Method and apparatus for accessing a network

Abstract

The method and apparatus for accessing a network belong to the field of communication technology. The method includes a step S201 in which a terminal determines an auxiliary network associated with a target network based on a selected target network, a step S202 in which a terminal connects to the auxiliary network and obtains a digital certificate for accessing the target network from the auxiliary network, a step S203 in which the digital certificate is installed, and a step S204 in which the terminal accesses the target network using the digital certificate. The method obtains a digital certificate for accessing the target network based on the auxiliary network, and the network operation procedure is simplified and the usability is improved.

Description

[Technical field]

[0001] [CROSS REFERENCE TO RELATED APPLICATIONS] This application claims priority from a Chinese patent application filed with the China Patent Office on January 5, 2022, bearing application number 202210014566.4 and entitled "Method and Apparatus for Accessing a Network," the entire disclosure of which is incorporated herein by reference.

[0002] [Technical field] The present invention relates to the field of communication technologies, and in particular to a method and device for accessing a network. [Background technology]

[0003] Wireless LAN Authentication and Privacy Infrastructure (WAPI) is a secure access technology for wireless LAN. When a user controls a terminal to connect to a WAPI certificate type network, the user usually needs to install a user certificate and an issuer certificate on the terminal for identity authentication during the network connection process. Taking the WAPI certificate network of a wireless local area network (WLAN) as an example, the user first controls the terminal to connect to the certificate server, downloads and installs the user certificate and the issuer certificate. When the terminal needs to connect to a WAPI certificate network, the network settings and connection based on the installed digital certificate are cumbersome operation procedures. The Wi-Fi certificate network has the same problem. The cumbersome user operations hinder the popularization of more secure certificate networks.

[0004] How to simplify network access operations based on digital certificates has become a technical problem to be solved at present. Summary of the Invention [Problem to be solved by the invention]

[0005] SUMMARY OF THE PRESENTLY PREFERRED EMBODIMENTS The embodiments of the present invention provide a method and apparatus for accessing a network, for simplifying network access operations based on digital certificates. [Means for solving the problem]

[0006] In a first aspect, an embodiment of the present invention provides a method for accessing a network, the method including the steps of: a terminal determining, based on a selected target network, an auxiliary network associated with the target network; connecting to the auxiliary network and obtaining a digital certificate from the auxiliary network; installing the digital certificate; and accessing the target network using the digital certificate, wherein the digital certificate is used to access the target network.

[0007] Optionally, the step of the terminal determining an auxiliary network associated with the target network based on the selected target network includes the terminal obtaining a second service set identifier (SSID) associated with the first SSID according to a selected first SSID, the first SSID being an SSID of the target network, and the second SSID being an SSID of the auxiliary network.

[0008] Optionally, the step of the terminal obtaining a second SSID associated with the selected first SSID includes a step of deriving the second SSID associated with the first SSID according to the selected first SSID based on a pre-configured network name derivation rule, where the network name derivation rule is pre-agreed upon by the terminal and the access device.

[0009] Optionally, the step of the terminal acquiring a second SSID associated with the first SSID according to the selected first SSID includes the terminal acquiring the second SSID associated with the first SSID from an access device through active scanning or passive scanning.

[0010] Optionally, the step of obtaining a digital certificate from the auxiliary network includes the steps of obtaining a domain name of a certificate server connected to the auxiliary network, obtaining an address of the certificate server according to the domain name of the certificate server, and downloading the digital certificate from the certificate server according to the address of the certificate server.

[0011] Optionally, said auxiliary network is isolated from the Internet.

[0012] Optionally, the step of obtaining a digital certificate from the auxiliary network includes the steps of popping up a password dialog box if the type of the auxiliary network is a pre-shared key type, obtaining a password entered in the password dialog box, and obtaining the digital certificate from the auxiliary network if the password is successfully verified.

[0013] Optionally, after obtaining a digital certificate from the auxiliary network, the method further includes the steps of popping up a certificate naming dialog box; obtaining a certificate alias set for the digital certificate input into the certificate naming dialog box; naming the digital certificate according to the certificate alias, and storing the named digital certificate.

