Secret key distribution method, device and equipment for VLAN (Virtual Local Area Network) and medium

Abstract

The invention provides a secret key distribution method and device for a VLAN network, equipment and a medium, relates to the technical field of network access, and can solve the problem that the current network distribution security is relatively low. Comprising the following steps: receiving an access request, and judging whether a terminal sending the access request is an unauthenticated terminal; if the terminal is an unauthenticated terminal, dividing the terminal to a preset VLAN, and sending an authentication instruction to the terminal according to the preset VLAN, so that the terminal presents an authentication interface according to the authentication instruction; according to the authentication interface, obtaining corresponding authentication information, and verifying the authentication information to obtain a corresponding PPSK key and a target VLAN; sending the PPSK key to the terminal, and carrying out binding operation on the PPSK key, the terminal and the target VLAN; therefore, the isolation and security of network access are improved.

Description

[0001] This application claims priority to Chinese Patent Application No. 202511270991.X, filed on September 8, 2025, entitled "A Key Distribution Method, Apparatus, Device and Medium for a VLAN Network", the entire contents of which are incorporated herein by reference. Technical Field

[0002] This application relates to the field of network access technology, and in particular to a key distribution method, apparatus, device and medium for VLAN networks. Background Technology

[0003] Network security access focuses on enabling secure access to computer networks by terminals. It implements functions such as identity authentication, access control, network isolation, and security protection throughout the entire process of terminal access to the network. When a terminal wants to access the network, it needs to provide the correct key to prove that it has been authorized. The network system (such as controllers and access points) will verify the validity of the key. Only devices whose keys are verified can be allowed to access the network and use network resources.

[0004] Traditional key distribution methods typically employ pre-shared keys (PSKs), where multiple tenants or users share the same key. This key needs to be pre-registered or generated through a fixed portal process, ensuring all devices using the key are grouped into the same network domain. However, PSKs pose certain security risks; for example, key leakage can jeopardize the security of the entire group. To address this, Private Pre-Shared Keys (PPSKs) have been proposed to enhance security. PPSKs assign a unique key to each user or device, enabling more granular access control and auditing capabilities. However, PPSKs also face challenges such as complex key distribution processes and high management costs.

[0005] Therefore, the relevant network key distribution methods suffer from low distribution efficiency and low security. Summary of the Invention

[0006] This application provides a key distribution method, apparatus, device, and medium for VLAN networks to solve the problems of low distribution efficiency and low security in existing key distribution methods for networks.

[0007] Firstly, this application provides a key distribution method for a VLAN network, the method comprising: Receive access requests and determine whether the terminal sending the access request is an unauthenticated terminal; If the terminal is an unauthenticated terminal, the terminal will be assigned to a preset VLAN, and an authentication command will be sent to the terminal according to the preset VLAN, so that the terminal will present an authentication interface according to the authentication command; the authentication command is sent to the terminal through the same service set identifier (SSID); According to the authentication interface, obtain the corresponding authentication information, verify the authentication information, and obtain the corresponding PPSK key and target VLAN; Send the PPSK key to the terminal and bind the PPSK key, the terminal, and the target VLAN.

[0008] In some embodiments of this application, it also includes: Control AP devices to broadcast a unified service set identifier, enabling terminals to connect to different VLANs based on the service set identifier and different access keys.

[0009] In some embodiments of this application, determining whether the terminal sending the access request is an unauthenticated terminal includes: Extract the access key corresponding to the access request, and match the access key with the keys in the preset key library; If the access key is the default key, then the terminal is determined to be the unauthenticated terminal; If the access key is the PPSK key, then the current detection mode is determined; wherein, the default key and the PPSK key are used to encrypt the first data sent by the terminal and the second data sent to the terminal; If the detection mode is a collaborative detection mode, then extract the terminal identification information corresponding to the terminal from the access request, and determine whether the terminal identification information is bound to the PPSK key; If the terminal identification information is bound to the PPSK key, then the terminal is determined not to be the unauthenticated terminal; If the terminal identification information is not bound to the PPSK key, then the terminal is determined to be the unauthenticated terminal; If the detection mode is a non-cooperative detection mode, then it is determined that the terminal is not the unauthenticated terminal; If the access key is neither the default key nor the PPSK key, then the terminal access is denied.

[0010] In some embodiments of this application, it also includes: The control AP device broadcasts a unified service set identifier, enabling the terminal to connect to different VLANs based on the service set identifier and different access keys.

[0011] In some embodiments of this application, the binding operation of the PPSK key, the terminal, and the target VLAN includes: Extract the terminal MAC address corresponding to the terminal from the access request; When assigning the terminal to a preset VLAN, the system receives a DHCP request sent by the terminal and extracts a request parameter list and a vendor category identifier from the DHCP request. When sending an authentication command to the terminal, the request feature field is extracted from the HTTP request sent by the terminal; A device fingerprint is generated using the request parameter list, the supplier category identifier, and the request feature field; The PPSK key, the device fingerprint, the terminal MAC address, and the target VLAN are bound together.

[0012] In some embodiments of this application, determining whether the terminal sending the access request is an unauthenticated terminal includes: Extract the terminal MAC address corresponding to the terminal from the access request; Receive the DHCP request sent by the terminal, extract the request parameter list and supplier category identifier from the DHCP request, and assign the terminal to a preset VLAN; When sending an authentication command to the terminal, the request feature field is extracted from the HTTP request sent by the terminal; A device fingerprint is generated using the request parameter list, the supplier category identifier, and the request feature field; Determine whether either the terminal MAC address or the device fingerprint is bound to the PPSK key; If either the terminal MAC address or the device fingerprint is bound to the PPSK key, then the terminal is determined not to be the unauthenticated terminal, and the terminal is reassigned to the target VLAN. If neither the terminal MAC address nor the device fingerprint is bound to the PPSK key, then the terminal is determined to be the unauthenticated terminal.

[0013] In some embodiments of this application, verifying the authentication information to obtain the corresponding PPSK key and target VLAN includes: The authentication information is compared with the information in the target information database to obtain the corresponding comparison result; If the comparison result shows that the authentication information matches any item in the target information database, then the PPSK key and the target VLAN are determined based on the authentication information. If the comparison result shows that the authentication information is inconsistent with all information in the target information database, then the verification result corresponding to the authentication information is determined to be a verification failure, and the prompt information corresponding to the verification result is output.

[0014] In some embodiments of this application, determining the PPSK key and the target VLAN based on the authentication information includes: Based on the preset key rules, determine the identification information in the authentication information that corresponds to the preset key rules; The PPSK key is generated based on the identification information.

[0015] In some embodiments of this application, the step of sending the PPSK key to the terminal and binding the PPSK key, the terminal, and the target VLAN includes: Send the PPSK key to the terminal and receive a secondary access request sent by the terminal based on the PPSK key; Based on the terminal MAC address corresponding to the secondary access request, the PPSK key, the terminal MAC address, and the target VLAN are bound together.

