HTTPS-based AC remote AP management method and related equipment

Abstract

The invention relates to the technical field of communication, and discloses a method for an AC to remotely manage an AP based on HTTPS, and the method comprises the steps: carrying out the interaction between the AC and the AP through a CAPWAP protocol, additionally establishing a secure communication channel based on HTTPS, and adding a new channel for the AC to manage the AP without changing and affecting the connection and data interaction of the existing CAPWAP protocol. The problems that a traditional CAPWAP protocol is not easy to expand and compatibility and intercommunity of the traditional CAPWAP protocol are solved, and the HTTPS protocol has higher safety. Besides, the invention also provides identity authentication when the AC and the AP establish the secure communication channel based on HTTPS, so that the external direct acquisition of corresponding data of the AP can be prevented, and the security is further improved. In addition, the invention also provides an AC device, an AP device and other related equipment applying the method.

Description

Technical Field

[0001] This invention relates to the field of communication technology, and in particular to a method and related equipment for remotely managing an access point (AP) based on HTTPS. Background Technology

[0002] An AP (Access Point) is a core device in a wireless local area network (WLAN). Its main function is to convert wired network signals into wireless signals, allowing wireless terminals (such as mobile phones and computers) to access the network via Wi-Fi. An AC (Access Controller) is responsible for the centralized management, configuration, and control of multiple APs in a wireless network.

[0003] Currently, the traditional communication between the Access Point (AP) and the Control Center (AC) is through the CAPWAP protocol for remote configuration. However, with technological advancements and increasing demands, the complexity and rigidity of the CAPWAP protocol have resulted in limited scalability, making it unable to meet the growing and expanding management needs of the AC for the AP. Summary of the Invention

[0004] The purpose of this invention is to provide a more flexible and easily expandable method and related equipment for remote management of APs based on HTTPS AC.

[0005] To achieve the above objectives, the present invention is implemented as follows: In a first aspect, the present invention provides a method for remotely managing an Access Point (AP) based on HTTPS, comprising: The AC and AP establish a communication connection and exchange CAPWAP protocol messages through the communication connection to complete the registration and basic configuration of the AP; After the AP registration is completed, the AC and the AP establish a separate secure communication channel based on HTTPS; The AC sends instructions to the AP through the secure communication channel; The AP responds to the instruction by performing the corresponding operation and exchanges data with the AC accordingly.

[0006] Secondly, the present invention provides an AC device configured as follows: Establish a communication connection with the AP and exchange CAPWAP protocol messages through the communication connection to complete the registration and basic configuration of the AP; After the AP is registered, a secure communication channel based on HTTPS will be established separately with the AP; Instructions are sent to the AP through the secure communication channel so that the AP can perform corresponding operations and transmit data back.

[0007] Thirdly, the present invention provides an AP device configured to: Establish a communication connection with the AC and exchange CAPWAP protocol messages through the communication connection to complete its own registration and basic configuration; After registration is completed, a secure communication channel based on HTTPS will be established separately with the AC. Receive instructions issued by the AC through the secure communication channel; In response to the instruction, the corresponding operation is performed, and the corresponding data is returned to the AC.

[0008] Fourthly, the present invention provides a computer-readable storage medium storing computer instructions that, when executed on a computer, cause the computer to perform the above-described method.

[0009] Fifthly, the present invention provides an electronic device, comprising: At least one processor, and A memory that is communicatively connected to the at least one processor; The memory stores instructions that can be executed by the at least one processor, which executes the instructions in the memory to enable the electronic device to implement the above-described method when the instructions are executed.

