020] As a preferred solution for wireless network security management, during the security situation analysis of wireless devices through the security situation analysis module, the security situation analysis module collects, aggregates, and statistically analyzes the operating status information, alarm information, and communication traffic information of the wireless devices to generate a device network topology map; the device network topology map is then displayed and supports drill-down queries.

[0021] As a preferred solution for wireless network security management, the log auditing module records logs including: user operation logs, wireless device authentication logs, and operation logs; the log auditing module supports querying and auditing operations on the logs.

[0022] The present invention also provides a wireless network security management system, comprising:

[0023] The system includes a request gateway module, a system initialization module, a device management module, a security policy configuration module, a monitoring and alarm module, a key management module, a security posture analysis module, a user permission management module, and a log auditing module.

[0024] The request gateway module is used to receive HTTPS requests from wireless devices and clients; after passing whitelist verification, identity authentication, and permission verification, it forwards the HTTPS request to the designated module and returns the response data to the requester;

[0025] The system initialization module is used to initialize the key management system parameters and administrator user information on the platform side, and to call the key management module to generate and configure asymmetric key pairs on the platform side.

[0026] The device management module is used to input, store and manage the basic information of the wireless device; it supports adding, deleting, modifying and querying the basic information, and supports device key query and device registration status verification functions.

[0027] The security policy configuration module is used to configure the device network access whitelist, and to manage the access of wireless devices through the device network access whitelist; to configure the network communication policy based on the five-tuple information; and to manage communication between devices through the network communication policy.

[0028] The monitoring and alarm module is used to collect the operating status data and alarm information of the wireless device in real time; after fusing the operating status data and alarm information, it notifies the management personnel for processing;

[0029] The key management module is used to generate a platform-side signed asymmetric key pair and a platform-side encrypted asymmetric key pair for the platform; and to generate a device-side signed asymmetric key pair and a device-side encrypted asymmetric key pair for each wireless device to be connected, thereby realizing key application, destruction, update and synchronization;

[0030] The security situation analysis module is used to aggregate the operating status information, alarm information, and communication traffic information of the wireless devices to generate a device network topology map; the device network topology map is displayed and supports information drill-down query and security risk location;

[0031] The user permission management module is used to manage system user accounts and role information; and works with the request gateway module to perform user identity authentication and permission verification.

[0032] The log auditing module is used to record user operation logs, device authentication logs, and operation logs, and supports log querying and auditing operations.

[0033] The present invention has the following advantages:

[0034] First, this invention adopts asymmetric key two-way identity authentication, combined with the full process verification of device network access and heartbeat communication, to strengthen identity authentication security from the root and eliminate the risk of a single authentication dimension being compromised.

[0035] Secondly, this invention achieves precise authorization for device access and communication through dual control of network access whitelist and five-tuple network communication strategy, reducing the risk of unauthorized access and illegal communication.

[0036] Third, this invention integrates device management, security monitoring, situation analysis, and log auditing through multi-module collaboration, comprehensively covering network security management scenarios and improving operational efficiency and risk handling speed.

[0037] Fourth, the key management system of the present invention supports full lifecycle management of keys, ensuring key uniqueness and dynamic updates, and further strengthening the network security protection barrier. Attached Figure Description

[0038] To more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings in the following description are merely exemplary, and those skilled in the art can derive other embodiments based on the provided drawings without creative effort.

[0039] The structures, proportions, sizes, etc. illustrated in this specification are only for the purpose of assisting those skilled in the art in understanding and reading the content disclosed herein, and are not intended to limit the conditions under which the present invention can be implemented. Therefore, they have no substantial technical significance. Any modifications to the structure, changes in the proportions, or adjustments to the size, without affecting the effects and objectives that the present invention can produce, should still fall within the scope of the technical content disclosed in the present invention.