[0014] Optionally, after obtaining a digital certificate from the auxiliary network, the method further comprises: naming the digital certificate according to a default name.

[0015] Optionally, said digital certificate comprises at least one of a user certificate, an issuer certificate and a user private key.

[0016] In a second aspect, an embodiment of the present invention provides a terminal including a network access management module, a digital certificate management module, a digital certificate storage module and a network connection module; the network access management module is configured to determine an auxiliary network associated with the target network according to a selected target network, invoke the network connection module to connect to the auxiliary network, obtain a digital certificate from the auxiliary network, invoke the digital certificate management module to install the digital certificate, and invoke the network connection module to access the target network using the digital certificate; The digital certificate management module is configured to install the digital certificate according to a request of the network access management module, and the digital certificate is used to access the target network; the digital certificate storage module is configured to store the digital certificate; The network connection module is configured to connect to the auxiliary network according to a request invoked by the network access management module, and to access the target network using the digital certificate.

[0017] In a third aspect, there is provided a communications apparatus including a processor and a memory, The memory is configured to store computer instructions, and the processor is used to read the computer instructions and to perform the method described in any one of the first aspects.

[0018] A fourth aspect provides a computer-readable storage medium having computer-executable instructions stored thereon, the computer-executable instructions being used to cause a computer to perform a method according to any one of the first aspects.

[0019] A fifth aspect provides a computer program product, which when invoked by a computer is used to cause the computer to carry out a method according to any one of the first aspects. Effect of the Invention

[0020] In an embodiment of the present invention, the terminal determines an auxiliary network associated with the target network according to the selected target network, installs a digital certificate for accessing the target network according to the auxiliary network download, and uses the digital certificate to access the target network, and the user does not need to operate the terminal to download a certificate from a certificate server, and the terminal automatically obtains and installs a digital certificate from the auxiliary network associated with the target network, and accesses the target network according to the digital certificate, thereby simplifying the network access operation based on the digital certificate and improving ease of use. [Brief description of the drawings]

[0021] [Figure 1] 1 is a schematic diagram of an application scenario provided by an embodiment of the present invention; [Diagram 2] 4 is a flowchart of a method for accessing a network provided by an embodiment of the present invention. [Figure 3a] 1 is a schematic diagram of a network list user interface provided by an embodiment of the present invention. [Figure 3b]FIG. 2 is a schematic diagram of a password dialog box interface provided by an embodiment of the present invention. [Figure 3c] FIG. 11 is a schematic diagram of another password dialog box interface provided by an embodiment of the present invention. [Figure 4] FIG. 2 is a schematic diagram of a digital certificate naming interface provided by an embodiment of the present invention. [Diagram 5] FIG. 2 is a schematic structural diagram of a terminal provided by an embodiment of the present invention; [Figure 6] 1 is a schematic diagram of an application scenario provided by an embodiment of the present invention; [Figure 7] 1 is a schematic structural diagram of a communication device provided by an embodiment of the present invention; DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0022] In order to make the objectives, technical solutions and advantages of the present invention clearer, the present invention will be described in more detail below with reference to the accompanying drawings. The described embodiments are only a part of the embodiments of the present invention, but are not all of them. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative efforts fall within the scope of protection of the present invention.

[0023] In the following, the terms "first" and "second" are used only for the purpose of distinguishing the description and are not to be understood as implying or suggesting a relative importance or as implicitly designating the number of technical features shown. As a result, a feature defined as "first" or "second" may explicitly or implicitly include one or more such features, and in the description of the embodiments of the present invention, unless otherwise specified, "at least one" means one or more.

[0024] Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.

[0025] Fig. 1 is a schematic diagram of an application scenario provided by an embodiment of the present invention. As shown in the figure, the scenario includes a terminal 10, an access device 11, a certificate server 12, an auxiliary network 13, and a target network 14. The terminal 10 is connected to the access device 11 by wireless or wired, and the access device 11 is connected to the certificate server 12 through the auxiliary network 13. The number of terminals may be multiple, but Fig. 1 only shows one terminal as an example.