[0010] Compared with the prior art, the beneficial effects of the present invention are as follows: This invention establishes a separate secure communication channel based on HTTPS between the AC and AP, in addition to the existing CAPWAP protocol for communication. This adds a new channel for AC to manage APs without altering or affecting the existing CAPWAP protocol's connection and data exchange, solving the problems of limited scalability and compatibility of the traditional CAPWAP protocol. Furthermore, the HTTPS protocol offers enhanced security. Additionally, this invention provides authentication for establishing the HTTPS secure communication channel between the AC and AP, preventing direct external access to AP data and further improving security. Attached Figure Description

[0011] Figure 1 This is a flowchart of a method for remotely managing an AP based on HTTPS according to an embodiment of the present invention; Figure 2 This is a schematic diagram of the AC and AP architecture in an embodiment of the present invention; Figure 3 This is a hardware block diagram of an electronic device according to an embodiment of the present invention.

[0012] In the diagram, 301 is the processor; 302 is the memory; 303 is the transceiver; and 304 is the user interface. Detailed Implementation

[0013] The specific embodiments of the present invention will be described in further detail below with reference to the accompanying drawings and examples. The following examples are for illustrative purposes only and are not intended to limit the scope of the invention.

[0014] Example 1 like Figure 1 As shown, a preferred embodiment of the present invention provides a method for remotely managing an AP using an HTTPS-based AC, comprising: The AC and AP establish a communication connection and exchange CAPWAP protocol messages through the communication connection to complete the AP registration and basic configuration. After the AP is registered, the AC and the AP will establish a separate secure communication channel based on HTTPS. AC sends commands to AP through a secure communication channel; The AP responds to the command by performing the corresponding operation and exchanges data with the AC accordingly.

[0015] This embodiment establishes a separate secure communication channel based on HTTPS, in addition to the existing CAPWAP protocol for interaction between the AC and AP. This adds a new channel for the AC to manage the AP without altering or affecting the existing CAPWAP protocol's connection and data exchange. This solves the problems of the traditional CAPWAP protocol's difficulty in expansion and its compatibility and interoperability, while also providing higher security through the HTTPS protocol. This embodiment establishes a separate secure communication channel based on HTTPS as an extension and supplement to the current CAPWAP protocol interaction between the AC and AP, making it more flexible and easily scalable.

[0016] Furthermore, in the separate secure communication channel established between the AC and AP based on HTTPS, the AP authenticates the AC, or the AC and AP authenticate each other.

[0017] In this embodiment, identity authentication is based on dynamically generated keys and random numbers.

[0018] Specifically, identity authentication includes: Step 1: The AC sends an HTTPS packet to the specified URL of all APs with established communication connections. The data portion of the HTTPS packet carries the first key and the first random number. Step 2: After receiving the HTTPS packet from the specified URL, the AP first checks the value of the Cookie field and compares it with its stored key. If they match, proceed to step 8; otherwise, proceed to step 3. Step 3: The AP checks whether the data portion of the HTTPS packet carries the first key and the first random number. If not, proceed to step 9; if so, proceed to step 4. Step 4: The AP performs a hash calculation based on the first random number and its own MAC address, and compares the result with the first key. If they match, proceed to step 5; otherwise, proceed to step 9. Step 5: The AP performs a hash calculation based on the second random number and its own IP address to obtain the second key, stores the second key, and returns it to the AC through a secure communication channel based on HTTPS. Step 6: The AC stores the second key and the corresponding AP's MAC address; Step 7: After AC, each time an HTTPS packet is sent to the corresponding AP, the second key must be included in the Cookie field; Step 8: AP authentication is successful. The AP and AC establish a secure communication channel based on HTTPS. The AC sends instructions to the AP through the secure communication channel. The AP responds to the instructions, performs the corresponding operation, and exchanges data with the AC accordingly. Step 9: AP authentication failed, returning a 403 status code and prohibiting access to the URL.

[0019] This embodiment provides authentication for establishing a secure communication channel between the AC and AP based on HTTPS, preventing direct external access to AP data and further enhancing security. This embodiment employs a unique authentication process to prevent direct external access to AP data, and since HTTPS is inherently an encrypted data transmission protocol, its security is high.

[0020] In addition, the AC issues instructions to the AP using data in a custom JSON format, and the AP exchanges corresponding data with the AC using data in the same custom JSON format.