[0040] Figure 1 This is a flowchart illustrating a wireless network security management method provided in Embodiment 1 of the present invention;

[0041] Figure 2This is a schematic diagram of the two-way authentication process based on asymmetric keys in a wireless network security management method provided in Embodiment 1 of the present invention;

[0042] Figure 3 This is a schematic diagram of the architecture of a wireless network security management system provided in Embodiment 2 of the present invention. Detailed Implementation

[0043] The following specific embodiments illustrate the implementation of the present invention. Those skilled in the art can easily understand other advantages and effects of the present invention from the content disclosed in this specification. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0044] Example 1

[0045] See Figure 1 Embodiment 1 of the present invention provides a wireless network security management method, comprising the following steps:

[0046] S1. Initialize the key management system parameters and administrator user information on the platform through the system initialization module; generate and configure the platform-side signature asymmetric key pair and the platform-side encryption asymmetric key pair by calling the key management module; generate the device-side signature asymmetric key pair and the device-side encryption asymmetric key pair for the wireless device to be connected through the key management module; and input and store the basic information of the wireless device through the wireless device management module.

[0047] S2. Based on the signature asymmetric key pair and encryption asymmetric key pair of the device and the platform, before accessing the wireless network, the wireless device initiates a two-way authentication request to the platform through the request gateway module; the authentication request includes first encryption information and first signature information.

[0048] S3. The platform decrypts the first encrypted information in the authentication request using the platform's encrypted private key to obtain the device's unique identifier; it queries the corresponding device's signature public key based on the device's unique identifier, and verifies the first signature information in the authentication request using the device's signature public key to complete the authentication of the wireless device.

[0049] S4. After the device-side identity authentication is successful, the platform generates a second random number and concatenates the second random number with the device's unique identifier to form a second concatenated information. The second concatenated information is then encrypted and signed using the device-side encryption public key and the platform-side signing private key, respectively, to form second encrypted information and second signed information, which are then returned to the device-side via the request gateway module.

[0050] S5. The device decrypts the second encrypted information using its private key and verifies the second signature information using the platform's public key, thus completing the authentication of the platform's identity.

[0051] S6. After two-way authentication is completed, the wireless device is allowed to access the wireless network by combining the device access whitelist configured in the security policy configuration module and the device registration status in the wireless device management module; the system administrator logs into the system through the user permission management module and performs administrator identity authentication and permission verification in combination with the request gateway module; after the wireless device accesses the network, it performs heartbeat communication and two-way authentication process with the platform at a set frequency.

[0052] S7. Based on the status of wireless devices accessing the wireless network, control the communication between devices through the network communication policy configured by the security policy configuration module; and monitor the operating status, analyze the security situation, and audit user operations and device logs of the wireless devices through the monitoring and alarm module, the security situation analysis module, and the log auditing module, respectively.

[0053] In this embodiment, in step S1, the system initialization module initializes the key management system parameters and administrator user information on the platform side; the key management module generates and configures the platform side signature asymmetric key pair and the platform side encryption asymmetric key pair; the key management module generates the device side signature asymmetric key pair and the device side encryption asymmetric key pair for the wireless device to be connected; and the wireless device management module records and stores the basic information of the wireless device.

[0054] Specifically, after the system initialization module starts, it prioritizes the standardized initialization of core operating parameters of the platform-side key management system, such as key generation algorithms, key validity periods, and basic information like administrator user accounts and initial permissions, ensuring that the core system components are ready for operation. Subsequently, the system calls the key management module to generate platform-specific signature asymmetric key pairs and encryption asymmetric key pairs according to preset encryption standards, and completes the key binding configuration on the platform. Simultaneously, the key management module generates a unique device-side signature asymmetric key pair and device-side encryption asymmetric key pair for each wireless device to be connected, ensuring unique identification for device and platform authentication. Finally, the wireless device management module records and stores basic information about the wireless devices, providing data support for subsequent device identification and access control.

[0055] The platform-side signature asymmetric key pair includes: a platform-side signature public key and a platform-side signature private key; the platform-side encryption asymmetric key pair includes: a platform-side encryption public key and a platform-side encryption private key; the device-side signature asymmetric key pair includes: a device-side signature public key and a device-side signature private key; the device-side encryption asymmetric key pair includes: a device-side encryption public key and a device-side encryption private key.

[0056] The basic information of a wireless device includes: device name, device type, device unique identifier, device serial number, device International Mobile Equipment Identity (IMEI), device IP address, device MAC address, and device manufacturer information.