[0016] In some embodiments of this application, after binding the PPSK key, the terminal MAC address, and the target VLAN according to the terminal MAC address corresponding to the secondary access request, the method further includes: Receive a real-time access request sent by the terminal, and determine the target VLAN corresponding to the PPSK key based on the PPSK key corresponding to the real-time access request; The terminal is assigned to the target VLAN.

[0017] In some embodiments of this application, it also includes: Bind the target VLAN to the BSSID of the AP device to which the terminal is connected; After determining the target VLAN corresponding to the PPSK key, the process further includes: Determine whether the AP device currently accessed by the terminal is the same as the AP device corresponding to the BSSID bound to the target VLAN; If they are different, a prompt message is sent to the terminal to prompt for a key change, or the process proceeds to the step of assigning the terminal to a preset VLAN and sending an authentication command to the terminal according to the preset VLAN, so that the terminal presents an authentication interface according to the authentication command.

[0018] Secondly, this application provides a key distribution device for a VLAN network, the device comprising: The receiving module is used to receive access requests and determine whether the terminal sending the access request is an unauthenticated terminal. The sending module is used to assign the terminal to a preset VLAN if the terminal is an unauthenticated terminal, and send an authentication command to the terminal according to the preset VLAN so that the terminal presents an authentication interface according to the authentication command; the authentication command is sent to the target terminal through the same service set identifier (SSID); The acquisition module is used to obtain the corresponding authentication information based on the authentication interface, verify the authentication information, and obtain the corresponding PPSK key and target VLAN. The binding module is used to send the PPSK key to the terminal and perform binding operations on the PPSK key, the terminal, and the target VLAN.

[0019] Thirdly, this application provides an apparatus, including: a processor, and a memory communicatively connected to the processor; The memory stores the instructions that the computer executes; The processor executes computer execution instructions stored in memory to implement the method of this application.

[0020] Fourthly, this application provides a computer-readable storage medium storing program code, which, when executed by a processor, is used to implement the method of this application.

[0021] This application provides a key allocation method for a VLAN network, comprising: receiving an access request and determining whether the terminal sending the access request is an unauthenticated terminal; if the terminal is an unauthenticated terminal, assigning the terminal to a preset VLAN and sending an authentication command to the terminal according to the preset VLAN, so that the terminal presents an authentication interface according to the authentication command; sending the authentication command to the terminal through a Service Set Identifier (SSID); obtaining the corresponding authentication information according to the authentication interface and verifying the authentication information to obtain the corresponding PPSK key and target VLAN; sending the PPSK key to the terminal and binding the PPSK key, the terminal, and the target VLAN.

[0022] The beneficial effects of this application are as follows: This application can perform initial screening of terminal identities by determining whether it is a first-time access terminal, and automatically assign first-time access terminals to a preset isolation VLAN. The preset VLAN provides initial isolation for unauthenticated terminals, restricting them to accessing only the authentication portal, thus preventing unauthorized devices from accessing core network resources, thereby improving the isolation of unfamiliar terminals, enhancing network security, and achieving fine-grained network isolation. By actively sending authentication commands, the terminal is guided to present the authentication interface to obtain authentication information, thereby generating a corresponding PPSK key after verification. This avoids the cumbersome process of manually distributing keys, simplifies the management process, and improves access convenience. The PPSK key replaces the traditional fixed shared key, and the PPSK key forms a "three-element binding" relationship with the terminal and the target VLAN, avoiding the privacy leakage risk caused by multiple users sharing the same domain (such as home device communication data being obtained by other users). At the same time, the isolation of a separate corresponding target VLAN blocks direct communication between unauthorized devices, significantly reducing the success rate of network attacks (such as ARP spoofing and malicious network hijacking), and improving overall network security.

[0023] This application also provides a key distribution device, equipment, and medium for a VLAN network, which has the aforementioned beneficial effects. Attached Figure Description

[0024] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0025] Figure 1 A flowchart illustrating a key allocation method for a VLAN network provided in an embodiment of this application; Figure 2 A flowchart illustrating a terminal identification information binding process provided in this application embodiment; Figure 3 A flowchart illustrating another terminal identification information binding process provided in this application embodiment; Figure 4 A schematic diagram illustrating the application of a key allocation method for a VLAN network provided in this embodiment of the application; Figure 5 A schematic diagram of the architecture of a network allocation method in a multi-tenant environment provided in an embodiment of this application; Figure 6 A schematic diagram of the structure of a key distribution device for a VLAN network provided in an embodiment of this application; Figure 7 This is a structural block diagram of a device for implementing a key distribution method for a VLAN network according to an embodiment of this application. Detailed Implementation

[0026] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects detailed in this application.

[0027] The technical solution of this application and how the technical solution of this application solves the above-mentioned technical problems are described in detail below with specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments. The embodiments of this application will now be described with reference to the accompanying drawings.

[0028] Figure 1 This is a flowchart illustrating a key allocation method for a VLAN network provided in an embodiment of this application. Figure 1 As shown, this key allocation method for a VLAN network may include the following steps: S10. Receive the access request and determine whether the terminal that sent the access request is an unauthenticated terminal.

[0029] In this embodiment, the terminal can be various types of terminal devices, such as mobile phones, tablets, personal computers, etc.

[0030] An access request is a network connection request signal sent by a terminal when attempting to access a wireless network. An access request can be understood as a request signal initiated by the terminal to access the network. It can be an association request frame or authentication frame sent by the terminal to an access point (AP) or wireless controller (AC), or a DHCP request frame sent by the terminal to a DHCP (Dynamic Host Configuration Protocol) server. The association and authentication frames are data frames sent by the terminal when requesting access to the wireless network. DHCP is a network protocol used to dynamically assign network configuration information such as IP addresses, subnet masks, and gateways to terminals accessing the network, enabling terminals to establish communication connections within the network. The aforementioned association, authentication, and DHCP request frames can be obtained through packet capture, such as by setting up a packet capture program at the access point or wireless controller and using that program to obtain these frames.

[0031] An unauthenticated terminal refers to an unfamiliar terminal that is accessing the network for the first time, i.e., an unauthenticated device that has not been registered on the network.

[0032] Based on this, in step S10, an access request is received, and it is determined whether the terminal sending the access request is an unauthenticated terminal that has not been registered in the network, so that the unauthenticated terminal can be authenticated in the future.

[0033] It is worth noting that, to facilitate terminal access and user convenience, this application can control multiple access point devices to broadcast a unified Service Set Identifier (SSID). Terminals can access the network based on this SSID. The SSID can be understood as the wireless network name. For terminals and users, they only need to access the wireless network based on the same SSID, without needing to worry about how the backend divides the wireless network into multiple isolated areas, thus facilitating user access.

[0034] Furthermore, in this embodiment, the terminal can connect to different VLANs based on a service set identifier and different access keys. Here, VLAN is a preset network isolation zone, and different VLANs are isolated from each other. The access key is the key used by the terminal when sending the aforementioned access request; the access key is used to encrypt the data transmitted between the terminal and the network system (such as between the terminal and the access point device). In other words, when a terminal requests access from an access point device broadcasting a service set identifier using different keys, the network system can assign the terminal to the VLAN corresponding to that key, thereby achieving the effect of dividing different terminals into different, mutually isolated VLANs when they connect to the same wireless network.