[0021] In this embodiment, a communication connection is established between the AC and the AP, and CAPWAP protocol messages are exchanged through the communication connection to complete the AP registration and basic configuration, including: AC discovers APs and establishes associations with them through the CAPWAP protocol, and uniformly distributes some configuration parameters; AC establishes a TCP connection with AP.

[0022] Therefore, as Figure 1 As shown in this embodiment, the method for remotely managing an AP using an HTTPS-based AC includes the following steps. S1: The AC discovers the AP and establishes a connection with it through the CAPWAP protocol, and uniformly distributes some configuration parameters; S2: AC and AP establish a TCP connection and enter the authentication phase; S3: The AC sends an HTTPS packet to the specified URL of all established APs. The data part of the HTTPS packet carries a first key and a first random number. The first key is a key value and the first random number is a random token. S4: After receiving the HTTPS packet from the specified URL, the AP first checks the value of the Cookie field and compares it with its stored key value. If the authentication is successful, proceed to S10; otherwise, proceed to S5. S5: The AP checks whether the HTTPS packet data portion carries the first key and the first random number. If so, proceed to S6; otherwise, proceed to S11. S6: The AP performs a hash calculation based on the token value of the first random number and its own MAC address (Media Access Control Address, LAN address), and compares the result with the first key value. If they match, proceed to S7; otherwise, proceed to S11. The first key is obtained by the AC generating the first random number and performing a hash calculation based on the stored MAC address. S7: The AP performs a hash calculation based on the second random number and its own IP address (Internet Protocol Address), stores the resulting second key value, and sends it back to the AC via HTTPS; the second random number is a new random token; S8: After receiving the response packet, the AC stores the MAC address of the AP corresponding to the second key value. At this point, the authentication phase ends and the data interaction phase begins. S9: After AC, each time an HTTPS packet is sent to the corresponding AP, the corresponding second key value must be included in the Cookie field, and instructions and data must be sent to the AP through data in a custom JSON format. S10: After the AP authentication cookie is successful, the response packet will be sent in a custom JSON format according to the instructions issued by the AC. S11: AP authentication failed, returning a 403 status code, access to this URL is prohibited; S12: The AC periodically updates the key values ​​of both parties to all APs with established connections using the above authentication process, which consists of steps S3-S8.

[0023] like Figure 2 As shown, this embodiment includes a network of 1 AC and 6 AP devices.

[0024] Step 201: AP1, AP2, AP3, and AP5 are powered on and connected to the AC, and are detected by the AC and establish a connection through the CAPWAP protocol.

[0025] Step 202: The AC sends HTTPS packets to AP1, AP2, AP3, and AP5, which have already established connections. Both parties then exchange authentication keys.

[0026] Step 203: The AC carries the key as authentication information and interacts with AP1, AP2, AP3, and AP5 via an HTTPS channel.

[0027] Step 204: The AC can see the corresponding AP information (such as resource utilization) and can also make the AP perform corresponding functions (such as the AP uploading files to the AC, the AP downloading files from the AC, etc.).

[0028] After the above steps, the AC can freely and flexibly interact with AP1, AP2, AP3, and AP5 via HTTPS using a custom JSON data format to obtain the desired information and issue commands. This avoids more complex and inconvenient extensions based on the CAPWAP protocol and also provides higher security.

[0029] Example 2 This invention provides an AC device configured as follows: Establish a communication connection with the AP and exchange CAPWAP protocol messages through the communication connection to complete the AP registration and basic configuration; After the AP registration is completed, a separate secure communication channel based on HTTPS will be established with the AP. Commands are sent to the AP through a secure communication channel so that the AP can perform corresponding operations and send data back.