[0026] The terminal 10 may be a user device in various forms, such as a mobile station (MS), terminal equipment, etc. Examples of terminals include a mobile phone, a tablet, a laptop, a mobile internet device (MID), a wearable device, a self-driving wireless terminal, a wireless terminal in a smart grid, a wireless terminal in a smart home, etc.

[0027] The access device 11 is mainly used to provide network access, and specifically can be a device having a network access function, such as an access router, an enterprise router, a home router, a wireless access point, etc. The access device 11 is coupled to the auxiliary network 13, and the access device 11 enables the terminal 10 to exchange data with the auxiliary network 13.

[0028] The certificate server 12 may be an enterprise-level server, a public network server, etc., and is used to provide a digital certificate service for users to obtain digital certificates. For example, the certificate server 12 may be a digital certificate issuing authority server and provide a digital certificate application service to public users. As another example, the certificate server 12 may be an enterprise-level server and provide a digital certificate application service to users within an enterprise LAN. Thus, the applied-for digital certificate may be an enterprise internal digital certificate and correspond to the identity of an enterprise internal network user.

[0029] In some application scenarios, the auxiliary network 13 may be an internal network of an enterprise, and the target network 14 may be an external network such as the Internet. The certificate server 12 may be set in the internal network of the enterprise. The terminal may access the certificate server 12 via the auxiliary network 13 and obtain a digital certificate from the certificate server 12 for use in accessing the target network 14.

[0030] In the embodiment of the present invention, the access device is taken as an example, and the Service Set Identifier (SSID) of the target network and the SSID of the auxiliary network can be pre-configured in the access device 102. Here, the SSID is usually broadcast by a wireless access point, and the terminal can obtain the SSID of the current area through the built-in scanning function of the system. Optionally, the target network and the auxiliary network can be WAPI. For convenience of description, in the present invention, the SSID of the target network is called the first SSID, and the SSID of the auxiliary network is called the second SSID. The auxiliary network is connected to a certificate server. That is, the certificate server can be accessed through the auxiliary network. The second SSID is configured as a hidden SSID by the access device, and the second SSID is not displayed in the network list of the user interface of the terminal. That is, for the user, the auxiliary network is a hidden network and is not recognized by the user.

[0031] In some embodiments, such as in an enterprise network, only one certificate server can be configured to provide digital certificate download services to all terminals that need to use digital certificates for network access, in which case the networks corresponding to the second SSIDs configured on these access devices are connected to the certificate server to allow the terminals to access the certificate server.

[0032] Optionally, in the embodiment of the present invention, a network name derivation rule can be pre-configured on the terminal. Optionally, the network name derivation rule can be pre-agreed by the terminal and the access device. The network name derivation rule is used to derive a second SSID according to a first SSID. Specifically, the second SSID is obtained. Specifically, the terminal obtains the first SSID by scanning, and derives the second SSID according to the network name derivation rule and the first SSID.

[0033] For example, the network name derivation rule is "second SSID = first SSID + @wapi-psk". For example, if the first SSID name is "WAPIEnterprise", the second SSID name can be deduced to be "WAPIEnterprise + @wapi-psk" according to the above network name derivation rule. The network name derivation rule may be other network name derivation rules, but the present invention is not limited thereto.

[0034] Furthermore, an embodiment of the present invention also provides a method for a terminal to acquire a second SSID associated with the first SSID, the method including: the terminal acquires the second SSID associated with the first SSID from an access device through active scanning or passive scanning, where the process of the terminal acquiring the second SSID associated with the first SSID from an access device through active scanning includes:

[0035] The terminal transmits a probe request frame to scan surrounding wireless networks. When the surrounding access devices receive the probe request frame, they respond with a probe response frame. The probe response frame includes a first SSID and its associated second SSID provided by the access device. Here, the first SSID is stored in an SSID information element of the probe response frame, and the second SSID is stored in a specific information element of the probe response frame. Usually, only the SSID stored in the SSID information element of the probe response frame is displayed by the terminal in the network list of the terminal user interface, but since the second SSID in this embodiment is not stored in the SSID information element, the second SSID obtained by the terminal from the specific information element of the probe response frame is not displayed by the terminal in the network list of the user interface of the terminal in the specific information element of the frame.