[0035] It should be noted that for information on key allocation and usage, as well as VLAN allocation and connection, please refer to the descriptions in the subsequent embodiments.

[0036] S20. If the terminal is an unauthenticated terminal, the terminal is assigned to a preset VLAN, and an authentication command is sent to the terminal according to the preset VLAN so that the terminal presents the authentication interface according to the authentication command; the authentication command is sent to the terminal through the same service set identifier SSID. In this embodiment, a preset VLAN refers to a network isolation area pre-configured by the network system specifically for isolating unauthenticated terminals, used to restrict unauthenticated terminals' access to the Internet or intranet resources.

[0037] The default VLAN includes an authentication device that provides authentication services to terminals. This authentication device can be implemented by an access point device, a wireless controller device, or an additional device set up in the network system. The authentication service provided by this authentication device can be, for example, a portal authentication service.

[0038] An authentication command is a message sent by a network system (such as a wireless controller or access point node) to a terminal after it has been assigned to a predefined VLAN. This message guides the terminal through the authentication process. The effect of sending an authentication command to a terminal can be understood as triggering network access redirection. For example, through techniques like "302 Redirect," the terminal is forced to automatically redirect to a predefined authentication entry point when attempting to access any network resource, ensuring that unauthenticated terminals must undergo authentication to obtain higher-level network access privileges.

[0039] The authentication interface refers to the interactive page displayed on the terminal's browser or system after the terminal receives and executes the authentication command. This interface can be provided by the Portal authentication service corresponding to the preset VLAN, i.e., the Portal landing page, used to collect the user's authentication information. This authentication information may include, for example, the user's entered mobile phone number / verification code, email address, tenant number, and other identity verification data. In practical applications, when a terminal is assigned to a preset VLAN, it can be configured to only allow the terminal to communicate with the Portal authentication service in the preset VLAN, thereby achieving network isolation of the terminal, preventing unauthorized devices from accessing the core network, thus improving network isolation and ensuring network security.

[0040] Furthermore, in addition to the conventional Portal method, it can also be applied to a pre-defined SSID network. For example, it can be an open network. Users connect to this SSID and are then directed to the authentication interface to submit information and obtain a unique PPSK key. Subsequently, the user's device will use this newly obtained PPSK key to reconnect to the same SSID. Since this connection uses the registered unique key, the network system will recognize it and switch it to the target VLAN with the correct permissions to access the Internet. In this way, for users, they only need to deal with a network name (SSID), making the experience simple.

[0041] Based on this, in step S20, if it is determined that the current terminal is an unauthenticated terminal, the terminal can be assigned to a preset VLAN to temporarily isolate the terminal, and an authentication command can be sent to the terminal according to the preset VLAN so that the terminal can present an authentication interface according to the authentication command.

[0042] Alternatively, a separate, special SSID can be set up for authentication and key distribution. For example, a company may have a main SSID called Company-Secure for internal employees, while visitors will be directed to a separate SSID, such as Company-Guest-Registration. After connecting to the Company-Guest-Registration SSID, the user completes authentication and obtains a PPSK key.

[0043] S30. Based on the authentication interface, obtain the corresponding authentication information, verify the authentication information, and obtain the corresponding PPSK key and target VLAN.

[0044] In this embodiment, authentication information refers to the data submitted in the authentication interface to prove the legitimacy of the user's identity, so that the system can determine whether the user can access the network. Authentication information can take various forms, such as a mobile phone number and verification code, an email address and password, a tenant number, etc., depending on the needs of the application scenario (e.g., a tenant number might be used in a community scenario, while a mobile phone number verification code might be used in a hotel scenario). After verifying the authenticity of this information (e.g., verifying the validity of the mobile phone number verification code, matching the tenant number with the registration information), and confirming that the user is an authorized user, the subsequent key generation and VLAN allocation process can proceed.

[0045] A PPSK key is a Personalized Pre-Shared Key, also known as a Personalized PSK or sPSK (i.e., Sensed PSK, Sensed, Secure, Seamless, signifying isolation upon initial discovery and decentralization during authentication). It is a unique key generated by the system after successful authentication verification. Unlike traditional shared PSKs, PPSKs are unique; each terminal or user possesses an independent key, making it a unique key specific to a particular device.

[0046] A target VLAN is an isolated area with specific network permissions assigned by the system to an authenticated terminal. Unlike the isolation function of a preset VLAN, a target VLAN is the formal network area that a terminal accesses after authentication. For example, in an enterprise scenario, it may be a dedicated VLAN for the department to which an employee belongs, configured with network policies that match the user's permissions (such as access range, bandwidth restrictions, etc.). After the terminal accesses the network, it can obtain the corresponding network services according to the VLAN policy.

[0047] Based on this, in step S30, in response to the user's feedback operation on the authentication interface, the corresponding authentication information is further obtained so as to verify the authentication information. After the verification is successful, the corresponding exclusive PPSK key is generated and the corresponding target VLAN is assigned.

[0048] S40. Send the PPSK key to the terminal and bind the PPSK key, the terminal, and the target VLAN.

[0049] In this embodiment, the binding operation refers to establishing a unique and associated mapping relationship between the generated PPSK key, the terminal, and the target VLAN, and storing it in the database of the controller or key server.

[0050] For example, a mapping relationship can be established between the PPSK key, the terminal MAC address, and the target VLAN. The terminal MAC address is the physical identifier of the terminal device. In addition, to improve the reliability of terminal device identification, other terminal identification information can be introduced, and this introduced identification information can be mapped together with the PPSK key, terminal MAC address, and target VLAN.

[0051] Based on this, after the terminal is registered and verified, and a corresponding PPSK key is generated and a target VLAN is assigned, the PPSK key can be fed back to the terminal so that the terminal can access the network normally using the PPSK key. Furthermore, the PPSK key, terminal, and target VLAN can be bound together so that when the user accesses the network again, they can be assigned to the corresponding target VLAN according to the PPSK key and the corresponding terminal, which improves the network access speed. And by using the target VLANs corresponding to each terminal, network isolation can be achieved, improving the security of network access.

[0052] Based on the feasible implementation of S10 described above, this application further provides steps for determining whether the terminal sending the access request is an unauthenticated terminal, including: S111. Extract the access key corresponding to the access request and match the access key with the key in the preset key library; S112. If the access key is the default key, then the terminal is determined to be an unauthenticated terminal. S113. If the access key is a PPSK key, then the terminal is determined to be an authenticated terminal; the default key and the PPSK key are used to encrypt the first data sent by the terminal and the second data sent to the terminal. S114. If the access key is not the default key and is not a PPSK key, then terminal access is denied.

[0053] In the above steps, the access key refers to the key corresponding to the terminal's current access.

[0054] The default key refers to the default key that is pre-set in the network system, which can be made public to users in the form of plain text or QR code in public places.

[0055] A PPSK key is a unique key assigned to a terminal by the network system when the terminal is authenticated. Unauthenticated terminals can log in for the first time using a default key. The network system can then guide terminals accessing the network using the default key to perform Portal authentication, thereby assigning a secure, unique PPSK key to the terminal.