[0057] In this embodiment, in step S2, based on the signature asymmetric key pair and encryption asymmetric key pair of the device and the platform, the wireless device initiates a two-way authentication request to the platform through the request gateway module before accessing the wireless network; the authentication request includes first encryption information and first signature information.

[0058] Specifically, based on the asymmetric key pair between the device and the platform generated in step S1, before initiating a network access request, the wireless device first generates a first random number, concatenates its own unique identifier with the first random number to form first concatenated information, and then encrypts this first concatenated information using the platform's encryption public key to generate first encrypted information; simultaneously, it signs the first concatenated information using its own device-side signing private key to generate first signed information. Subsequently, the wireless device uses the first encrypted information and the first signed information as core parameters to initiate a two-way authentication request to the platform through the request gateway module. After receiving the two-way authentication request, the request gateway module performs a preliminary verification of the wireless device using the device network access whitelist; after successful verification, the request gateway module forwards the two-way authentication request to the platform for authentication.

[0059] In this embodiment, in step S3, the platform decrypts the first encrypted information in the authentication request using the platform's encrypted private key to obtain a unique device identifier; it then queries the corresponding device signature public key based on the unique device identifier and verifies the first signature information in the authentication request using the device signature public key to complete the authentication of the wireless device.

[0060] Specifically, after receiving the authentication request forwarded in step S2, the platform first uses its stored platform-side encrypted private key to decrypt the first encrypted information in the request. If decryption is successful, it extracts the device's unique identifier and a first random number; if decryption fails, it directly determines that the device authentication has failed. Subsequently, based on the device's unique identifier obtained through decryption, the platform queries the corresponding device-side signature public key through the wireless device management module. It then uses this device-side signature public key to verify the first signature information in the authentication request, confirming whether the first concatenated information has been tampered with and whether it was genuinely initiated by the device. When decryption and signature verification are successful, the wireless device's identity authentication is completed; failure at any step terminates the authentication process.

[0061] In this embodiment, in step S4, after the device authentication is successful, the platform generates a second random number and concatenates the second random number with the device's unique identifier to form second concatenated information. The second concatenated information is then encrypted and signed using the device's encryption public key and the platform's signing private key, respectively, to form second encrypted information and second signed information, which are then returned to the device via the request gateway module.

[0062] Specifically, after confirming the device's identity in step S3, the platform generates a second random number and concatenates it with the device's unique identifier to form second concatenated information, ensuring the uniqueness and relevance of the feedback information. Subsequently, the platform encrypts the second concatenated information using the device's public encryption key configured in step S1, generating second encrypted information. Simultaneously, it signs the second concatenated information using its own platform-side signing private key, generating second signed information. Finally, the platform returns the second encrypted information and the second signed information to the device via the request gateway module, providing the device with decryptable and signature-verifiable credentials to verify the platform's identity.

[0063] In this embodiment, in step S5, the device decrypts the second encrypted information using its private encryption key and verifies the second signature information using the platform's public signature key, thus completing the authentication of the platform's identity.

[0064] Specifically, after receiving the second encrypted information and the second signature information returned in step S4, the device first uses its stored device-side encryption private key to decrypt the second encrypted information. If decryption is successful, it extracts the second random number and the device's unique identifier to confirm that the information source is related to itself. If decryption fails, it determines that the platform's identity is illegitimate and terminates the network access process. Subsequently, the device verifies the second signature information using the platform's signature public key configured in step S1 to verify whether the second concatenated information has been tampered with and whether it was genuinely sent by the target platform. When decryption is successful and signature verification is passed, the identity authentication of the platform is completed, and the two-way identity authentication between the device and the platform is now complete.

[0065] In this embodiment, in step S6, after the two-way authentication is completed, the wireless device is allowed to access the wireless network by combining the device access whitelist configured in the security policy configuration module and the device registration status in the wireless device management module; the system administrator logs into the system through the user permission management module and performs administrator identity authentication and permission verification in combination with the request gateway module; after the wireless device accesses the network, it performs heartbeat communication and two-way authentication process with the platform at a set frequency.