[0036] The process in which the terminal acquires the second SSID associated with the first SSID from the access device through passive scanning includes:

[0037] The terminal obtains surrounding wireless network information by listening to a beacon frame periodically transmitted by an access device. The beacon frame includes a first SSID provided by the access device and a second SSID associated therewith. Here, the first SSID is stored in an SSID information element of the beacon frame, and the second SSID is stored in a specific information element of the beacon frame. Usually, only the SSID stored in the SSID information element of the beacon frame is displayed by the terminal in the network list of the terminal user. Since the second SSID in this embodiment is not stored in an SSID information element, the second SSID obtained by the terminal in the specific information element of the beacon frame is not displayed by the terminal in the network list of the user interface of the terminal.

[0038] 2 is a flowchart of a method for accessing a network provided by an embodiment of the present invention. The method can be performed by a terminal (such as the terminal 10 in FIG. 1). The flowchart enables the terminal to perform operations of accessing an auxiliary network for downloading a digital certificate, and connecting to a target network through the downloaded digital certificate based on the auxiliary network. As shown in the figure, the flowchart mainly includes the following steps:

[0039] S201: A terminal determines, based on a selected target network, an auxiliary network associated with the target network.

[0040] In this step, the terminal receives a signal transmitted by an access device including connectable network identification information (such as SSID), and the terminal displays the network identification information included in the received signal in a network list of a user interface, allowing the user to select one of the networks for network access. When the user selects a target network in the network list, the terminal obtains an auxiliary network associated with the target network and obtains a digital certificate for accessing the target network through the auxiliary network.

[0041] For example, the terminal acquires a first SSID included in a signal transmitted from an access device and displays the first SSID in a network list, and after a user selects the first SSID in the network list, if the terminal determines that the digital certificate used to access the target network is not installed in the terminal or that the installed digital certificate has already been revoked (e.g., expired), the terminal acquires a second SSID associated with the first SSID, and acquires a digital certificate used to access the target network by connecting the second SSID to an auxiliary network.

[0042] For example, Fig. 3a is a schematic diagram of a terminal user interface provided by an embodiment of the present invention. As shown in the figure, the user interface displays a network list including WAPI network names or SSIDs (as shown in the figure, WAPIEnterprise, WT_WAPIRT, global WAPI most secure mechanism WAPI, WAPIEnterprise-double-teset, gxdw) scanned by the terminal. When a user clicks on "WAPIEnterprise" (i.e., the first SSID in the embodiment of the present invention) in the list, it indicates that the user wants to access the corresponding WLAN or wireless access point and access the Internet through the WLAN or wireless access point.

[0043] Optionally, the terminal can derive a second SSID associated with the first SSID based on the first SSID selected by the user according to a preset network name derivation rule. The description of the network name derivation rule is in the previous section.

[0044] S202: A terminal connects to an auxiliary network associated with a target network and obtains a digital certificate from the auxiliary network, where the digital certificate is used to access the target network.

[0045] Optionally, if the type of the auxiliary network is a pre-shared key type, when the user clicks the first SSID, the terminal pops up a password dialog box to allow the user to enter a password to connect to the auxiliary network. If the terminal uses this password and successfully connects to the auxiliary network, the terminal can access the certificate server and download a digital certificate from the certificate server to be used to access the target network.

[0046] For example, Figures 3b and 3c are schematic diagrams of a password dialog box interface provided by an embodiment of the present invention, and as shown in Figures 3b and 3c, the popped-up password dialog box displays the first SSID or target network name selected by the user (such as WAPIEnterprise in the figure). The terminal responds to the password entered by the user in the password dialog box, and when the terminal successfully connects to the auxiliary network using the password, the terminal can access the certificate server.

[0047] Optionally, there are various ways to obtain the password. For example, in an enterprise application scenario, the password can be communicated to an employee of the enterprise through email or group messaging. As another example, at a friend's house, the password can be communicated verbally. As another example, in a public place, a text message can be received via the terminal, and the text message containing the password can be displayed in a user interface. This application is not limited to the present invention.