[0056] It is worth noting that the default key and PPSK key are used to encrypt the first data sent by the terminal and the second data sent to the terminal. For example, when the terminal establishes a connection with the AP device, the terminal and the AP device can establish encrypted communication based on the default key or PPSK key, such as WPA (Wi-Fi Protected Access), WPA2 (WPA version 2), WPA3 (WPA version 3), and other encrypted communication.

[0057] Therefore, in this embodiment, the access key used by the terminal when sending the access request can be used to determine whether the terminal is an unauthenticated terminal. If the terminal uses a publicly available default key to send the access request, it can be determined that the terminal is an unauthenticated terminal. If the terminal uses a PPSK key to send the access request, since the PPSK key is an access key assigned to authenticated terminals, the terminal can be determined to be an authenticated terminal. Of course, if the access key sent by the terminal is neither the default key nor the PPSK key, it can be considered that the terminal is using an incorrect access key to access the wireless network, and the terminal's access can be denied.

[0058] Based on the feasible implementation of S10 described above, this application also provides another method for determining whether the terminal sending the access request is an unauthenticated terminal, including the following steps: S121. Extract the access key corresponding to the access request and match the access key with the key in the preset key library; S122. If the access key is the default key, then the terminal is determined to be an unauthenticated terminal. S123. If the access key is a PPSK key, then determine the current detection mode; wherein, the default key and the PPSK key are used to encrypt the first data sent by the terminal and the second data sent to the terminal; S124. If the detection mode is the collaborative detection mode, extract the terminal identification information corresponding to the terminal from the access request, and determine whether the terminal identification information is bound to the PPSK key. S125. If the terminal identification information is bound to the PPSK key, then the terminal is determined not to be an unauthenticated terminal. S126. If the terminal identification information is not bound to the PPSK key, the terminal is determined to be an unauthenticated terminal. S127. If the detection mode is non-cooperative detection mode, then the terminal is determined not to be an unauthenticated terminal. S128. If the access key is not the default key and is not a PPSK key, then terminal access is denied.

[0059] Terminal identification information refers to information used to identify the identity of a terminal. For example, terminal identification information can be the terminal's MAC address or its device fingerprint. The terminal MAC address is the physical hardware address of a network device, composed of 48 bits (12 hexadecimal bits), and is globally unique. It is embedded in the hardware by the device manufacturer during production, essentially acting as the terminal's access key or "ID number" in the network. The device fingerprint refers to device identification information generated based on feature information extracted from various data frames sent by the terminal. In this embodiment, when allocating a PPSK key and target VLAN to the terminal, the terminal identification information can be bound to the PPSK key and target VLAN.

[0060] It's worth noting that the terminal identification information can specifically be a combination of a MAC address and a device fingerprint. This is because the terminal may have enabled a random MAC address function, which allows the terminal to access the network using only a random MAC address, making it impossible to uniquely identify the terminal based solely on the MAC address. Furthermore, the feature information provided by the terminal in the data frames during network access also serves to identify the terminal. Therefore, introducing an additional device fingerprint can improve the reliability of terminal identification.

[0061] Collaborative detection mode refers to a detection mode that uses terminal identification information and access keys to determine whether a terminal is legitimate. This detection mode has high accuracy. If a terminal uses a default key to access the network, it can be determined to be an unauthenticated terminal. If a terminal uses a dedicated PPSK key to access the network, but its MAC address is not bound to that PPSK key, it can also be determined to be an unauthenticated terminal. Only when a terminal uses a dedicated PPSK key to access the network, and its identification information (such as its MAC address) is bound to that PPSK key, can the terminal be determined to be authenticated.

[0062] Non-cooperative detection mode allows detection based solely on the access key. In this mode, if a terminal accesses using the default key, it is considered unauthenticated. If a terminal accesses using a dedicated PPSK key, it is considered authenticated regardless of whether its terminal identification information is bound to the PPSK key.

[0063] For example, if the first member of the family obtains the PPSK key, this key can be shared and used by family members. In this case, the non-cooperative detection mode can better improve the user experience. When the first member of the family obtains the PPSK key, and other devices use this key to access the system, the non-cooperative detection mode is enabled, skipping the terminal identification information comparison and directly authorizing the device.

[0064] It should be noted that, regardless of whether it is a collaborative detection mode or a non-collaborative detection mode, if the access key used by the terminal is neither the default key nor a PPSK key, the terminal's access can be denied. Since the access key serves to establish encrypted communication between the terminal and the access point device, it can effectively prevent malicious probing during the key distribution process, thus improving security.

[0065] As can be seen, this application can provide a default key. When a terminal connects to the network using the default key, this application can determine that the terminal is an unauthenticated terminal and guide it into the Portal authentication process. When the terminal connects to the network using a dedicated PPSK key, this application can utilize two different modes. In the collaborative detection mode, the terminal identification information and access key work together to determine whether the current terminal is an unauthenticated terminal. In the non-collaborative detection mode, only the access key is used to determine whether the current terminal is an unauthenticated terminal, thus meeting different requirements for security and flexibility.

[0066] Based on the feasible implementation of step S40 above, this application further provides a step for binding the PPSK key, the terminal, and the target VLAN, which may include: S411. Extract the terminal MAC address corresponding to the terminal from the access request; S412. Bind the PPSK key, terminal MAC address and target VLAN.

[0067] In this embodiment, the terminal MAC address can be used as the terminal identification information, and the terminal MAC address can be bound with the PPSK key and the target VLAN so that the terminal can be determined as to whether the terminal is bound to the PPSK key and the target VLAN based on the terminal MAC address.

[0068] Based on the feasible implementation of S124 described above, this application also provides a method for extracting terminal identification information corresponding to the terminal from the access request, which may include: S12411. Extract the terminal MAC address corresponding to the terminal from the access request.

[0069] In this embodiment, the terminal MAC address corresponding to the terminal can first be extracted from the access request and used as the terminal identification information of the terminal.

[0070] Accordingly, based on the feasible implementation of S124 described above, this application also provides a step for determining whether the terminal identification information is bound to the PPSK key, which may include: S12412. Determine whether the terminal MAC address is bound to the PPSK key; S12413. If the terminal MAC address is bound to the PPSK key, then the terminal is determined not to be an unauthenticated terminal. S12414. If the terminal's MAC address is not bound to the PPSK key, then the terminal is determined to be an unauthenticated terminal.

[0071] In this embodiment, it can be determined whether the terminal's MAC address is bound to the PPSK key. If it is bound, the terminal can be identified as an authenticated terminal. If it is not bound, the terminal can be identified as an unauthenticated terminal.

[0072] Based on the feasible implementation of step S40 above, this application also provides another method for binding PPSK keys, terminals, and target VLANs, which may include: S421. Extract the terminal MAC address corresponding to the terminal from the access request; S422. When assigning a terminal to a preset VLAN, receive the DHCP request sent by the terminal and extract the request parameter list and vendor category identifier from the DHCP request; S423. When sending an authentication command to the terminal, extract the request feature field from the HTTP request sent by the terminal; S424. Generate device fingerprints using the request parameter list, supplier category identifier, and request feature fields; S425. Bind the PPSK key, device fingerprint, terminal MAC address and target VLAN.