[0066] Specifically, after two-way authentication is completed, the system first queries the device whitelist in the security policy configuration module and simultaneously verifies the device's registration status in the wireless device management module. Only when the device is both on the whitelist and its registration status is valid is it allowed to access the wireless network. At the same time, the system administrator needs to initiate a login request by entering account information through the user permission management module, requesting the gateway module to collaborate with the user permission management module to complete the administrator's identity authentication and permission verification, authorizing only the administrator to perform operations such as whitelist modification and policy configuration. After the wireless device successfully accesses the network, it will conduct heartbeat communication with the platform at preset time intervals. During each heartbeat communication, the two-way authentication process of steps S2-S5 is repeated to ensure the continued validity of the device's identity after access.

[0067] Each heartbeat communication is initiated through the request gateway module.

[0068] In this embodiment, in step S7, based on the status of the wireless device accessing the wireless network, the network communication policy configured by the security policy configuration module is used to control the communication between devices; the monitoring and alarm module, security situation analysis module, and log auditing module are used to monitor the operating status of the wireless device, analyze the security situation, and audit user operations and device logs, respectively.

[0069] Specifically, based on the network connectivity status of wireless devices, the security policy configuration module precisely controls communication behavior between devices through preset network communication policies, allowing only policy-compliant communication to proceed normally, while blocking unauthorized communication. Simultaneously, the monitoring and alarm module collects real-time device operating status data and alarm information, and promptly notifies administrators after data fusion. The security situation analysis module aggregates device operating status, alarm information, and communication traffic information, displaying it in the form of a network topology map, supporting administrators to drill down and locate security vulnerabilities. The log auditing module comprehensively records user operation logs, device authentication logs, and operation logs, and supports querying and auditing these logs, providing complete data support for security incident tracing and compliance auditing.

[0070] The network communication strategy controls communication between devices by configuring a five-tuple of information: source device IP, source device port, destination device IP, destination device port, and communication protocol.

[0071] In this embodiment, the two-way authentication process based on asymmetric keys is as follows: Figure 2 As shown, the specific authentication steps are as follows:

[0072] T1. The device generates a random number RandomA, and concatenates the device's unique identifier DeviceId with RandomA to form concatenated information (DeviceId|RandomA). First, the concatenated information is encrypted with the platform's encryption public key to obtain the EncA value, and then the concatenated information is signed with its own signing private key to obtain the SigA value.

[0073] T2. The device initiates a two-way authentication request to the wireless network security management system platform (hereinafter referred to as the "platform"), submitting the EncA value and SigA value as core parameters together.

[0074] T3. After receiving the two-way authentication request, the platform immediately parses out the EncA and SigA values.

[0075] T4. The platform calls its own encrypted private key to decrypt the EncA value: if decryption is successful, the concatenated information (DeviceId|RandomA) is extracted; if decryption fails, the device authentication is directly determined to be unsuccessful, and the process jumps to step T6.

[0076] T5. The platform queries the signature public key and encryption public key value corresponding to the device based on the DeviceId obtained by decryption, and uses the signature public key value of the device to verify the concatenated information (DeviceId|RandomA) and SigA value: if the verification is successful, the device authentication is successful; if the verification fails, the device authentication is deemed unsuccessful.

[0077] T6. The platform stores and records the authentication result of this device.

[0078] T7. Only when the device authentication is successful, the platform generates a random number RandomB, concatenates DeviceId and RandomB to form concatenated information (DeviceId|RandomB), first encrypts the concatenated information with the device's public key to obtain the EncB value, and then signs the concatenated information with its own signing private key to obtain the SigB value.

[0079] T8. The platform returns a response result to the device: If the authentication process is normal, it returns the EncB value and SigB value; if an error occurs in step T4 or step T5, it returns the corresponding error code and error description.

[0080] T9. After receiving the response data from the platform, the device parses out the EncB and SigB values ​​(if it is an abnormal response, it directly records the authentication failure).

[0081] T10. The device calls its own encrypted private key to decrypt the EncB value: If decryption is successful, the concatenated information (DeviceId|RandomB) is extracted; if decryption fails, the two-way authentication is determined to have failed, and the process jumps to step T12.

