A method, apparatus, device and medium for multi-mode configuration of a WIFI pre-shared key group
By unifying the key group configuration data from the cloud, AC controller, and local command line into a standard format, the problem of inconsistent key data formats in existing technologies is solved, achieving flexibility and low-cost operation and maintenance in WIFI key management.
Patent Information
- Application Number
- CN202611351754.0
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2026-09-02
- Publication Date
- 2026-11-06
AI Technical Summary
Existing Wi-Fi devices use different key data formats under different configuration modes, which cannot be uniformly consumed by the driver layer, leading to increased system complexity and maintenance costs, and making it difficult to flexibly adapt to various deployment scenarios.
By uniformly converting key group configuration data from the cloud, AC controller, and local command line into a standard key file format, and selecting the authentication path according to the preset PPSK mode value, flexibility and unified processing of key management are achieved.
It reduces system complexity and maintenance costs, improves the deployment flexibility and operational efficiency of WIFI key group management, is compatible with multiple configuration distribution channels, and unifies the key data processing flow.
Smart Images
Figure CN123055281A_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of communication technology, and in particular to a method, apparatus, device and medium for configuring a multi-mode WIFI pre-shared key group. Background Technology
[0002] With the deepening of enterprise digital transformation and the explosive growth of wireless terminals in scenarios such as hotels, factories (Internet of Things), and campuses, the need to assign independent WPA (Wi-Fi Protected Access) keys to different terminals under the same SSID (Service Set Identifier) is becoming increasingly urgent. By binding an independent pre-shared key and an optional VLAN (Virtual Local Area Network) identifier to each terminal, secure isolation and differentiated network access control between terminals can be achieved, which has become an important direction for the current refined management of Wi-Fi security.
[0003] Existing Wi-Fi devices typically only support a single PSK (Pre-Shared Key) key management configuration method. Some devices allow users to manually enter the MAC (Media Access Control) address and key binding relationship in a local configuration file, which takes effect through the local authentication process. Other devices support integration with a RADIUS (Remote Authentication Dial-In User Service) authentication server, where the remote server dynamically distributes the key upon terminal access. These two methods are independent and suitable for local maintenance and centralized authentication scenarios, respectively.
[0004] However, the above two methods only solve the key source problem and do not consider the diversity of configuration distribution channels. In actual deployments, cloud platform scenarios require batch distribution of configurations via JSON protocol, AC (Access Controller) centralized management scenarios require cross-mesh node synchronization via binary IE (Information Element) protocol, and on-site operation and maintenance scenarios require direct operation via command line. The key data formats generated by different configuration methods are different and cannot be uniformly consumed by the driver layer, resulting in each access method requiring an independent key processing path, increasing system complexity and maintenance costs. Summary of the Invention
[0005] This application provides a method, apparatus, device, and medium for configuring a multi-mode WIFI pre-shared key group, which can reduce system complexity and maintenance costs.
[0006] To achieve the above objectives, this application adopts the following technical solution: In a first aspect, this application provides a method for configuring a multi-mode WIFI pre-shared key group, the method comprising: Receive key group configuration data; When the configuration mode of the key group configuration data is cloud configuration mode, parse the JSON array sent from the cloud; Extract the terminal MAC address, plaintext key, and VLAN identifier for each key record from the JSON array; Create a separate key file for each Service Set Identifier (SSID) in each Radio. Write the terminal MAC address, plaintext key, and VLAN identifier of each extracted key record into the key file corresponding to the different Service Set Identifiers (SSIDs) in all Radios in a unified format to generate a standard key file. When the configuration mode of the key group configuration data is AC controller configuration mode, receive the binary IE protocol packet sent by the AC controller; When the binary IE protocol packet contains a local key IE, the terminal MAC address, plaintext key, and VLAN identifier in each key record are extracted from the TLV structure of the local key IE, and the terminal MAC address, plaintext key, and VLAN identifier in each key record are written into the standard key file according to the unified format.
[0007] In some possible implementations, the method further includes: Obtain the private pre-shared key PPSK mode value, which indicates the working status of the PPSK mode. The PPSK mode includes off mode, local file mode, and RADIUS mode. When the PPSK mode value is the value corresponding to the local file mode, read each key record in the standard key file. Based on the PBKDF2 algorithm and the plaintext key in each key record, obtain the pair master key. Store the pair master key in the pair master key identifier cache. During the terminal access authentication process, search for the pair master key corresponding to the terminal's MAC address from the pair master key identifier cache according to a preset priority to complete the authentication.
[0008] In some possible implementations, the method further includes: When the PPSK mode value is the value corresponding to the RADIUS mode, each key record in the standard key file is read; during terminal access authentication, an authentication request is initiated to the RADIUS server through the RADIUS protocol; based on the authentication result returned by the RADIUS server and the VLAN identifier in each key record, the corresponding VLAN is assigned to the terminal.
[0009] In some possible implementations, the step of searching for the pair master key corresponding to the terminal's MAC address from the pair master key identifier cache according to a preset priority to complete authentication includes: The first priority authentication mode directly uses the VAP global pre-shared key to authenticate with the terminal. If the first priority authentication mode fails to match, the second priority authentication mode is executed, which uses the pair master key in the pair master key identifier cache corresponding to the group zero MAC address to authenticate with the terminal. If the second priority authentication mode fails to match, the third priority authentication mode is executed, which uses the terminal's MAC address to look up the corresponding pair master key identifier in the pair master key identifier cache, obtains the corresponding pair master key based on the pair master key identifier, and uses the obtained pair master key to authenticate with the terminal.
[0010] In some possible implementations, when the configuration mode of the key group configuration data is AC controller configuration mode, the method further includes: When the binary IE protocol packet contains a mode configuration IE, the mode state is recorded according to the PPSK mode value in the mode configuration IE, the local key file parameters and the remote authentication dial-up user service protocol RADIUS authentication parameters are cleared through the unified configuration interface UCI, and the configuration environment is rebuilt according to the PPSK mode value. When the binary IE protocol packet contains a RADIUS configuration IE, RADIUS server information is extracted from the RADIUS configuration IE. The RADIUS server information includes IP address, port and shared key. RADIUS authentication parameters are set and RADIUS server parameters are configured through UCI.