[0048] Optionally, if the type of the auxiliary network is an open type, the step of entering a password can be omitted. For example, in response to a user clicking an SSID or a network, the terminal obtains an SSID or a network name of the auxiliary network associated with an SSID or a network name of the target network. Based on the SSID or the network name of the auxiliary network, the terminal directly connects to a certificate server connected to the auxiliary network.

[0049] Optionally, the terminal can obtain a domain name of a certificate server connected to the auxiliary network via the auxiliary network, obtain a corresponding IP address based on the domain name of the certificate server, and download a digital certificate from the certificate server based on the IP address.

[0050] Optionally, the digital certificate obtained by the terminal includes at least one of a user certificate, an issuer certificate, and a user private key.

[0051] S203: After the terminal obtains the digital certificate, the terminal installs the digital certificate.

[0052] In this step, the terminal obtains a digital certificate used to access the target network and then installs the digital certificate locally on the terminal.

[0053] In some embodiments, the digital certificate name includes two parts, the first part being digital certificate type information and the second part being digital certificate alias. Optionally, the digital certificate type information is set by the system as a default and is not allowed to be changed. The digital certificate alias can be entered by the user or set by the system. If the digital certificate default alias is set to an empty string, indicating that the user needs to name the digital certificate, a digital certificate naming interface is displayed for the user to enter the digital certificate alias. If the digital certificate alias is set by the system as a default, it is also allowed to change the digital certificate alias that is set by default. The digital certificate alias can also be set by the system as a default and is not allowed to be changed by the user.

[0054] As an example, the naming convention for user certificates is "WAPI_USRCERT_" + alias for the digital certificate. As another example, the naming convention for issuer certificates is "WAPI_CACERT_" + alias for the digital certificate. As another example, the naming convention for user private keys is "WAPI_USRPKEY_" + alias for the digital certificate.

[0055] The user certificate is automatically named WAPI_USRCERT_NAME1 in the background. Figure 4 exemplarily illustrates a schematic diagram of a digital certificate naming interface provided by an embodiment of the present invention. As shown in the figure, after the terminal downloads the digital certificate from the certificate server, a certificate naming dialog box pops up. According to the digital certificate alias NAME1 input by the user, the user certificate is automatically named WAPI_USRCERT_NAME1 in the background, the issuer certificate is named WAPI_CACERT_NAME1, and the user's private key is named WAPI_USRPKEY_NAME1.

[0056] In some embodiments, if the set of aliases for this digital certificate is set to a non-empty string (users cannot enter or change the aliases for the digital certificate), the system names the digital certificate with "default alias set for this digital certificate" as "digital certificate alias", which means that the system can automatically complete the naming operation of the digital certificate of the set according to the naming rules, and the user interface will not display the "certificate naming dialog box pop-up", simplifying the operation procedure of the interface.

[0057] S204: The terminal uses the digital certificate to access the selected target network.

[0058] In this embodiment, the digital certificate downloaded and installed by the terminal based on the auxiliary network is the credential information for accessing the target network, so that the terminal can use the digital certificate to access the target network.

[0059] In the embodiment of the present invention, the terminal determines an auxiliary network associated with the target network based on the selected target network, installs a digital certificate for accessing the target network based on the auxiliary network, and thereby, to access the target network using the digital certificate, the terminal obtains and automatically installs a digital certificate from the auxiliary network associated with the target network instead of downloading a certificate from a certificate server, and accesses the target network based on the digital certificate, thereby simplifying the network access operation based on the digital certificate and improving usability. That is, for the user, the embodiment of the present invention allows the user to perform an operation that is consistent with the most familiar operation method of the current user to access a wireless local area network (e.g., a WiFi password-protected network or a password-less network) when using a certificate. Based on this, the user's Internet access process is made more secure (because a certificate network is more secure than a WiFi password-protected network or a password-less network).

[0060] Based on the same technical idea, the embodiment of the present invention also provides a terminal capable of implementing the above method flow in the embodiment of the present invention.

[0061] 5 is a schematic diagram of a terminal provided by an embodiment of the present invention. As shown in the figure, the terminal includes: a network access management module 501, a digital certificate management module 502, a digital certificate storage module 503, and a network connection module 504.