[0082] T11. The device uses the platform's signature public key value to verify the concatenated information (DeviceId|RandomB) and SigB value: if the verification is successful, the two-way authentication is successful; if the verification fails, the two-way authentication fails.

[0083] T12. The device stores the result of this two-way authentication to provide a basis for subsequent network access, communication and other operations.

[0084] The application scenarios of this invention are as follows:

[0085] In the operation and maintenance scenario of wireless network in enterprise parks, this invention accurately identifies legitimate devices and blocks unauthorized access through two-way identity authentication and whitelist management, ensuring the security of internal core data transmission.

[0086] In the scenario of interconnection of wireless devices in the Industrial Internet of Things, this invention uses key lifecycle management and communication policy configuration to achieve secure access and compliant communication of devices such as sensors and controllers, and prevents devices from being hijacked and tampered with.

[0087] In public area wireless network service scenarios, this invention monitors the status of access devices in real time through dynamic heartbeat authentication and situational analysis, quickly handles abnormal access behavior, and reduces the risk of network attacks.

[0088] In the scenario of network deployment of operator base stations and terminal equipment, this invention relies on multi-module collaboration and log auditing functions to realize full-process security management of base stations, CPE and other equipment, and ensure the stability and security of wireless network coverage;

[0089] In the scenario of wireless terminal access in smart campuses, this invention regulates the network access behavior of teachers' and students' terminals and teaching equipment through user permission hierarchy and device communication control, thereby preventing the abuse of campus network resources.

[0090] It should be noted that the method of this embodiment can be applied to a distributed scenario, where multiple devices cooperate to complete the task. In such a distributed scenario, one of these devices may execute only one or more steps of the method in this embodiment, and the multiple devices will interact with each other to complete the method described.

[0091] It should be noted that the above description describes some embodiments of this disclosure. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in a different order than that shown in the above embodiments and still achieve the desired result. Furthermore, the processes depicted in the drawings do not necessarily require a specific or sequential order to achieve the desired result. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0092] Example 2

[0093] See Figure 3 Embodiment 2 of the present invention also provides a wireless network security management system, comprising:

[0094] The system requests the following modules: Gateway Module 001, System Initialization Module 002, Device Management Module 003, Security Policy Configuration Module 004, Monitoring and Alarm Module 005, Key Management Module 006, Security Situation Analysis Module 007, User Access Management Module 008, and Log Audit Module 009.

[0095] The request gateway module 001 is used to receive HTTPS requests from wireless devices and clients; after passing whitelist verification, identity authentication, and permission verification, it forwards the HTTPS request to the designated module and returns the response data to the requester;

[0096] The system initialization module 002 is used to initialize the key management system parameters and administrator user information on the platform side, and call the key management module to generate and configure asymmetric key pairs on the platform side.

[0097] The device management module 003 is used to input, store and manage the basic information of the wireless device; it supports adding, deleting, modifying and querying the basic information, and supports device key query and device registration status verification functions.

[0098] The security policy configuration module 004 is used to configure the device network access whitelist, and to manage the access of wireless devices through the device network access whitelist; to configure the network communication policy based on the five-tuple information; and to manage communication between devices through the network communication policy.

[0099] The monitoring and alarm module 005 is used to collect the operating status data and alarm information of the wireless device in real time; after fusing the operating status data and alarm information, it notifies the management personnel for processing;

[0100] The key management module 006 is used to generate a platform-side signature asymmetric key pair and a platform-side encryption asymmetric key pair for the platform side; and to generate a device-side signature asymmetric key pair and a device-side encryption asymmetric key pair for each wireless device to be accessed, thereby realizing key application, destruction, update and synchronization;

[0101] The security situation analysis module 007 is used to aggregate the operating status information, alarm information and communication traffic information of the wireless device to generate a device network topology map; the device network topology map is displayed and supports information drill-down query and security risk location;

[0102] The user permission management module 008 is used to manage system user accounts and role information; and works with the request gateway module to perform user identity authentication and permission verification.

[0103] The log auditing module 009 is used to record user operation logs, device authentication logs, and operation logs, and supports log query and auditing operations.