[0011] In some possible implementations, the method further includes: When the key group configuration data is updated, the standard key file is regenerated based on the updated key group configuration data; the generated standard key file is deleted, and the regenerated standard key file is written to the storage path of the generated standard key file to complete the update of the standard key file.
[0012] Secondly, this application provides an apparatus for configuring a multi-mode WIFI pre-shared key group, the apparatus comprising: The format conversion module receives key group configuration data; when the configuration mode of the key group configuration data is cloud configuration mode, it parses the JSON array sent from the cloud; extracts the terminal MAC address, plaintext key, and VLAN identifier of each key record from the JSON array; creates an independent key file for each different Service Set Identifier (SSID) in each Radio, and writes the extracted terminal MAC address, plaintext key, and VLAN identifier of each key record into the key files corresponding to the different SSIDs in all Radios according to a unified format to generate a standard key file; when the configuration mode of the key group configuration data is AC controller configuration mode, it receives binary IE protocol packets sent by the AC controller; when the binary IE protocol packet contains a local key IE, it extracts the terminal MAC address, plaintext key, and VLAN identifier of each key record from the TLV structure of the local key IE, and writes the terminal MAC address, plaintext key, and VLAN identifier of each key record into the standard key file according to the unified format.
[0013] Thirdly, this application provides a computing device, including a memory and a processor; The memory stores one or more computer programs, the one or more computer programs including instructions; when the instructions are executed by the processor, the computing device performs the method as described in any one of the first aspects.
[0014] Fourthly, this application provides a computer-readable storage medium for storing a computer program for performing the method as described in any one of the first aspects.
[0015] Fifthly, this application provides a computer program product comprising one or more computer instructions, wherein when the computer instructions are executed by a computer, the computer performs the method as described in any one of the first aspects.
[0016] As can be seen from the above technical solution, this application has at least the following beneficial effects: In this application, key group configuration data from at least one configuration mode is received; the key group configuration data is converted into a standard key file in a unified format according to the configuration mode of the key group configuration data; a preset PPSK mode value is obtained, and when the PPSK mode value is the value corresponding to the local file mode, each key record in the standard key file is read; a pair master key is obtained based on the PBKDF2 algorithm and the plaintext key in each key record; the pair master key is stored in a pair master key identifier cache; in the four-way handshake of terminal access authentication, the pair master key corresponding to the MAC address of the terminal is searched from the pair master key identifier cache according to a preset priority to complete the authentication.
[0017] In existing technical solutions, the key data formats generated by different configuration modes vary and cannot be uniformly consumed by the driver layer. This results in each access method requiring an independent key processing path, increasing system complexity and maintenance costs. Therefore, this application addresses this by uniformly converting key group configuration data from different configuration modes into a standard key file format and selecting the corresponding authentication path based on a preset PPSK mode value. This allows the cloud, AC controller, and command line configuration modes to share the same key data format and application pipeline, eliminating the need to develop separate key processing paths for each access method and reducing system complexity and maintenance costs.
[0018] It should be understood that the descriptions of technical features, technical solutions, beneficial effects, or similar language in this application do not imply that all features and advantages can be achieved in any single embodiment. Rather, it is understood that the description of a feature or beneficial effect means that a specific technical feature, technical solution, or beneficial effect is included in at least one embodiment. Therefore, the descriptions of technical features, technical solutions, or beneficial effects in this specification do not necessarily refer to the same embodiment. Furthermore, the technical features, technical solutions, and beneficial effects described in this embodiment can be combined in any suitable manner. Those skilled in the art will understand that embodiments can be implemented without one or more specific technical features, technical solutions, or beneficial effects of a particular embodiment. In other embodiments, additional technical features and beneficial effects may be identified in specific embodiments that do not embody all embodiments. Attached Figure Description
[0019] Figure 1 A schematic diagram illustrating an application scenario provided in an embodiment of this application; Figure 2 A flowchart illustrating a method for configuring a multi-mode WIFI pre-shared key group, as provided in this application embodiment; Figure 3 A schematic diagram of an apparatus for configuring a multi-mode WIFI pre-shared key group according to an embodiment of this application; Figure 4This is a schematic diagram of a computing device provided in an embodiment of this application. Detailed Implementation
[0020] The terms "first," "second," and "third," etc., used in this application specification and accompanying drawings are used to distinguish different objects, not to limit a specific order.
[0021] In the embodiments of this application, the terms "exemplary" or "for example" are used to indicate that something is an example, illustration, or description. Any embodiment or design that is described as "exemplary" or "for example" in the embodiments of this application should not be construed as being more preferred or advantageous than other embodiments or design. Specifically, the use of the terms "exemplary" or "for example" is intended to present the relevant concepts in a specific manner.
[0022] Currently, in scenarios such as enterprises, hotels, factory IoT, and campuses, the need to assign independent WPA keys to different terminals under the same SSID is becoming increasingly urgent. Existing Wi-Fi devices typically only support a single PSK management configuration method. Some devices allow manual entry of the MAC address and key binding relationship in a local configuration file, which takes effect through the local authentication process; other devices support connection to a RADIUS authentication server, where the remote server dynamically distributes keys when the terminal connects. These two methods are independent and are suitable for local operation and maintenance and centralized authentication scenarios, respectively.
[0023] However, the two methods mentioned above only solve the key source problem and do not consider the diversity of configuration distribution channels. Cloud platform scenarios require batch distribution of configurations via JSON protocol, AC centralized management scenarios require synchronization across Mesh (wireless mesh network) nodes via binary IE protocol, and on-site operation and maintenance scenarios require direct operation via command line. Existing solutions cannot cover these three configuration modes with a unified architecture, resulting in inflexible key management under different deployment scenarios. At the same time, the key data generated by different configuration methods have different formats and cannot be consumed uniformly by the driver layer, increasing system complexity and maintenance costs.
[0024] In view of this, embodiments of this application provide a method for configuring a multi-mode pre-shared key group for Wi-Fi. This method is applied to an AP (Access Point) and converts key group configuration data from cloud configuration mode, AC controller configuration mode, and local command line configuration mode into a standard key file format. This allows key group configuration data from different configuration modes to be loaded and processed uniformly, eliminating the need to develop a complete key processing flow for each access method and reducing system complexity. Simultaneously, by obtaining a preset PPSK mode value and selecting the corresponding authentication path based on that value, the same standard key file can simultaneously support both local file authentication and RADIUS authentication modes, increasing the flexibility of key management. Furthermore, when the key group configuration data is updated, the key group configuration can be updated simply by regenerating the standard key file and replacing the old file, without needing to develop additional processing logic for the update operation. Compared with existing technologies, this application is compatible with multiple configuration distribution channels, unifies the key data processing flow, effectively reduces system complexity and maintenance costs, and improves the deployment flexibility and operational efficiency of Wi-Fi key group management.