[0073] To better understand the process of setting up and binding device fingerprints and terminal MAC addresses, please refer to [link / reference]. Figure 2 , Figure 2 This is a flowchart of a terminal identification information binding process provided in an embodiment of this application.

[0074] In this embodiment, the terminal MAC address can be extracted from access requests (such as association frames, authentication frames).

[0075] The generation of device fingerprints involves two stages: 1. Upon receiving a DHCP request from a terminal, the request parameter list (Option 55 field) and vendor category identifier (Option 60 field) can be extracted from the DHCP request. The combination and order of Option 55 parameters are usually different for different operating systems (iOS, Android, Windows) and their versions, and the Option 60 field may also be different for different device types.

[0076] 2. When the terminal presents the authentication interface (Portal page) according to the authentication command, the AP device obtains the HTTP request sent by the terminal and extracts the request feature information from the HTTP request. This request feature information may include information such as the operating system, browser version, and hardware architecture from the User-Agent (UA) field. In addition, auxiliary information such as screen resolution, system font list, and time zone can be further obtained through JavaScript.

[0077] After obtaining the request parameter list, supplier category identifier, and request characteristic field, these three pieces of information can be integrated to generate a device fingerprint. For example, the device fingerprint can be obtained by string concatenation, or by hashing all three pieces of information simultaneously.

[0078] After obtaining the device fingerprint and terminal MAC address, the PPSK key, device fingerprint, terminal MAC address and target VLAN can be bound to meet the device identification requirements.

[0079] Based on the feasible implementation of step S10 above, this application also provides another method for determining whether the terminal sending the access request is an unauthenticated terminal, which may include: S131. Extract the terminal MAC address corresponding to the terminal from the access request; S132. Receive the DHCP request sent by the terminal, extract the request parameter list and vendor category identifier from the DHCP request, and assign the terminal to the preset VLAN; S133. When sending an authentication command to the terminal, extract the request feature field from the HTTP request sent by the terminal; S134. Generate device fingerprint using the request parameter list, supplier category identifier, and request feature field.

[0080] In this embodiment, the terminal MAC address corresponding to the terminal can first be extracted from the access request.

[0081] Furthermore, to avoid the inability to identify the terminal based on its MAC address due to the terminal enabling random MAC addressing, this embodiment can pre-assign the terminal to a preset VLAN and send authentication commands to the terminal. During this process, this embodiment can extract the request parameter list and vendor category identifier from the DHCP request sent by the terminal, and extract the request feature field from the HTTP request sent by the terminal, integrating the extracted request parameter list, vendor category identifier, and request feature field into a device fingerprint.

[0082] Finally, both the device fingerprint and the terminal MAC address can be used as the aforementioned terminal identification information.

[0083] S135. Determine whether either the terminal MAC address or the device fingerprint is bound to the PPSK key; S136. If either the terminal's MAC address or the device fingerprint is bound to the PPSK key, then the terminal is determined not to be an unauthenticated terminal, and the terminal is reassigned to the target VLAN. S137. If neither the terminal MAC address nor the device fingerprint is bound to the PPSK key, then the terminal is determined to be an unauthenticated terminal.

[0084] In this embodiment, it can be determined whether either the terminal MAC address or the device fingerprint is bound to the PPSK key. If either the terminal MAC address or the device fingerprint is bound to the PPSK key, this embodiment can determine that the terminal is not a terminal. Conversely, if neither the terminal MAC address nor the device fingerprint is bound to the PPSK key, this embodiment can determine that the terminal is a terminal. Thus, even when the terminal enables the random MAC function, this embodiment can still identify the terminal through the device fingerprint.

[0085] Based on the feasible implementation of step S30 above, this application further provides a method for verifying authentication information to obtain the corresponding PPSK key and target VLAN, which may include: S311. Compare the authentication information with the information in the target information database to obtain the corresponding comparison results; S312. If the comparison result shows that the authentication information matches any item in the target information database, then determine the PPSK key and the target VLAN based on the authentication information. S313. If the comparison result shows that the authentication information is inconsistent with all the information in the target information database, then the verification result corresponding to the authentication information is determined to be a verification failure, and the corresponding prompt message is output.

[0086] The target information database refers to a pre-stored authorization information database used to verify the legitimacy of a user's identity. It is used to compare the authentication information with the authentication information to verify the authenticity of the authentication information.

[0087] Based on this, when a user submits authentication information (such as mobile phone number or tenant number) on the authentication interface, the authentication information can be compared with the information in the target information database. If a match is found, that is, the submitted authentication information has been registered in the database and is valid, the authentication is deemed successful, and the corresponding PPSK key is generated and the target VLAN is allocated. If no match is found, it indicates that the authentication information is incorrect, and the verification result is verification failure.

[0088] Based on the feasible implementation of step S30 above, this application also provides a method for determining the PPSK key and target VLAN according to authentication information, which may include: S321. Determine the identification information in the authentication information that corresponds to the preset key rule according to the preset key rule; S322. Generate a PPSK key based on the identification information.

[0089] Among them, the preset key rule refers to the pre-set key rule used to generate the PPSK key corresponding to the terminal that sends the access request.

[0090] The identification information is the information corresponding to the preset key rules. For example, the preset key rules may consist of character combination rules (such as the combination rules of letters, numbers, and special symbols) and user identity information. In this case, the identification information is the information in the authentication information that corresponds to the user identity information required by the preset key rules.

[0091] Based on this, by pre-setting key rules and extracting authentication information, the user information required to generate the key is obtained, thereby generating the terminal's exclusive PPSK key.

[0092] Based on the feasible implementation of S40 described above, this application also provides a method for sending a PPSK key to a terminal and binding the PPSK key, the terminal, and the target VLAN, which may include: S431. Send the PPSK key to the terminal and receive the secondary access request sent by the terminal based on the PPSK key. S432. Bind the PPSK key, terminal MAC address and target VLAN according to the terminal MAC address corresponding to the secondary access request.

[0093] Among them, a secondary access request refers to a network access request that the terminal re-initiates using the PPSK key after receiving it from the system.

[0094] Based on this, in practical applications, when modern smart terminal operating systems connect to open networks, the system defaults to enabling the "MAC address randomization" function to protect user privacy. Therefore, during the user's initial connection phase, the terminal MAC address obtained by the AP access key may be a randomly generated "temporary MAC address," not the device's real MAC address. This will result in the terminal passing authentication but failing to log in to the network normally if the binding is completed at this stage. In subsequent attempts, when the user switches to using the access key PPSK for access, the MAC address may be inconsistent because the real MAC address may be used during subsequent accesses. Therefore, the system can require a second request to use the real MAC address to complete the three-way binding between the terminal MAC address, PPSK key, and corresponding target VLAN during the second login.