[0062] The network access management module 501 is used to manage the automatic operation of steps such as accessing an auxiliary network, downloading a digital certificate from a certificate server, installing a digital certificate, accessing a target network, etc. For example, the network access management module 501 is used to determine an auxiliary network associated with the target network according to a selected target network, call the network connection module 504 to connect to the auxiliary network, obtain a digital certificate from the auxiliary network, call the digital certificate management module 502 to install the digital certificate, and call the network connection module 504 to access the target network using the digital certificate.

[0063] The digital certificate management module 502 is mainly used to implement the related functions of digital certificate management. For example, the digital certificate management module 502 installs the digital certificate according to the request of the network access management module 501, and the digital certificate is used to access the target network.

[0064] The digital certificate storage module 503 is configured to store the digital certificate.

[0065] The network connection module 504 connects to the auxiliary network or accesses the target network using the digital certificate according to a request made by the network access management module 501 .

[0066] Based on the terminal shown in above Fig. 5, a schematic diagram of an application scenario is illustrated in Fig. 6. In this application scenario, a target network is a WAPI certificate network, and a digital certificate is required when accessing the WAPI certificate network.

[0067] The network access management module 501 lists connectable networks in a network list according to the SSID included in the signal transmitted from the wireless access point 601, and responds to a WAPIEnterprise selected by a user in the network list (taking WAPIEnterprise as the WAPI certificate network name as an example), obtains an auxiliary network name WAPIEnterprise+@wapi-psk associated with WAPIEnterprise (see the above embodiment for a specific acquisition method), and pops up a password dialog box for the user to input a password. The network access management module 501 sends parameters such as the auxiliary network name (WAPIEnterprise+@wapi-psk), network security type (WAPI pre-shared key type), and password to the network connection module 504, and calls the connection module 504 to connect to the auxiliary network.

[0068] When the network access management module 501 detects that the network connection module 504 is connected to an auxiliary network, it obtains the domain name of the certificate server connected to the auxiliary network, obtains the corresponding IP address through the domain name of the certificate server, connects to the certificate server according to the IP address and default port number, downloads a digital certificate from the certificate server 602, obtains user certificate data and user private key data from the downloaded user certificate, and obtains issuer certificate data from the downloaded issuer certificate.

[0069] The network access management module 501 calls the "Install WAPI Certificate" interface of the digital certificate management module 502, and provides the interface parameters of the interface (user certificate data, issuer certificate data, user private key data, and the default alias of this set). After receiving the "Install WAPI Certificate" request and reading the interface parameters, the digital certificate management module 502 verifies the match of the digital certificate data. If there is no match, the installation fails. If there is a match, a certificate naming dialog pops up, and a box is displayed for the user to input the alias of the digital certificate. After the user inputs the alias of the digital certificate, the digital certificate management module 502 uses the certificate alias to name the user certificate, issuer certificate, and user private key according to the naming rule preset, and calls the digital certificate storage module 503 to store the digital certificate. The digital certificate storage module 503 stores the set of digital certificate data according to the naming rule preset by the digital certificate management module 502.

[0070] If the network access management module 501 detects that the digital certificate has been successfully installed, it initiates the steps of configuring and connecting to the WAPI certificate network as follows.

[0071] The network access management module 501 sends network parameters, such as the target WAPI certificate network name (e.g., WAPI Enterprise), the network security type (e.g., WAPI certificate type), the digital certificate selection mode (e.g., automatic selection mode), and the selected certificate name (e.g., an empty string), to the network connection module 504, and calls the network connection module 504 to connect the network. The network connection module 504 calls the digital certificate storage module 503 to obtain all the digital certificates. The network connection module 504 associates with the wireless access point 601. After the association is successful, the network connection module 504 and the wireless access point 601 execute the protocol process of the WAPI certificate type, and upon receiving the first protocol packet (authentication activation packet) sent by the wireless access point 601, obtain the "local ASU ID" field in the packet (note: ASU stands for authentication service unit / authentication server). Then, scan the data of each set of digital certificates to obtain the "issuer ID" field of the certificate. Check for a set of digital certificates whose "issuer ID" field matches the "local ASU ID" field of the authentication activation packet, use the matching digital certificate to perform subsequent protocol interactions, and access the WAPI certificate network after the protocol process is completed. When the network access management module 501 detects that the network connection module 504 has accessed the WAPI network, the user interface displays that WAPI Enterprise is connected.