[0025] To make the technical solution of this application clearer and easier to understand, the application scenarios of the technical solution of this application are described below with reference to the accompanying drawings. Figure 1 As shown in the figure, this figure is a schematic diagram of an application scenario provided by an embodiment of this application.
[0026] In this application scenario, the AP establishes a communication connection with the server (including the cloud management platform and the AC controller). The AP, as the execution subject of the multi-mode configuration WIFI pre-shared key group method provided in this application embodiment, is used to receive key group configuration data from at least one configuration mode among cloud configuration mode, AC controller configuration mode, and local command line configuration mode, and execute the corresponding key group configuration logic locally. The cloud management platform, as the management terminal for cloud hosting and remote operation and maintenance, is used to send key group configuration data to the AP via the JSON protocol. The AC controller, as the management terminal for centralized control, is used to send key group configuration data to the AP via the binary IE protocol. Operation and maintenance personnel send key group configuration data in iwpriv command format to the AP via the local command line for on-site debugging and single-machine deployment scenarios.
[0027] This application unifies key group configuration data from cloud-based configuration mode, AC controller configuration mode, and local command-line configuration mode into a standard key file format. This allows key group configuration data from different configuration modes to be loaded and processed uniformly, eliminating the need to develop a separate complete key processing flow for each access method and reducing system complexity. Furthermore, by obtaining a preset PPSK mode value and selecting the corresponding authentication path based on that value, the same standard key file can simultaneously support both local file authentication and RADIUS authentication modes, increasing the flexibility of key management.
[0028] To make the technical solution of this application clearer and easier to understand, the following describes a method for configuring a multi-mode WIFI pre-shared key group, based on the above application scenarios. For example... Figure 2 As shown, this figure is a flowchart of a method for configuring a multi-mode WIFI pre-shared key group according to an embodiment of this application. The method includes: S201, AP receives key group configuration data from at least one configuration mode.
[0029] The configuration mode is the source of key group configuration data. In this application embodiment, the configuration modes include cloud configuration mode, AC controller configuration mode and local command line configuration mode.
[0030] Key group configuration data is a set of key records containing the terminal MAC address, plaintext key, and VLAN identifier. Each key record corresponds to a terminal device.
[0031] When the configuration mode is cloud-based, the AP receives a JSON array (key group configuration data) from the cloud management platform via the manage-server process. The manage-server process is a service module running locally on the AP, specifically responsible for communicating with the cloud management platform and receiving and parsing the JSON-formatted configuration data. The JSON array contains a field for the PPSK (Private Pre-Shared Key) mode value. The AP extracts the PPSK mode value through the manage-server process and writes it into the driver configuration structure.
[0032] When the configuration mode is AC controller configuration mode, the AP receives binary IE protocol packets (key group configuration data) sent by the AC controller through the mapd process. The binary IE protocol packet is the data unit for communication between the AC controller and the AP. This binary IE protocol packet contains at least one of the following: mode configuration IE, local key IE, or RADIUS configuration IE. The payload of the local key IE uses a TLV (Type-Length-Value) structure to encapsulate the key record. In the TLV structure of the local key IE, the T field identifies the type of the key record, the L field indicates the number of bytes in the value field, and the V field stores the terminal MAC address, plaintext key, and VLAN identifier sequentially. The AC sends the PPSK mode value through the mode configuration IE in the binary IE protocol packet. After receiving it, the AP extracts the PPSK mode value and writes it into the driver configuration structure.
[0033] When the configuration mode is local command-line configuration mode, the AP receives the iwpriv command entered by the maintenance personnel through the local terminal. The iwpriv command is a proprietary command in the Linux system used to configure wireless network card driver parameters. The iwpriv command carries the PPSK mode value and key group configuration data. After receiving the iwpriv command, the AP extracts the PPSK mode value and key group configuration data from the parameters of the iwpriv command and writes the PPSK mode value into the driver configuration structure.
[0034] In some embodiments, upon AP startup, the AP reads local key file parameters and RADIUS authentication parameters through the UCI (Unified Configuration Interface) configuration file. The AP sets the interface configuration bitmap marker based on the local key file parameters and RADIUS authentication parameters, triggering the Wi-Fi platform layer to execute the `iwpriv` command to set the PPSK mode value. This interface configuration bitmap marker identifies the currently configured authentication method. The Wi-Fi platform layer executes the corresponding `iwpriv` command based on this bitmap marker, writing the PPSK mode value into the driver configuration structure. The local key file parameter points to the storage path of the standard key file, informing the AP where to read the key record in local file mode. The RADIUS authentication parameter controls whether RADIUS authentication is enabled, informing the AP to forward authentication requests to the RADIUS server in RADIUS mode.
[0035] S202, AP converts the key group configuration data into a standard key file in a unified format according to the configuration mode of the key group configuration data.
[0036] The standard key file is a text file stored locally on the AP. Each key record in the standard key file corresponds to the key configuration information of a terminal. The uniform format of the standard key file is VLAN ID (vlanid) + terminal MAC address + plaintext key, where the VLAN ID is optional.
[0037] When the configuration mode of the key group configuration data is cloud configuration mode, the AP receives the JSON array sent by the cloud management platform through the manage-server process.
[0038] The AP parses the JSON array sent from the cloud through the manage-server process. In this embodiment, the name of the JSON array is ppskConfigs. ppskConfigs is an array type, which contains one or more elements, each of which corresponds to the key configuration information of a terminal.
[0039] The AP extracts three fields from each key record in the JSON array. The first field is MAC, which represents the terminal's MAC address. The second field is password, which represents the plaintext key used by the terminal. The third field is VLAN Port, which represents the VLAN identifier assigned to the terminal after it connects.