[0095] To better understand the terminal MAC address binding, please refer to... Figure 3 , Figure 3 A flowchart illustrating another terminal identification information binding process provided in an embodiment of this application. This process may include: S81. Receive the access request and determine whether the terminal sending the access request is an unauthenticated terminal; S82. If the terminal is an unauthenticated terminal, the terminal will be assigned to a preset VLAN, and an authentication command will be sent to the terminal according to the preset VLAN, so that the terminal will present the authentication interface according to the authentication command; the authentication command is sent to the terminal through the same service set identifier SSID. S83. Based on the authentication interface, obtain the corresponding authentication information, verify the authentication information, and obtain the corresponding PPSK key and target VLAN; S84. Send the PPSK key to the terminal and receive the secondary access request sent by the terminal based on the PPSK key; S85. Bind the PPSK key, terminal MAC address and target VLAN according to the terminal MAC address corresponding to the secondary access request.

[0096] As can be seen, in steps S81-S85, during the initial terminal authentication, the terminal MAC address provided by the terminal through the access request may be a random MAC address. Binding a random MAC address can easily lead to MAC address inconsistencies during subsequent accesses. Therefore, this embodiment adopts a secondary access binding strategy. That is, when the terminal initiates a secondary access based on the PPSK key, the PPSK key, the terminal MAC address, and the target VLAN are bound from the terminal MAC address corresponding to the secondary access request. Since the MAC address provided by the terminal during the secondary access has high stability, the information inconsistency problem caused by incorrect binding can be avoided, thus improving the user experience.

[0097] Based on the feasible implementation of step S40 above, this application also provides the following steps that can be performed after binding the PPSK key, the terminal MAC address, and the target VLAN according to the terminal MAC address corresponding to the secondary access request: S51. Receive the real-time access request sent by the terminal, and determine the target VLAN corresponding to the PPSK key based on the PPSK key corresponding to the real-time access request. S52. Assign the terminal to the target VLAN.

[0098] Among them, a real-time access request refers to an access connection request sent to the network in real time by a terminal that has completed the initial authentication and bound the PPSK key during subsequent network access or roaming.

[0099] Based on this, when the terminal reconnects to the network, the AP queries the terminal's MAC address to find the existing binding relationship of the terminal's MAC address, and automatically allows it to access the network using the bound PPSK key and switch to the corresponding target VLAN.

[0100] Based on the feasible implementation of step S40 described above, this application also provides the following steps: S61. Bind the target VLAN to the BSSID of the AP device to which the terminal is connected; After determining the target VLAN corresponding to the PPSK key, the following steps are also included: S71. Determine whether the AP device currently accessed by the terminal is the same as the AP device corresponding to the BSSID bound to the VLAN; S72. If they are different, send a prompt message to the terminal to ask it to change the key, or proceed to the steps of assigning the terminal to a preset VLAN and sending an authentication command to the terminal according to the preset VLAN so that the terminal can present the authentication interface according to the authentication command.

[0101] BSSID refers to the AP physical address, and different BSSIDs can be used to distinguish different AP devices.

[0102] Therefore, considering that user terminals typically access the network via fixed AP devices, and that a user terminal has switched AP devices, there is a possibility that the user has moved from their original residence. To improve internet access security, this application can send a prompt message to the terminal reminding it to change its key. Alternatively, the terminal can be forcibly assigned to a preset VLAN to guide it to re-authenticate, thereby reallocating a PPSK key to the terminal.

[0103] Please refer to Figure 4 , Figure 4 This is an application diagram illustrating a key allocation method for a VLAN network provided in an embodiment of this application; as shown below. Figure 4 As shown, all devices are connected to a single SSID, and each device connects to the internet using a different key, achieving network isolation. Please refer to [reference needed]. Figure 5 , Figure 5 This is a schematic diagram of a network system architecture provided in an embodiment of this application. This network system may include multiple access point devices (such as AP1~AP3), multiple gateway devices (such as gateway devices 1~2), and authentication devices. Access point devices and gateway devices can communicate in various ways. For example, a switch system can be configured between the access point devices and the gateway devices (…). Figure 5 (Not shown in the diagram), and the access point device and the gateway device communicate through the trunk interface of the switch system. Alternatively, a tunnel can be established between the access point device and the gateway device, and communication can be achieved through the tunnel.

[0104] In addition, in this system, each gateway device corresponds to at least one target VLAN. For example, gateway device 1 corresponds to target VLAN 1, and gateway device 2 corresponds to target VLAN 2. Authentication devices correspond to preset VLANs.

[0105] In addition, the aforementioned multiple access point devices broadcast the same SSID.

[0106] Of course, this network system may also include other components, such as a DHCP server, which can be configured according to actual application requirements.

[0107] In practical applications, when an access point device receives an access request from a terminal, it can extract the access key from the request and determine the type of the access key. If the access key is a default key, the access point device can assign the terminal to a preset VLAN, for example, by assigning an IP address to the terminal in a preset VLAN via a DHCP server. At this point, the terminal will begin interacting with the authentication device. For example, the authentication device sends an authentication command to the terminal, and the terminal displays an authentication interface based on the authentication command, allowing the user to enter authentication information through the interface. Subsequently, the terminal sends the authentication information to the authentication device. The authentication device can verify the authentication information and, upon successful verification, assign a PPSK key and a target VLAN to the terminal. Additionally, during the initial authentication, the authentication device can also bind the terminal's terminal identification information (such as the terminal's MAC address and device fingerprint) with the PPSK key and target VLAN. Of course, when the terminal starts using the random MAC function, the authentication device can also bind the terminal's terminal identification information (such as the terminal's MAC address and device fingerprint) with the PPSK key and target VLAN again during subsequent accesses by the terminal.

[0108] If the access key is a PPSK key, the access point device can determine the target VLAN corresponding to the PPSK key and assign the terminal to the target VLAN, for example, by assigning an IP address of the target VLAN to the terminal through a DHCP server. Subsequently, the access point device can send the terminal's traffic to the gateway device corresponding to the target VLAN, thereby enabling the terminal to access the target VLAN.

[0109] In this way, the system determines whether a terminal is accessing for the first time, completing the initial screening of the terminal's identity. For newly accessing terminals, they are automatically assigned to a preset isolation VLAN. The preset VLAN provides initial isolation for unauthenticated terminals, restricting them to accessing only the authentication portal. This prevents unauthorized devices from accessing core network resources, thereby improving the isolation of unfamiliar terminals, enhancing network security, and achieving fine-grained network isolation. By actively sending authentication commands, the terminal is guided to present the authentication interface to obtain authentication information. After verification, a corresponding PPSK key is generated, avoiding the tedious process of manually distributing keys, simplifying the management process, and improving access convenience. The PPSK key replaces the traditional fixed shared key, and the key forms a "three-element binding" relationship with the terminal identification information and the target VLAN. This avoids the privacy leakage risk caused by multiple users sharing the same domain (such as home device communication data being obtained by other users). At the same time, the isolation of a separate target VLAN blocks direct communication between unauthorized devices, significantly reducing the success rate of network attacks (such as ARP spoofing and malicious network hijacking), and improving the overall network security.