[0072] According to the same technical concept, the embodiment of the present invention also provides a communication device, which can implement the method flow provided in the above embodiment of the present invention. Figure 7 shows a schematic structural diagram of a communication device provided by an embodiment of the present invention. As shown in the figure, the communication device can include a processor 701, a memory 702, and a bus interface 703.

[0073] The processor 701 is responsible for managing the bus architecture and general processing, and the memory 702 may store data used by the processor 701 when performing operations.

[0074] The bus architecture may include any number of interconnected buses and bridges, specifically linked together by various circuits, one or more processors represented by the processor 701 and memory represented by memory 702. The bus architecture may also link various other circuits, such as peripherals, voltage regulators, power management circuits, etc., all of which are well known in the art and will not be described further herein. The bus interface provides an interface. The processor 701 is responsible for managing the bus architecture and general processing, and the memory 702 allows the processor 701 to store data used by the processor 701 when performing operations.

[0075] The flowcharts disclosed in the embodiments of the present invention can be applied to or implemented by the processor 701. During implementation, each step in the spread transmission flow in the frequency domain can be completed by a hardware logic integrated circuit or a software type instruction in the processor 701. The processor 701 can be a general-purpose processor, a digital signal processor, a dedicated integrated circuit, a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component, and can implement and execute each method, step, and logic block diagram disclosed in the embodiments of the present invention. The general-purpose processor can be a microprocessor or any normal processor, etc. With reference to the steps of the method disclosed in the embodiments of the present invention, they can be directly executed and completed by a hardware processor, or can be executed and completed by a combination of hardware and software modules in the processor. The software modules can be stored in a storage medium well known in the art, such as a random memory, a flash memory, a read-only memory, a programmable read-only memory or an electrically erasable programmable memory, a register, etc. The storage medium is located in the memory 702, and the processor 701 reads the information stored in the memory 702 and cooperates with the hardware to complete the steps of the information processing flow.

[0076] Specifically, the processor 701 is used to read computer instructions in the memory 702 and execute the method of accessing a network in the embodiment of the present invention.

[0077] It should be noted that the above-mentioned communication device provided by the embodiment of the present invention can implement all the method steps implemented by the above-mentioned method embodiment, and can achieve the same technical effects. Herein, the same parts and beneficial effects of the present embodiment as those of the method embodiment will not be further described.

[0078] An embodiment of the present invention also provides a computer-readable storage medium storing computer-executable instructions used to cause a computer to perform the method of accessing a network of the above embodiments.

[0079] An embodiment of the present invention also provides a computer program product which, when invoked by a computer, causes said computer to perform the method for accessing a network of the above embodiment.

[0080] Those skilled in the art will appreciate that embodiments of the present invention may be provided as a method, a system, or a computer program product. Thus, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention may take the form of a computer program product embodied on one or more computer usable storage media (including, but not limited to, disk storage devices, CD-ROMs, optical storage devices, etc.) having a computer usable program thereon.

[0081] The present invention has been described above by way of flowcharts and / or block diagrams of the method, apparatus (system) and computer program product of the embodiments of the present invention. It should be understood that each flow and / or block in the flow diagrams and / or block diagrams and the combination of flows and / or blocks in the flow diagrams and / or block diagrams can be realized by computer program instructions. A processor can provide these computer program instructions to a processor of a general purpose computer, a special purpose computer, an embedded processor, or other programmable data processing device, and the processor of the computer or other programmable data processing device executes these computer program instructions to realize the functions specified in one or more flows in the flow diagrams and / or one or more blocks in the block diagrams. These computer program instructions can also be stored in a computer readable storage device that causes a computer or other programmable data processing apparatus to operate in a specific fashion such that the apparatus containing the instructions can execute the instructions in the computer readable storage device to implement the function(s) specified in one or more of the flow diagrams and / or one or more blocks in the block diagrams.