[0040] The AP obtains the current number of Radios on the device. A Radio is a wireless radio card within the AP; each Radio corresponds to a physical wireless network card chip, and each Radio can create multiple VAPs (Virtual Access Points). The AP creates a separate standard key file for each Radio's different Service Set Identifier (SSID). The path format of the standard key file is / tmp / wpa_psk_file_<iface_prefix> <index>.
[0041] The AP extracts the VLAN identifier, terminal MAC address, and plaintext key from each key record and writes them into the standard key file corresponding to the different Service Set Identifiers (SSIDs) across all radios, using a uniform format. For example, if a key record has a VLAN identifier of 100, a terminal MAC address of AA:BB:CC:DD:EE:12, and a plaintext key of evqZ3Ti8, then the content written to the file would be vlanid=100 AA:BB:CC:DD:EE:12 evqZ3Ti8. The AP performs the above writing operation on all key records one by one until all key records are written into the standard key file corresponding to the different Service Set Identifiers (SSIDs) across all radios.
[0042] When the configuration mode of the key group configuration data is AC controller configuration mode, the AP receives binary IE protocol packets sent by the AC controller; When the binary IE protocol packet contains a local key IE, the terminal MAC address, plaintext key, and VLAN identifier in each key record are extracted from the TLV structure of the local key IE, and the terminal MAC address, plaintext key, and VLAN identifier in each key record are written into the standard key file in a unified format.
[0043] When the binary IE protocol packet contains a mode configuration IE, the AP records the mode state according to the PPSK mode value in the mode configuration IE, clears the local key file parameters and RADIUS authentication parameters through the UCI (Unified Configuration Interface), and rebuilds the configuration environment according to the PPSK mode value.
[0044] When the binary IE protocol packet contains a RADIUS configuration IE, the AP parses the RADIUS configuration IE and extracts the RADIUS server information, which includes the IP address, port and shared key. The AP sets the RADIUS authentication parameters and configures the RADIUS server parameters through the UCI.
[0045] When the key group configuration data is configured in local command-line configuration mode, the AP receives the `iwpriv` command input by the operations and maintenance personnel. This `iwpriv` command contains the PPSK mode value. When the PPSK mode value is the value corresponding to the local file mode, the AP retrieves the terminal MAC address, plaintext key, and VLAN identifier from each key record from the `iwpriv` command. The AP then writes the terminal MAC address, plaintext key, and VLAN identifier from each key record into a standard key file according to a unified format.
[0046] This application unifies the key group configuration data from three different configuration modes into a standard key file of a unified format. This makes the subsequent key loading, derivation and injection processes not need to care about which configuration mode the key data comes from. All configuration modes share the same set of processing logic, eliminating the need to develop separate processing paths for each configuration mode and reducing the implementation complexity of the system.
[0047] S203, AP obtains the preset PPSK mode value.
[0048] The PPSK mode value is an integer stored in the AP's driver configuration structure. This PPSK mode value indicates the working status of the PPSK mode, which includes three modes: off mode, local file mode, and RADIUS mode. The PPSK mode value has three possible values: 0 indicates off mode, 1 indicates local file mode, and 2 indicates RADIUS mode. In off mode, the AP does not enable the PPSK function and reverts to the traditional single PSK authentication method.
[0049] After generating the standard key file, the AP reads the PPSK mode value from the driver configuration structure and determines which authentication path to take based on the PPSK mode value.
[0050] After the AP reads the PPSK mode value from the driver configuration structure, it temporarily stores the PPSK mode value in a local memory variable. If the read PPSK mode value is 1, the AP enters the processing flow corresponding to the local file mode, that is, executes steps S204 to S206. If the read PPSK mode value is 2, the AP enters the processing flow corresponding to the RADIUS mode, that is, executes step S207. If the read PPSK mode value is 0, the AP does not perform any PPSK authentication operation and directly uses the traditional single PSK authentication method.
[0051] S204. When the PPSK mode value is the value corresponding to the local file mode, the AP reads each key record in the standard key file.
[0052] When the PPSK mode value is equal to 1, the AP determines that the current working mode is local file mode and enters the processing flow corresponding to local file mode.
[0053] The AP invokes the 8021xd daemon to read the standard key file. The 8021xd daemon is an authentication service process that runs continuously in the background of the AP, responsible for handling all matters related to Wi-Fi authentication.
[0054] The 8021xd daemon locates the storage path of the standard key file. The standard key file, generated in S202, is stored in the / tmp directory of the AP's local file system, and its filename is wpa_psk_file_.<iface_prefix> <index>If the AP is configured with multiple Radios, each Radio directory contains a corresponding standard key file. The 8021xd daemon reads the standard key file corresponding to each Radio one by one.
[0055] After opening the standard key file, the 8021xd daemon reads the file line by line, starting from the first line. Each line in the standard key file corresponds to a key record. The 8021xd daemon temporarily stores each key record in a key record list in memory. The key record list is an array structure, and each element in the array contains three fields: VLAN identifier, terminal MAC address, and plaintext key. The 8021xd daemon performs parsing and temporary storage operations on all lines in the standard key file one by one until the end of the file. If the standard key file is empty, the key record list is empty, and the 8021xd daemon terminates the current processing flow.
[0056] S205 and AP obtain paired master keys based on the PBKDF2 algorithm and the plaintext key in each key record; and store the paired master keys in the paired master key identifier cache.
[0057] The PBKDF2 (Password-Based Key Derivation Function 2) algorithm is used to generate a fixed-length binary data from a plaintext password through multiple iterative hash operations.
[0058] The pairwise master key (PMK) is the binary data output by the PBKDF2 algorithm. This pairwise master key is used to generate temporary session keys during the four-way handshake authentication.
[0059] The Paired Master Key Identifier Cache is a storage area inside the AP driver that stores paired master keys indexed by the paired master key identifier.
[0060] The AP retrieves the first key record from the key record list. The AP then calls the PBKDF2 algorithm to perform derivation calculations on the plaintext key in that key record. The input parameters of the PBKDF2 algorithm include the plaintext key, a pseudo-random function, the number of iterations, and the output length. The AP uses the plaintext key as input to the PBKDF2 algorithm, and after multiple iterations of pseudo-random function operations, outputs a fixed-length binary data set, which is the paired master key corresponding to that terminal.