[0030] Specifically, the AC device is configured as follows: The AP is discovered and associated with the AP through the CAPWAP protocol, and configuration parameters are uniformly distributed to the AP. After the CAPWAP association is established, a TCP connection is established with the AP; Generate a first random number and a first key; the first key is obtained by hashing the first random number with the stored MAC address of the AP; Send an HTTPS packet to the specified URL of the AP. The data portion of the HTTPS packet carries a first random number and a first key. Receive the HTTPS packet returned by the AP. The HTTPS packet returned by the AP carries the second key calculated by the AP based on the second random number and the hash of its own IP address. The second key is stored in association with the MAC address of the AP; In subsequent communications, the second key is carried in the cookie field of the HTTPS packet sent to the AP, and instructions or data are exchanged with the AP in a custom JSON format; Periodically send HTTPS packets to the AP to update the second key.

[0031] Example 3 This invention provides an AP device configured as follows: Establish a communication connection with the AC and exchange CAPWAP protocol messages through the communication connection to complete its own registration and basic configuration; After registration is completed, a secure communication channel based on HTTPS will be established separately with the AC; Receive instructions from the AC through a secure communication channel; In response to the command, perform the corresponding operation and return the corresponding data to the AC.

[0032] Specifically, the AP device is configured as follows: Establish a connection with the AC via the CAPWAP protocol and receive configuration parameters; After the CAPWAP association is established, a TCP connection is established with the AC; Receive HTTPS packets sent by AC to the specified URL; The value of the Cookie field in the HTTPS packet is detected and compared with the key stored locally. If they match, the instructions issued by the AC through the custom JSON format are parsed and the HTTPS packet is returned in the custom JSON format. If cookie authentication fails, check whether the data portion of the HTTPS packet carries the first random number and the first key; If carried, a hash calculation is performed based on the first random number and its own MAC address, and the calculation result is compared with the first key; If the comparison matches, a second random number is generated. The second key is obtained by hashing the second random number with its own IP address and then returning the second key to the AC via an HTTPS response. If any of the above authentications fails, a 403 status code will be returned, prohibiting access to the URL.

[0033] Example 4 This invention provides a computer-readable storage medium storing computer instructions. When the computer instructions are executed on a computer, the computer performs the method described in Embodiment 1 and achieves the same technical effect. To avoid repetition, further details are omitted here.

[0034] A computer-readable storage medium stores a computer program that, when executed by a processor, implements the various processes of the above-described method embodiment for remotely managing an AP using an HTTPS-based AC, achieving the same technical effects. To avoid repetition, these processes will not be described again here. The computer-readable storage medium may include read-only memory (ROM), random access memory (RAM), a magnetic disk, or an optical disk.

[0035] Example 5 This invention provides an electronic device, comprising: At least one processor 301, and Memory 302 that is communicatively connected to at least one processor; The memory 302 stores instructions that can be executed by at least one processor 301. The at least one processor 301 is used to execute the instructions in the memory 302 so that when executing the instructions, the electronic device can implement the various processes of the above-described method embodiment of the HTTPS-based AC remote management AP and achieve the same technical effect. To avoid repetition, it will not be described again here.

[0036] The electronic device also includes a transceiver 303 for receiving and sending data under the control of the processor 301.

[0037] Among them, Figure 3 In this context, the bus architecture can include any number of interconnected buses and bridges, specifically connecting various circuits of one or more processors represented by processor 301 and memory represented by memory 302. The bus architecture can also connect various other circuits such as peripheral devices, voltage regulators, and power management circuits, which are well known in the art and therefore will not be described further herein. The bus interface provides an interface. Transceiver 303 can be multiple elements, including transmitters and receivers, providing a unit for communicating with various other devices over a transmission medium. For different user equipment, the user interface 304 can also be an interface capable of connecting external or internal devices, including but not limited to keypads, displays, speakers, microphones, joysticks, etc.

[0038] The processor 301 is responsible for managing the bus architecture and general processing, while the memory 302 can store the data used by the processor 301 when performing operations.

[0039] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0040] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. The computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal (which may be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in the various embodiments of the present invention.

[0041] The embodiments of the present invention have been described above with reference to the accompanying drawings. However, the present invention is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art, under the guidance of the present invention, can make many modifications without departing from the spirit and scope of the claims, all of which fall within the protection scope of the present invention. The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and substitutions can be made without departing from the technical principles of the present invention, and these improvements and substitutions should also be considered within the scope of protection of the present invention.