[0104] It should be noted that the information interaction and execution process between the modules of the above system are based on the same concept as the method embodiment in Embodiment 1 of this application, and the resulting technical effects are the same as those in the method embodiment of this application. For details, please refer to the description in the method embodiment shown above in this application, and it will not be repeated here.

[0105] Example 3

[0106] Embodiment 3 of the present invention provides a non-transitory computer-readable storage medium storing program code of a wireless network security management method. The program code includes instructions for executing the wireless network security management method of Embodiment 1 or any possible implementation thereof.

[0107] Computer-readable storage media can be any available medium that a computer can access, or a data storage device such as a server or data center that integrates one or more available media. The available medium can be magnetic media (e.g., floppy disks, hard disks, magnetic tapes), optical media (e.g., DVDs), or semiconductor media (e.g., solid-state drives (SSDs)).

[0108] Example 4

[0109] Embodiment 4 of the present invention provides an electronic device, including: a memory and a processor;

[0110] The processor and the memory communicate with each other via a bus; the memory stores program instructions that can be executed by the processor, and the processor can execute a wireless network security management method according to Embodiment 1 or any possible implementation thereof by calling the program instructions.

[0111] Specifically, a processor can be implemented in hardware or software. When implemented in hardware, the processor can be a logic circuit, an integrated circuit, etc. When implemented in software, the processor can be a general-purpose processor that reads software code stored in memory. This memory can be integrated into the processor or located outside the processor and exist independently.

[0112] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented in software, it can be implemented, in whole or in part, as a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of the present invention are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable system. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means.

[0113] It is obvious to those skilled in the art that the modules or steps of the present invention described above can be implemented using general-purpose computing systems. They can be centralized on a single computing system or distributed across a network of multiple computing systems. Optionally, they can be implemented using program code executable by a computing system, thereby storing them in a storage system for execution by the computing system. In some cases, the steps shown or described can be performed in a different order than those presented herein, or they can be fabricated as separate integrated circuit modules, or multiple modules or steps can be fabricated as a single integrated circuit module. Thus, the present invention is not limited to any particular combination of hardware and software.

[0114] Although the present invention has been described in detail above with general descriptions and specific embodiments, modifications or improvements can be made to it, which will be obvious to those skilled in the art. Therefore, all such modifications or improvements made without departing from the spirit of the present invention are within the scope of protection claimed by the present invention.

Claims

1. A wireless network security management method, characterized in that, include: The system initialization module initializes the key management system parameters and administrator user information on the platform. The platform-side signature asymmetric key pair and the platform-side encryption asymmetric key pair are generated and configured by calling the key management module. The key management module generates a device-side signature asymmetric key pair and a device-side encryption asymmetric key pair for the wireless device to be connected. Enter and store basic information about wireless devices through the wireless device management module; Based on the signature asymmetric key pair and encryption asymmetric key pair on the device and platform sides, before accessing the wireless network, the wireless device initiates a two-way authentication request to the platform side through the request gateway module; the authentication request includes first encryption information and first signature information. The platform decrypts the first encrypted information in the authentication request using its private encryption key to obtain the device's unique identifier. Based on the unique identifier of the device, the corresponding device-side signature public key is queried, and the first signature information in the authentication request is verified using the device-side signature public key to complete the identity authentication of the wireless device. After the device authentication is successful, the platform generates a second random number and concatenates the second random number with the device's unique identifier to form a second concatenated information. The second concatenated information is then encrypted and signed using the device's encryption public key and the platform's signing private key, respectively, to form a second encrypted information and a second signed information, which are then returned to the device via the request gateway module. The device decrypts the second encrypted information using its private key and verifies the second signature information using the platform's public key, thus completing the authentication of the platform's identity. After two-way authentication is completed, the wireless device is allowed to access the wireless network by combining the device whitelist configured in the security policy configuration module and the device registration status in the wireless device management module; the system administrator logs into the system through the user permission management module and performs administrator identity authentication and permission verification in combination with the request gateway module. After the wireless device is connected, it will perform heartbeat communication and two-way authentication with the platform at the set frequency. Based on the status of wireless devices accessing the wireless network, the network communication policy configured by the security policy configuration module is used to control communication between devices; the monitoring and alarm module, security situation analysis module, and log auditing module are used to monitor the operating status of wireless devices, analyze security situation, and audit user operations and device logs, respectively.