[0061] After obtaining the paired master key, the AP stores it in the paired master key identifier cache. The specific storage process is as follows: the AP calculates the paired master key identifier corresponding to the paired master key, uses the paired master key identifier as an index, and uses the paired master key as the value to form a key-value pair, which is then stored in the paired master key identifier cache.
[0062] The AP repeats the above derivation and storage operations for each key record in the key record list. If there are N records in the key record list, the AP performs N PBKDF2 derivation calculations and stores the N paired master keys sequentially into the paired master key identifier cache through the OID (Object Identifier) interface. After all key records have been processed, the paired master key identifier cache stores the paired master keys of all terminals.
[0063] This application completes the PBKDF2 derivation and cache injection of all key records before terminal access authentication. This allows the driver to directly look up the corresponding paired master keys from the cache when the terminal initiates the four-way handshake, eliminating the need to perform PBKDF2 derivation calculations temporarily during authentication and reducing processing latency during terminal authentication. Furthermore, the multiple iterative hash operations of the PBKDF2 algorithm increase the difficulty of brute-force attacks on plaintext keys, protecting key security.
[0064] S206. In the four-way handshake for terminal access authentication, the AP searches for the pair master key corresponding to the terminal's MAC address from the pair master key identifier cache according to the preset priority to complete the authentication.
[0065] The four-way handshake is a message exchange process in the Wi-Fi authentication process. This process involves exchanging four message frames between the terminal and the access point (AP) to verify whether both parties hold the same pair of master keys and to negotiate and generate a temporary session key for encrypting data traffic.
[0066] The preset priority is the order in which the AP driver attempts to find the paired master key during the four-way handshake. This order includes first priority, second priority, and third priority.
[0067] When a terminal initiates a Wi-Fi connection, it sends the first message frame of the four-way handshake to the access point (AP), which carries the terminal's MAC address. Upon receiving this message frame, the AP's Wi-Fi driver initiates the four-way handshake authentication process and searches for the pair master key corresponding to the terminal's MAC address in the pair master key identifier cache according to a preset priority.
[0068] The AP performs the first-priority matching. The first priority is to directly use the VAP's global pre-shared key to complete the four-way handshake authentication with the terminal. Specifically, the VAP's global pre-shared key is the single Wi-Fi password configured on the VAP, and all terminals connecting to this VAP use this single Wi-Fi password by default. The AP checks whether the VAP is configured with a global pre-shared key. If the VAP is configured with a global pre-shared key, the AP driver directly uses this global pre-shared key to derive the corresponding paired master key and completes the four-way handshake authentication with the terminal. At this point, the authentication process ends, and the terminal successfully accesses the network.
[0069] If the first priority match fails (i.e., the VAP is not configured with a globally pre-shared key, or authentication using the globally pre-shared key fails), the AP driver executes the second priority match. The second priority uses the pairwise master key from the pairwise master key identifier cache corresponding to the group zero MAC address to complete the four-way handshake authentication with the terminal. Specifically, the group zero MAC address refers to a group key with all MAC addresses set to 0, used as an index in the pairwise master key identifier cache. The AP driver uses the group zero MAC address as an index to look up the corresponding pairwise master key identifier in the cache and retrieves the corresponding pairwise master key based on that identifier. If the pairwise master key corresponding to the group zero MAC address exists in the cache, the AP driver uses that pairwise master key to complete the four-way handshake authentication with the terminal, at which point the authentication process ends.
[0070] If the second priority match fails (i.e., the paired master key identifier cache does not contain a paired master key corresponding to the zero-group MAC address, or authentication using that key fails), the AP executes the third priority match. The third priority involves using the terminal's MAC address to search for the corresponding paired master key identifier in the paired master key identifier cache, obtaining the corresponding paired master key based on that identifier, and using the obtained paired master key to complete the four-way handshake authentication with the terminal. Specifically, the AP uses the MAC address carried by the terminal in the first message frame as an index to search for the corresponding paired master key identifier in the paired master key identifier cache, and obtains the corresponding paired master key based on that identifier. If the paired master key identifier cache contains a paired master key corresponding to the terminal's MAC address, the AP uses that paired master key to complete the four-way handshake authentication with the terminal. At this point, the authentication process ends, and the terminal successfully accesses the network.
[0071] If the third priority match also fails, meaning that the paired master key identifier does not exist in the paired master key identifier cache for the terminal's MAC address, the AP determines that the terminal cannot complete the authentication, terminates the four-way handshake process, and the terminal access fails.
[0072] This application utilizes a pre-defined three-level priority matching mechanism to enable the AP to be compatible with scenarios involving a mix of traditional PSK and PPSK terminals. Traditional PSK terminals use a globally pre-shared VAP key for authentication, eliminating the need for separate key records for each terminal. PPSK terminals, on the other hand, use independent paired master keys corresponding to their own MAC addresses for authentication, achieving differentiated authentication and network access isolation for different terminals. Both types of terminals share the same authentication process, eliminating the need to develop separate authentication processing logic for different terminal types and reducing system implementation complexity.
[0073] S207. When the PPSK mode value is the value corresponding to the RADIUS mode, the AP reads each key record in the standard key file; during terminal access authentication, it initiates an authentication request to the RADIUS server through the RADIUS protocol; based on the authentication result returned by the RADIUS server and the VLAN identifier in each key record, it assigns the corresponding VLAN to the terminal.
[0074] RADIUS mode corresponds to the operating state when the PPSK mode value equals 2. In RADIUS mode, the AP does not rely on locally stored pairwise master keys for authentication. Instead, it forwards the terminal's authentication request to the RADIUS server, which verifies the terminal's identity. The RADIUS protocol is a remote authentication dial-up user service protocol used to define the communication rules for exchanging authentication information between the AP and the RADIUS server.
[0075] When the AP reads a PPSK mode value of 2, it determines that the current working mode is RADIUS mode and enters the processing flow corresponding to RADIUS mode.
[0076] The AP reads each key record from the standard key file. The AP opens the standard key file and reads it line by line, starting from the first line. Each line is parsed using spaces as delimiters to extract the terminal MAC address and VLAN identifier from each key record. It's important to note that in RADIUS mode, the AP only obtains the terminal's MAC address and VLAN identifier from the standard key file; it does not obtain the plaintext key, because key verification in RADIUS mode is handled by the RADIUS server, and the AP does not need to hold the plaintext key locally. The AP temporarily stores the parsed MAC address and VLAN identifier mapping in a terminal information list in memory. This terminal information list is used to assign the corresponding VLAN to the terminal when it connects.