Claims

1. A method for remotely managing an Access Point (AP) using an AC based on HTTPS, characterized in that, include: The AC and AP establish a communication connection and exchange CAPWAP protocol messages through the communication connection to complete the registration and basic configuration of the AP; After the AP registration is completed, the AC and the AP establish a separate secure communication channel based on HTTPS; The AC sends instructions to the AP through the secure communication channel; The AP responds to the instruction by performing the corresponding operation and exchanges data with the AC accordingly.

2. The method according to claim 1, characterized in that, In the separate HTTPS-based secure communication channel established between the AC and the AP, The AP performs identity authentication on the AC, or the AC and the AP perform identity authentication on each other.

3. The method according to claim 2, characterized in that, The authentication is based on dynamically generated keys and random numbers.

4. The method according to claim 3, characterized in that, The identity authentication includes: Step 1: The AC sends an HTTPS packet to a specified URL of all APs with established communication connections. The data portion of the HTTPS packet carries a first key and a first random number. Step 2: After receiving the HTTPS packet from the specified URL, the AP first checks the value of the Cookie field and compares it with its stored key. If they match, proceed to step 8; otherwise, proceed to step 3. Step 3: The AP detects whether the data portion of the HTTPS packet carries the first key and the first random number. If not, proceed to step 9; if yes, proceed to step 4. Step 4: The AP performs a hash calculation based on the first random number and its own MAC address, and compares the result with the first key. If they match, proceed to step 5; otherwise, proceed to step 9. Step 5: The AP performs a hash calculation based on the second random number and its own IP address to obtain the second key, stores the second key, and returns it to the AC through a secure communication channel based on HTTPS. Step 6: The AC stores the second key and the corresponding AP's MAC address; Step 7: Each time the AC sends an HTTPS packet to the corresponding AP, it must include the second key in the Cookie field; Step 8: Once the AP is successfully authenticated, the AP and the AC establish a secure communication channel based on HTTPS. The AC sends instructions to the AP through the secure communication channel. The AP responds to the instructions by performing corresponding operations and exchanges data with the AC accordingly. Step 9: The AP authentication failed, a 403 status code was returned, and access to the URL was prohibited.

5. The method according to claim 1, characterized in that, The AC issues instructions to the AP using data in a custom JSON format, and the AP exchanges corresponding data with the AC using data in the same custom JSON format.

6. The method according to claim 1, characterized in that, The AC and AP establish a communication connection and exchange CAPWAP protocol messages through the communication connection to complete the registration and basic configuration of the AP, including: The AC discovers the AP and establishes an association with it through the CAPWAP protocol, and uniformly distributes some configuration parameters. The AC establishes a TCP connection with the AP.

7. An AC device, characterized in that, Configured as: Establish a communication connection with the AP and exchange CAPWAP protocol messages through the communication connection to complete the registration and basic configuration of the AP; After the AP is registered, a secure communication channel based on HTTPS will be established separately with the AP; Instructions are sent to the AP through the secure communication channel so that the AP can perform corresponding operations and transmit data back.

8. An AP device, characterized in that, Configured as: Establish a communication connection with the AC and exchange CAPWAP protocol messages through the communication connection to complete its own registration and basic configuration; After registration is completed, a secure communication channel based on HTTPS will be established separately with the AC. Receive instructions issued by the AC through the secure communication channel; In response to the instruction, the corresponding operation is performed, and the corresponding data is returned to the AC.

9. A computer-readable storage medium, characterized in that... The computer-readable storage medium stores computer instructions that, when executed on a computer, cause the computer to perform the method as described in any one of claims 1-6.

10. An electronic device, characterized in that... ,include: At least one processor, and A memory that is communicatively connected to the at least one processor; The memory stores instructions executable by the at least one processor, which executes the instructions in the memory to cause the electronic device to implement the method as described in any one of claims 1-6 when the instructions are executed.

Images