2. The wireless network security management method according to claim 1, characterized in that, The platform-side signature asymmetric key pair includes: a platform-side signature public key and a platform-side signature private key; the platform-side encryption asymmetric key pair includes: a platform-side encryption public key and a platform-side encryption private key; the device-side signature asymmetric key pair includes: a device-side signature public key and a device-side signature private key; the device-side encryption asymmetric key pair includes: a device-side encryption public key and a device-side encryption private key.

3. The wireless network security management method according to claim 2, characterized in that, The basic information of a wireless device includes: device name, device type, device unique identifier, device serial number, device International Mobile Equipment Identity (IMEI), device IP address, device MAC address, and device manufacturer information.

4. The wireless network security management method according to claim 3, characterized in that, The device's unique identifier is concatenated with a first random number to generate first concatenated information; the first concatenated information is encrypted using the platform's public key to generate first encrypted information; and the first concatenated information is signed using the device's private key to generate first signed information.

5. The wireless network security management method according to claim 4, characterized in that, After receiving the two-way authentication request, the request gateway module performs a preliminary verification of the wireless device through the device network access whitelist; after the verification is successful, the request gateway module forwards the two-way authentication request to the platform for authentication.

6. The wireless network security management method according to claim 5, characterized in that, In the process of controlling communication between devices through the network communication policy configured by the security policy configuration module, the network communication policy controls communication between devices by configuring the five-tuple information of source device IP, source device port, destination device IP, destination device port, and communication protocol.

7. A wireless network security management method according to claim 6, characterized in that, After a wireless device connects to the wireless network, each heartbeat communication is initiated through the request gateway module and undergoes a two-way authentication process.

8. The wireless network security management method according to claim 7, characterized in that, During the process of performing security situation analysis on wireless devices through the security situation analysis module, the security situation analysis module generates a device network topology map by collecting, aggregating, and statistically analyzing the operating status data, alarm information, and communication traffic information of wireless devices. The network topology of the devices is displayed and supports drill-down queries.

9. A wireless network security management method according to claim 8, characterized in that, The logs recorded by the log auditing module include: user operation logs, wireless device authentication logs, and operation logs; the log auditing module supports querying and auditing operations on the logs.

10. A wireless network security management system, characterized in that, include: The system includes a request gateway module, a system initialization module, a device management module, a security policy configuration module, a monitoring and alarm module, a key management module, a security posture analysis module, a user permission management module, and a log auditing module. The request gateway module is used to receive HTTPS requests from wireless devices and clients; after passing whitelist verification, identity authentication, and permission verification, it forwards the HTTPS request to the designated module and returns the response data to the requester; The system initialization module is used to initialize the key management system parameters and administrator user information on the platform side, and to call the key management module to generate and configure asymmetric key pairs on the platform side. The device management module is used to input, store and manage the basic information of wireless devices; it supports adding, deleting, modifying and querying the basic information, and supports device key query and device registration status verification functions. The security policy configuration module is used to configure a device network access whitelist, and to control wireless device access through the device network access whitelist; and to configure network communication policies based on five-tuple information. The network connectivity strategy is used to manage and control communication between devices. The monitoring and alarm module is used to collect the operating status data and alarm information of wireless devices in real time. After fusing the operational status data and the alarm information, the administrator is notified to handle the matter. The key management module is used to generate a platform-side signature asymmetric key pair and a platform-side encryption asymmetric key pair for the platform. Generate a device-side signature asymmetric key pair and a device-side encryption asymmetric key pair for each wireless device to be connected, enabling key application, destruction, updating and synchronization; The security situation analysis module is used to aggregate the operating status data of wireless devices, the alarm information and communication traffic information to generate a device network topology map; The network topology of the devices is displayed and supports drill-down queries and security vulnerability location. The user permission management module is used to manage system user accounts and role information; and works with the request gateway module to perform user identity authentication and permission verification. The log auditing module is used to record user operation logs, device authentication logs, and operation logs, and supports log querying and auditing operations.

Images