[0077] When a terminal initiates a Wi-Fi connection request, the Access Point (AP) receives an authentication request frame from the terminal. This frame carries the terminal's MAC address, username, and password. The AP then sends an authentication request to the RADIUS server via the RADIUS protocol. The AP encapsulates the terminal's MAC address, username, and password into a RADIUS authentication request message. The destination address of this message is the pre-configured RADIUS server IP address, and the destination port is the RADIUS server's authentication port. The AP sends this message to the RADIUS server via a wired or wireless backhaul network and enters a waiting state, awaiting the authentication result from the RADIUS server.
[0078] After receiving a RADIUS authentication request message from the AP, the RADIUS server verifies the terminal's identity information against its locally stored user database. Upon successful verification, the RADIUS server returns an authentication response message to the AP, containing the authentication result, which can be either successful or rejected. If the terminal's username and password match a record in the server's database, the RADIUS server returns a successful authentication response; otherwise, if they do not match or the terminal's record does not exist in the database, the RADIUS server returns a rejected authentication response.
[0079] After receiving the authentication response message from the RADIUS server, the AP parses the authentication result field in the message. If the authentication result is authentication rejection, the AP determines that the terminal's authentication has failed, sends an authentication rejection message to the terminal, and the terminal cannot access the network, thus ending the authentication process.
[0080] If the authentication result is successful, the AP determines that the terminal has been successfully authenticated. The AP searches for the VLAN ID corresponding to the MAC address carried in the authentication request frame from the terminal information list in memory. If a matching record is found, the AP extracts the VLAN ID from that record. If no matching record is found, the AP uses the default VLAN ID as the terminal's VLAN configuration.
[0081] The AP assigns a corresponding VLAN to the terminal based on the found VLAN identifier. The AP then assigns the terminal's access port to the virtual LAN corresponding to that VLAN identifier, thus restricting the data traffic of the terminal after it accesses the network to the range of that VLAN, achieving network isolation and differentiated access control between different terminals.
[0082] This application unifies the key group configuration data of three configuration modes into a standard key file format, allowing different configuration modes to share the same set of processing logic. This eliminates the need to develop separate key processing paths for each mode, reducing system complexity. Simultaneously, by preset PPSK mode values, it selects between local file authentication and RADIUS authentication paths. In local file mode, the PMK is pre-derived and cached, reducing processing latency during terminal authentication. In RADIUS mode, keys are centrally stored on the server, reducing the risk of key leakage at the AP.
[0083] In some embodiments, when the key group configuration data is updated, the standard key file is regenerated based on the updated key group configuration data; the generated standard key file is deleted, and the regenerated standard key file is written to the storage path of the generated standard key file to complete the update of the standard key file.
[0084] Specifically, the AP monitors for update trigger conditions in the standard key file via the 8021xd daemon. Update trigger conditions include the cloud management platform re-issuing the JSON array, the AC controller re-sending the binary IE protocol packet, and maintenance personnel reconfiguring key records using the iwpriv command. When any of these update trigger conditions occurs, the AP determines that the key group configuration data has been updated.
[0085] The AP regenerates the standard key file based on the updated key group configuration data. The specific process of regeneration is the same as that of generating a new standard key file in S202, and will not be repeated here.
[0086] The newly generated standard key file is stored in the same storage path as the old standard key file, but with a temporary filename, such as adding the suffix .tmp to the original filename, to prevent other processes from reading incomplete file content during the writing process.
[0087] After the AP completes the writing of the new standard key file, it deletes the generated standard key file. The AP then performs a file deletion operation, removing the old standard key file from the file system. The AP renames the newly generated standard key file from its temporary filename to the old standard key file's filename. The AP sets the local key file parameter to the storage path of the updated standard key file via UCI, triggering the 8021xd daemon to execute the ppsk_reload function. This causes the 8021xd daemon to reread the updated standard key file and re-execute the PBKDF2 derivation and cache injection operations, completing the standard key file update.
[0088] This application updates the key group configuration data by regenerating the standard key file and replacing the old file. The update process only involves file system read / write operations and reloading the authentication process, without requiring a restart of the Wi-Fi interface or AP device. Connected terminals are unaffected during the update process, avoiding service interruptions caused by restarts. Furthermore, the use of atomic replacement after temporary file writing ensures that no other process reads the partially written file during the update process, guaranteeing data consistency.
[0089] In some embodiments, when the AP acts as the root node of the Mesh, it forwards the received binary IE protocol packets to all Mesh child node AP devices through the switch_tx_data interface.
[0090] In AC controller configuration mode, the AC controller sends configuration IEs to the root AP in the Mesh network via the switch_comm protocol of the mapd process. Upon receiving the three configuration IEs (mode configuration IE, local key IE, and RADIUS configuration IE), the root AP forwards them to all Mesh child AP devices via the switch_tx_data interface of the switch_comm protocol. Each Mesh child AP device, upon receiving its configuration IE, executes the corresponding steps in S201 to S207 to generate the standard key file and configure the authentication path, achieving network-wide synchronization of the key set.
[0091] Based on the above, the multi-mode configuration method for pre-shared WIFI key groups provided in this application converts key group configuration data from cloud configuration mode, AC controller configuration mode, and local command line configuration mode into a standard key file format, and selects the corresponding authentication path according to the preset PPSK mode value, thus enabling the three configuration modes to share the same key data format and application pipeline. When the key group configuration data is updated, the update can be completed simply by regenerating the standard key file and replacing the old file, without restarting the WIFI interface or authentication service. Compared with the prior art, this application does not require developing a separate key processing path for each access method, effectively reducing system complexity and maintenance costs, and improving the deployment flexibility and operational efficiency of WIFI key group management.
[0092] The above text combined Figures 1 to 2 The method for configuring a multi-mode WIFI pre-shared key group according to the embodiments of this application has been described in detail. The apparatus and device provided in the embodiments of this application will be described below with reference to the accompanying drawings.