[0110] Figure 6 This is a schematic diagram of the structure of a key distribution device 600 for a VLAN network provided in an embodiment of this application. Figure 6 As shown, the VLAN network key distribution device 600 includes: a receiving module 610, a sending module 620, an obtaining module 630, and a binding module 640; wherein: The receiving module 610 is used to receive access requests and determine whether the terminal sending the access request is an unauthenticated terminal. The sending module 620 is used to assign the terminal to a preset VLAN if the terminal is an unauthenticated terminal, and send an authentication command to the terminal according to the preset VLAN so that the terminal presents an authentication interface according to the authentication command; the authentication command is sent to the terminal through the same service set identifier SSID; The acquisition module 630 is used to obtain the corresponding authentication information based on the authentication interface, verify the authentication information, and obtain the corresponding PPSK key and target VLAN. The binding module 640 is used to send the PPSK key to the terminal and perform binding operations on the PPSK key, the terminal and the target VLAN.

[0111] In this embodiment of the application, the receiving module 610 may also be specifically used for: Extract the access key corresponding to the access request, and match the access key with the keys in the preset key library; If the access key is the default key, then the terminal is determined to be the terminal. If the access key is the PPSK key, then the current detection mode is determined; wherein, the default key and the PPSK key are used to encrypt the first data sent by the terminal and the second data sent to the terminal; If the detection mode is a collaborative detection mode, then extract the terminal identification information corresponding to the terminal from the access request, and determine whether the terminal identification information is bound to the PPSK key; If the terminal identification information is bound to the PPSK key, then the terminal is determined not to be the unauthenticated terminal; If the terminal identification information is not bound to the PPSK key, then the terminal is determined to be the unauthenticated terminal; If the detection mode is a non-cooperative detection mode, then it is determined that the terminal is not the unauthenticated terminal; If the access key is neither the default key nor the PPSK key, then the terminal access is denied.

[0112] In this embodiment of the application, the device may further include: The broadcast control module is used to control the AP device to broadcast a unified service set identifier, so that the terminal can connect to different VLANs based on the service set identifier and different access keys.

[0113] In this embodiment of the application, the binding module 640 can also be specifically used for: Extract the terminal MAC address corresponding to the terminal from the access request; When assigning the terminal to a preset VLAN, the system receives a DHCP request sent by the terminal and extracts a request parameter list and a vendor category identifier from the DHCP request. When sending an authentication command to the terminal, the request feature field is extracted from the HTTP request sent by the terminal; A device fingerprint is generated using the request parameter list, the supplier category identifier, and the request feature field; The PPSK key, the device fingerprint, the terminal MAC address, and the target VLAN are bound together.

[0114] In this embodiment of the application, the receiving module 610 may also be specifically used for: Extract the terminal MAC address corresponding to the terminal from the access request; Receive the DHCP request sent by the terminal, extract the request parameter list and supplier category identifier from the DHCP request, and assign the terminal to a preset VLAN; When sending an authentication command to the terminal, the request feature field is extracted from the HTTP request sent by the terminal; A device fingerprint is generated using the request parameter list, the supplier category identifier, and the request feature field; Determine whether either the terminal MAC address or the device fingerprint is bound to the PPSK key; If either the terminal MAC address or the device fingerprint is bound to the PPSK key, then the terminal is determined not to be the unauthenticated terminal, and the terminal is reassigned to the target VLAN. If neither the terminal MAC address nor the device fingerprint is bound to the PPSK key, then the terminal is determined to be the unauthenticated terminal.

[0115] In this embodiment of the application, the sending module 620 can also be specifically used for: The authentication information is compared with the information in the target information database to obtain the corresponding comparison results; If the comparison result shows that the authentication information matches any item in the target information database, then the PPSK key and the target VLAN are determined based on the authentication information. If the comparison result shows that the authentication information is inconsistent with all the information in the target information database, then the verification result corresponding to the authentication information is determined to be a verification failure, and the corresponding prompt message is output.

[0116] In this embodiment of the application, the sending module 620 can also be specifically used for: Based on the preset key rules, determine the identification information in the authentication information that corresponds to the preset key rules; Generate a PPSK key based on the identification information.

[0117] In this embodiment of the application, the binding module 640 can also be specifically used for: Send the PPSK key to the terminal and receive secondary access requests sent by the terminal based on the PPSK key; Based on the terminal MAC address corresponding to the secondary access request, bind the PPSK key, terminal MAC address, and target VLAN.

[0118] In this embodiment of the application, the binding module 640 can also be specifically used for: Receive real-time access requests sent by the terminal, and determine the target VLAN corresponding to the PPSK key based on the PPSK key corresponding to the real-time access request; Assign the terminal to the target VLAN.

[0119] In this embodiment of the application, the device may further include: The BSSID binding module is used to bind the target VLAN to the BSSID of the AP device to which the terminal is connected; The key switching prompt module is used to determine whether the AP device currently accessed by the terminal is the same as the AP device corresponding to the BSSID bound to the VLAN; if they are different, a prompt message is sent to the terminal to prompt for key replacement, or the steps of classifying the terminal to a preset VLAN and sending an authentication command to the terminal according to the preset VLAN, so that the terminal presents an authentication interface according to the authentication command, are entered.

[0120] Figure 7 This is a schematic diagram of the structure of a device for implementing a key allocation method for a VLAN network according to an embodiment of this application. Figure 7 As shown, the device 700 includes: The device 700 may include a processor 701 with one or more processing cores, a memory 702 with one or more computer-readable storage media, a communication component 703, and other components. The processor 701, memory 702, and communication component 703 are connected via a bus 704.

[0121] In the specific implementation process, at least one processor 701 executes computer execution instructions stored in memory 702, causing at least one processor 701 to execute the above-described key distribution method for a VLAN network.

[0122] The specific implementation process of processor 701 can be found in the above method embodiments, and its implementation principle and technical effect are similar. It will not be repeated here.

[0123] Furthermore, the processor can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), etc. A general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in this application can be directly implemented by a hardware processor, or implemented by a combination of hardware and software modules within the processor.

[0124] The memory may include random access memory (RAM) and may also include non-volatile memory (NVM), such as at least one disk storage device.

[0125] The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. Buses can be categorized as address buses, data buses, control buses, etc. For ease of illustration, the buses shown in the accompanying drawings are not limited to a single bus or a single type of bus.

[0126] In some embodiments, a computer program product is also provided, including a computer program or instructions that, when executed by a processor, implement the steps in any of the above-described VLAN network key allocation methods.

[0127] For details on the implementation of each of the above operations, please refer to the previous examples, which will not be repeated here.

[0128] Those skilled in the art will understand that all or part of the steps in the various methods of the above embodiments can be performed by instructions, or by instructions controlling related hardware. These instructions can be stored in a computer-readable storage medium and loaded and executed by a processor.

[0129] Therefore, embodiments of this application provide a computer-readable storage medium storing a plurality of program codes that can be loaded by a processor to execute steps in any of the VLAN network key distribution methods provided in embodiments of this application.

[0130] The storage medium may include: read-only memory (ROM), random access memory (RAM), disk or optical disk, etc.