[0082] These computer program instructions may also be implemented in a computer or other programmable data processing device such that the computer or other programmable device executes a series of operational steps to implement the relevant process, and the instructions executed on the computer or other programmable device implement the functions specified in one or more of the flows in the flow diagrams and / or one or more blocks in the block diagrams. Of course, those skilled in the art may modify the technical solutions described in the above embodiments or replace some technical elements therein. Such modifications and replacements are not considered to depart from the technical scope of the embodiments of the present invention. Such modifications and replacements all belong to the scope of the claims of the present invention.

Claims

1. 1. A method of accessing a network, comprising: The terminal determines, based on the selected target network, an auxiliary network associated with the target network; connecting to the auxiliary network and obtaining a digital certificate used to access the target network from the auxiliary network; installing the digital certificate; and using the digital certificate to access the target network.

2. The step of determining, by the terminal, an auxiliary network associated with the target network based on the selected target network, comprises: The terminal includes a step of obtaining a second SSID associated with the first SSID based on the selected first SSID; 2. The method of claim 1, wherein the first SSID is an SSID of the target network and the second SSID is an SSID of the auxiliary network.

3. The step of acquiring a second SSID associated with the first SSID by the terminal according to the selected first SSID, Deriving the second SSID associated with the first SSID according to the selected first SSID based on a preset network name derivation rule; The method of claim 2, wherein the network name resolution rule is agreed upon in advance by the terminal and the access device.

4. The step of acquiring a second SSID associated with the first SSID by the terminal according to the selected first SSID, 3. The method of claim 2, further comprising the step of: said terminal acquiring a second SSID associated with said first SSID from an access device through active or passive scanning.

5. The step of obtaining a digital certificate from the auxiliary network includes: obtaining a domain name of a certificate server connected to the auxiliary network; obtaining an address of the certificate server according to a domain name of the certificate server; 2. The method of claim 1, further comprising the step of: downloading said digital certificate from said certificate server according to said certificate server address.

6. Method for accessing a network according to any one of claims 1 to 5, characterized in that the auxiliary network is isolated from the Internet.

7. The step of obtaining a digital certificate from the auxiliary network includes: if the type of the auxiliary network is a pre-shared key type, popping up a password dialog box; obtaining the password entered into the password dialog box; A method for accessing a network according to any one of claims 1 to 5, further comprising the step of: if said password is successfully verified, obtaining said digital certificate from said auxiliary network.

8. after obtaining a digital certificate from the auxiliary network; popping up a certificate naming dialog box; obtaining a certificate alias set in the digital certificate entered in the certificate naming dialog box; naming the digital certificate according to an alias of the certificate; 6. The method of claim 1, further comprising the step of: storing said named digital certificate.

9. The method for accessing a network according to any one of claims 1 to 5, further comprising the step of naming the digital certificate according to a default name after obtaining the digital certificate from the auxiliary network.

10. The method of accessing a network according to any one of claims 1 to 5, characterized in that the digital certificate comprises at least one of a user certificate, an issuer certificate and a user private key.

11. A terminal, The present invention includes a network access management module, a digital certificate management module, a digital certificate storage module, and a network connection module, the network access management module is configured to determine, according to a selected target network, an auxiliary network associated with the target network, invoke the network connection module to connect to the auxiliary network, obtain a digital certificate from the auxiliary network, invoke the digital certificate management module to install the digital certificate, and invoke the network connection module to access the target network using the digital certificate; The digital certificate management module is configured to install the digital certificate according to a request called by the network access management module, and the digital certificate is used to access the target network; the digital certificate storage module is configured to store the digital certificate; The terminal, characterized in that the network connection module is configured to connect to the auxiliary network according to a request invoked by the network access management module, and to access the target network using the digital certificate.

12. A communication device, comprising: A processor and a memory are included. the memory is configured to store computer instructions; A communication device, characterized in that the processor is configured to read the computer instructions and to carry out the method according to any one of claims 1 to 10.

13. 1. A computer-readable storage medium, comprising: The computer-readable storage medium has stored thereon computer-executable instructions, the computer-executable instructions being used to cause a computer to carry out the method of any one of claims 1 to 10.

14. 1. A computer program product comprising: A computer program product, which when invoked by a computer, causes the computer to carry out the method according to any one of claims 1 to 10.

Images