[0093] This application also provides an apparatus for configuring a multi-mode WIFI pre-shared key group, such as... Figure 3 As shown in the figure, this is a schematic diagram of a device for configuring a multi-mode WIFI pre-shared key group according to an embodiment of this application. The device includes: The format conversion module 301 is used to receive key group configuration data; when the configuration mode of the key group configuration data is cloud configuration mode, it parses the JSON array sent from the cloud; extracts the terminal MAC address, plaintext key, and VLAN identifier of each key record from the JSON array; creates an independent key file for each different Service Set Identifier (SSID) in each Radio, and writes the extracted terminal MAC address, plaintext key, and VLAN identifier of each key record into the key files corresponding to the different Service Set Identifiers (SSIDs) in all Radios according to a unified format to generate a standard key file; when the configuration mode of the key group configuration data is AC controller configuration mode, it receives binary IE protocol packets sent by the AC controller; when the binary IE protocol packet contains a local key IE, it extracts the terminal MAC address, plaintext key, and VLAN identifier of each key record from the TLV structure of the local key IE, and writes the terminal MAC address, plaintext key, and VLAN identifier of each key record into the standard key file according to the unified format.
[0094] In some possible implementations, the device further includes: The authentication module is used to obtain the private pre-shared key (PPSK) mode value, which indicates the working status of the PPSK mode. The PPSK mode includes a closed mode, a local file mode, and a RADIUS mode. When the PPSK mode value is the value corresponding to the local file mode, each key record in the standard key file is read. Based on the PBKDF2 algorithm and the plaintext key in each key record, a pair of master keys is obtained. The pair of master keys is stored in a pair of master key identifier cache. During the terminal access authentication process, the pair of master keys corresponding to the terminal's MAC address are searched from the pair of master key identifier cache according to a preset priority to complete the authentication.
[0095] In some possible implementations, the authentication module 302 is further configured to: read each key record in the standard key file when the PPSK mode value is the value corresponding to the RADIUS mode; initiate an authentication request to the RADIUS server via the RADIUS protocol during terminal access authentication; and assign a corresponding VLAN to the terminal based on the authentication result returned by the RADIUS server and the VLAN identifier in each key record.
[0096] In some possible implementations, the authentication module 302 is further configured to: use the VAP global pre-shared key to directly authenticate with the terminal in the first priority authentication mode; if the first priority authentication mode fails to match, then execute the second priority authentication mode, which uses the pair master key in the pair master key identifier cache corresponding to the group zero MAC address to authenticate with the terminal; if the second priority authentication mode fails to match, then execute the third priority authentication mode, which uses the terminal's MAC address to find the corresponding pair master key identifier in the pair master key identifier cache, obtains the corresponding pair master key based on the pair master key identifier, and uses the obtained pair master key to authenticate with the terminal.
[0097] In some possible implementations, when the configuration mode of the key group configuration data is AC controller configuration mode, the format conversion module 301 is further configured to record the mode status according to the PPSK mode value in the mode configuration IE when the binary IE protocol packet contains a mode configuration IE, clear the local key file parameters and remote authentication dial-up user service protocol RADIUS authentication parameters through the unified configuration interface UCI, and rebuild the configuration environment according to the PPSK mode value. When the binary IE protocol packet contains a RADIUS configuration IE, RADIUS server information is extracted from the RADIUS configuration IE. The RADIUS server information includes IP address, port and shared key. RADIUS authentication parameters are set and RADIUS server parameters are configured through UCI.
[0098] In some possible implementations, the device further includes: The update module is used to regenerate the standard key file according to the updated key group configuration data when the key group configuration data is updated; delete the generated standard key file; and write the regenerated standard key file to the storage path of the generated standard key file to complete the update of the standard key file.
[0099] The apparatus for configuring a multi-mode WIFI pre-shared key group according to the embodiments of this application can correspond to executing the method described in the embodiments of this application, and the other operations and / or functions of each module / unit of the apparatus for configuring a multi-mode WIFI pre-shared key group are respectively for implementing Figure 2 For the sake of brevity, the corresponding processes of each method in the illustrated embodiments will not be described in detail here.
[0100] This application also provides a computing device. For example... Figure 4 As shown in the figure, this is a schematic diagram of a computing device provided in an embodiment of this application. The computing device 400 includes a bus 401, a processor 402, a communication interface 403, and a memory 404. The processor 402, the memory 404, and the communication interface 403 communicate with each other via the bus 401.
[0101] Bus 401 can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. Buses can be categorized as address buses, data buses, control buses, etc. For ease of representation, Figure 4 The bus is represented by a single thick line, but this does not mean that there is only one bus or one type of bus.
[0102] Processor 402 can be any one or more of the following processors: central processing unit (CPU), graphics processing unit (GPU), microprocessor (MP), or digital signal processor (DSP).
[0103] The communication interface 403 is used for communication with external devices. For example, if the computing device is a first switch, the communication interface 403 can be used for communication between the first switch and a first user terminal, or for communication between the first switch and a second switch.
[0104] Memory 404 may include volatile memory, such as random access memory (RAM). Memory 404 may also include non-volatile memory, such as read-only memory (ROM), flash memory, hard disk drive (HDD), or solid state drive (SSD).
[0105] The memory 404 stores executable code, which the processor 402 executes to perform the aforementioned method for configuring a multi-mode WIFI pre-shared key group.
[0106] Specifically, in achieving Figure 3 In the case of the illustrated embodiment, and Figure 3 When the modules or units of the multi-mode configuration WIFI pre-shared key group device described in the embodiments are implemented by software, the execution... Figure 3 The software or program code required for the functions of each module / unit can be partially or wholly stored in memory 404. Processor 402 executes the program code corresponding to each unit stored in memory 404, and executes the aforementioned method for configuring the WIFI pre-shared key group in multiple modes.
[0107] This application also provides a computer-readable storage medium. The computer-readable storage medium can be any available medium that a computing device can store, or a data storage device such as a data center containing one or more available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., solid-state drive). The computer-readable storage medium includes instructions that instruct a computing device to perform the above-described method for configuring a multi-mode WIFI pre-shared key group.
[0108] This application also provides a computer program product comprising one or more computer instructions. When the computer instructions are loaded and executed on a computing device, all or part of the processes or functions described in this application are generated.
[0109] The computer instructions may be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions may be transmitted from one website, computer, or data center to another website, computer, or data center via wired (e.g., coaxial cable, fiber optic) or wireless (e.g., infrared, wireless, microwave, etc.) means.