[0131] According to one aspect of this application, a computer program product or computer program is provided, the computer program product or computer program including computer instructions stored in a computer-readable storage medium.

[0132] Since the instructions stored in the storage medium can execute the steps in any of the VLAN network key allocation methods provided in the embodiments of this application, the beneficial effects that any of the VLAN network key allocation methods provided in the embodiments of this application can achieve can be realized. For details, please refer to the previous embodiments, which will not be repeated here.

[0133] Other embodiments of this application will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of this application that follow the general principles of this application and include common knowledge or customary techniques in the art not disclosed herein. The specification and examples are to be considered exemplary only.

[0134] It should be understood that this application is not limited to the precise structure described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope.

Claims

1. A key distribution method for a VLAN network, characterized in that, The method includes: Receive an access request and determine whether the terminal sending the access request is an unauthenticated terminal; If the terminal is an unauthenticated terminal, the terminal is assigned to a preset VLAN, and an authentication command is sent to the terminal according to the preset VLAN, so that the terminal presents an authentication interface according to the authentication command; the authentication command is sent to the terminal through the same service set identifier (SSID); According to the authentication interface, obtain the corresponding authentication information, verify the authentication information, and obtain the corresponding PPSK key and target VLAN; The PPSK key is sent to the terminal, and the PPSK key, the terminal, and the target VLAN are bound together.

2. The method according to claim 1, characterized in that, The step of determining whether the terminal sending the access request is an unauthenticated terminal includes: Extract the access key corresponding to the access request, and match the access key with the keys in the preset key library; If the access key is the default key, then the terminal is determined to be the unauthenticated terminal; If the access key is the PPSK key, then the current detection mode is determined; the default key and the PPSK key are used to encrypt the first data sent by the terminal and the second data sent to the terminal; If the detection mode is a collaborative detection mode, then extract the terminal identification information corresponding to the terminal from the access request, and determine whether the terminal identification information is bound to the PPSK key; If the terminal identification information is bound to the PPSK key, then the terminal is determined not to be the unauthenticated terminal; If the terminal identification information is not bound to the PPSK key, then the terminal is determined to be the unauthenticated terminal; If the detection mode is a non-cooperative detection mode, then it is determined that the terminal is not the unauthenticated terminal; If the access key is neither the default key nor the PPSK key, then the terminal access is denied.

3. The method according to claim 1, characterized in that, Also includes: The control access point device broadcasts a unified service set identifier, enabling the terminal to connect to different VLANs based on the service set identifier and different access keys.

4. The method according to claim 1, characterized in that, The binding operation of the PPSK key, the terminal, and the target VLAN includes: Extract the terminal MAC address corresponding to the terminal from the access request; When assigning the terminal to a preset VLAN, the system receives a DHCP request sent by the terminal and extracts a request parameter list and a vendor category identifier from the DHCP request. When sending an authentication command to the terminal, the request feature field is extracted from the HTTP request sent by the terminal; A device fingerprint is generated using the request parameter list, the supplier category identifier, and the request feature field; The PPSK key, the device fingerprint, the terminal MAC address, and the target VLAN are bound together.

5. The method according to claim 4, characterized in that, The step of determining whether the terminal sending the access request is an unauthenticated terminal includes: Extract the terminal MAC address corresponding to the terminal from the access request; Receive the DHCP request sent by the terminal, extract the request parameter list and supplier category identifier from the DHCP request, and assign the terminal to a preset VLAN; When sending an authentication command to the terminal, the request feature field is extracted from the HTTP request sent by the terminal; A device fingerprint is generated using the request parameter list, the supplier category identifier, and the request feature field; Determine whether either the terminal MAC address or the device fingerprint is bound to the PPSK key; If either the terminal MAC address or the device fingerprint is bound to the PPSK key, then the terminal is determined not to be the unauthenticated terminal, and the terminal is reassigned to the target VLAN. If neither the terminal MAC address nor the device fingerprint is bound to the PPSK key, then the terminal is determined to be the unauthenticated terminal.

6. The method according to claim 1, characterized in that, The step of verifying the authentication information to obtain the corresponding PPSK key and target VLAN includes: The authentication information is compared with the information in the target information database to obtain the corresponding comparison result; If the comparison result shows that the authentication information matches any item in the target information database, then the PPSK key and the target VLAN are determined based on the authentication information. If the comparison result shows that the authentication information is inconsistent with all information in the target information database, then the verification result corresponding to the authentication information is determined to be a verification failure, and the prompt information corresponding to the verification result is output.

7. The method according to claim 6, characterized in that, The step of determining the PPSK key and the target VLAN based on the authentication information includes: Based on the preset key rules, determine the identification information in the authentication information that corresponds to the preset key rules; The PPSK key is generated based on the identification information.

8. The method according to claim 1, characterized in that, The step of sending the PPSK key to the terminal and binding the PPSK key, the terminal, and the target VLAN includes: Send the PPSK key to the terminal and receive a secondary access request sent by the terminal based on the PPSK key; Based on the terminal MAC address corresponding to the secondary access request, the PPSK key, the terminal MAC address, and the target VLAN are bound together.

9. The method according to claim 8, characterized in that, After binding the PPSK key, the terminal MAC address, and the target VLAN according to the terminal MAC address corresponding to the secondary access request, the method further includes: Receive a real-time access request sent by the terminal, and determine the target VLAN corresponding to the PPSK key based on the PPSK key corresponding to the real-time access request; The terminal is assigned to the target VLAN.

10. The method according to claim 9, characterized in that, Also includes: Bind the target VLAN to the BSSID of the AP device to which the terminal is connected; After determining the target VLAN corresponding to the PPSK key, the process further includes: Determine whether the AP device currently accessed by the terminal is the same as the AP device corresponding to the BSSID bound to the target VLAN; If they are different, a prompt message is sent to the terminal to prompt for a key change, or the process proceeds to the step of assigning the terminal to a preset VLAN and sending an authentication command to the terminal according to the preset VLAN, so that the terminal presents an authentication interface according to the authentication command.

11. A key distribution device for a VLAN network, characterized in that, The device includes: A receiving module is used to receive access requests and determine whether the terminal sending the access request is an unauthenticated terminal. The sending module is configured to, if the terminal is an unauthenticated terminal, classify the terminal into a preset VLAN and send an authentication command to the terminal according to the preset VLAN, so that the terminal presents an authentication interface according to the authentication command; the authentication command is sent to the terminal through the same service set identifier (SSID); The acquisition module is used to acquire the corresponding authentication information based on the authentication interface, and to verify the authentication information to obtain the corresponding PPSK key and target VLAN; The binding module is used to send the PPSK key to the terminal and perform binding operations on the PPSK key, the terminal, and the target VLAN.

12. A device, characterized in that, include: One or more processors; Memory; One or more programs, wherein the programs are stored in memory and configured to be executed by one or more processors, the programs being configured to perform the key distribution method for a VLAN network as described in any one of claims 1 to 10.

13. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores program code that can be called by a processor to execute the key distribution method for the VLAN network as described in any one of claims 1 to 10.

Images