[0110] When the computer program product is executed by a computer, the computer performs any of the methods described above for configuring a multi-mode Wi-Fi pre-shared key group. The computer program product can be a software installation package; when any of the methods described above for configuring a multi-mode Wi-Fi pre-shared key group needs to be used, the computer program product can be downloaded and executed on the computer.
[0111] The descriptions of the processes or structures corresponding to the above figures each have their own emphasis. For parts of a process or structure that are not described in detail, please refer to the relevant descriptions of other processes or structures.
[0112] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any changes or substitutions within the technical scope disclosed in this application should be covered within the scope of protection of this application.< / index> < / index>
Claims
1. A method of multi-mode configuration of a WIFI pre-shared key group, characterized in that, The method includes: Receive key group configuration data; When the configuration mode of the key group configuration data is cloud configuration mode, parse the JSON array sent from the cloud; Extract the terminal MAC address, plaintext key, and VLAN identifier for each key record from the JSON array; Create a separate key file for each Service Set Identifier (SSID) in each Radio. Write the terminal MAC address, plaintext key, and VLAN identifier of each extracted key record into the key file corresponding to the different Service Set Identifiers (SSIDs) in all Radios in a unified format to generate a standard key file. When the configuration mode of the key group configuration data is AC controller configuration mode, receive the binary IE protocol packet sent by the AC controller; When the binary IE protocol packet contains a local key IE, the terminal MAC address, plaintext key, and VLAN identifier in each key record are extracted from the TLV structure of the local key IE, and the terminal MAC address, plaintext key, and VLAN identifier in each key record are written into the standard key file according to the unified format.
2. The method according to claim 1, characterized in that, The method further includes: Obtain the private pre-shared key PPSK mode value, which indicates the working status of the PPSK mode, including closed mode, local file mode, and RADIUS mode; When the PPSK mode value is the value corresponding to the local file mode, read each key record in the standard key file; Based on the PBKDF2 algorithm and the plaintext key in each key record, a pair of master keys is obtained; The paired master keys are stored in the paired master key identifier cache; During the terminal access authentication process, the paired master key corresponding to the terminal's MAC address is searched from the paired master key identifier cache according to a preset priority to complete the authentication.
3. The method according to claim 2, characterized in that, The method further includes: When the PPSK mode value is the value corresponding to the RADIUS mode, read each key record in the standard key file; During terminal access authentication, an authentication request is sent to the RADIUS server via the RADIUS protocol; Based on the authentication result returned by the RADIUS server and the VLAN identifier in each key record, the corresponding VLAN is assigned to the terminal.
4. The method according to claim 2, characterized in that, The step of searching for the paired master key corresponding to the terminal's MAC address from the paired master key identifier cache according to a preset priority to complete authentication includes: The highest priority authentication mode is to directly use the VAP global pre-shared key to complete authentication with the terminal; If the first priority authentication mode fails to match, the second priority authentication mode is executed. The second priority authentication mode uses the pair master key in the pair master key identifier cache corresponding to the group zero MAC address to complete the authentication with the terminal. If the second priority authentication mode fails to match, the third priority authentication mode is executed. The third priority authentication mode uses the terminal's MAC address to look up the corresponding pair master key identifier in the pair master key identifier cache, obtains the corresponding pair master key based on the pair master key identifier, and uses the obtained pair master key to complete authentication with the terminal.
5. The method according to claim 1, characterized in that, When the configuration mode of the key group configuration data is AC controller configuration mode, the method further includes: When the binary IE protocol packet contains a mode configuration IE, the mode state is recorded according to the PPSK mode value in the mode configuration IE, the local key file parameters and the remote authentication dial-up user service protocol RADIUS authentication parameters are cleared through the unified configuration interface UCI, and the configuration environment is rebuilt according to the PPSK mode value. When the binary IE protocol packet contains a RADIUS configuration IE, RADIUS server information is extracted from the RADIUS configuration IE. The RADIUS server information includes IP address, port and shared key. RADIUS authentication parameters are set and RADIUS server parameters are configured through UCI.
6. The method according to claim 1, characterized in that, The method further includes: When the key group configuration data is updated, the standard key file is regenerated based on the updated key group configuration data. Delete the generated standard key file, write the newly generated standard key file to the storage path of the generated standard key file, and complete the update of the standard key file.
7. A device for configuring a multi-mode WIFI pre-shared key group, characterized in that, The device includes: The format conversion module is used to receive key group configuration data; when the configuration mode of the key group configuration data is cloud configuration mode, it parses the JSON array sent from the cloud; extracts the terminal MAC address, plaintext key, and VLAN identifier of each key record from the JSON array; creates an independent key file for each different Service Set Identifier (SSID) in each Radio, and writes the extracted terminal MAC address, plaintext key, and VLAN identifier of each key record into the key files corresponding to the different SSIDs in all Radios according to a unified format to generate a standard key file; when the configuration mode of the key group configuration data is AC controller configuration mode, it receives binary IE protocol packets sent by the AC controller; when the binary IE protocol packet contains a local key IE, it extracts the terminal MAC address, plaintext key, and VLAN identifier of each key record from the TLV structure of the local key IE, and writes the terminal MAC address, plaintext key, and VLAN identifier of each key record into the standard key file according to the unified format.
8. The method according to claim 1, characterized in that, The device further includes: The authentication module is used to obtain the private pre-shared key (PPSK) mode value, which indicates the working status of the PPSK mode. The PPSK mode includes a closed mode, a local file mode, and a RADIUS mode. When the PPSK mode value is the value corresponding to the local file mode, each key record in the standard key file is read. Based on the PBKDF2 algorithm and the plaintext key in each key record, a pair of master keys is obtained. The pair of master keys is stored in a pair of master key identifier cache. During the terminal access authentication process, the pair of master keys corresponding to the terminal's MAC address are searched from the pair of master key identifier cache according to a preset priority to complete the authentication.
9. A computing device, characterized in that, Including memory and processor; The memory stores one or more computer programs, the one or more computer programs including instructions; when the instructions are executed by the processor, the computing device performs the method as described in any one of claims 1 to 7.
10. A computer-readable storage medium, characterized in that, The computer-readable storage medium is used to store a computer program for performing the method as described in any one of claims 1 to 7.