Network Access Certificate Checks for Phishing Wi-Fi Detection

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing network access control methods using WPA-Enterprise are vulnerable to phishing Wi-Fi attacks due to terminals mistakenly trusting server certificates, allowing security risks and potential data breaches.

Innovation Solution

Implement a network access control method that verifies the authenticity of server certificates using a root certificate with different identity verification information, and interrupts the network access of terminals that successfully verify the certificate, indicating a security risk.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If the terminal verifies the server certificate using the installed root certificate, then the terminal can establish trust in the server, but the terminal may mistakenly trust phishing server certificates with similar identity information

Engineering Contradiction:

Improvecertificate trust verificationVSAvoidphishing Wi-Fi attack vulnerability

Core Design Contradiction:

ReliabilityVSObject-affected harmful factors

Solution Approach 1:

Instead of verifying whether the server certificate matches the root certificate (normal verification), the patent inverts the approach by verifying whether the server certificate is different from the root certificate. The terminal is configured to obtain identity verification information of both the root certificate and the server certificate, and determine that verification passes only when these information differ. This inversion prevents terminals from trusting phishing certificates that might incorrectly match root certificate information.

Inventive Principle:

Principle #13The other way round (Inversion)

Solution Approach 2:

The patent applies preliminary anti-action by pre-configuring the terminal with the root certificate's identity verification information before the actual connection attempt. The terminal proactively compares the server's presented certificate against the pre-stored root certificate information and actively blocks the connection if they match (indicating a phishing attempt). This preliminary verification prevents the harmful effect of phishing attacks before they can compromise the network.

Inventive Principle:

Principle #9Preliminary anti-action

2Ease of operation

If the authentication server sends a normal server certificate to the terminal, then the terminal can successfully authenticate, but terminals with security risks may successfully access the network

Engineering Contradiction:

Improvenetwork access authenticationVSAvoidnetwork security

Core Design Contradiction:

Ease of operationVSReliability

Solution Approach 1:

The authentication server applies the inversion principle by sending a certificate that is deliberately different from the root certificate stored in terminals, rather than sending a certificate that matches the root certificate. This ensures that terminals with proper security configurations will reject the certificate, while also preventing phishing attacks. The server obtains the root certificate's identity verification information and uses it to generate or select a server certificate with different identity information, thus maintaining both ease of operation and reliability.

Inventive Principle:

Principle #13The other way round (Inversion)

3Device complexity

If the terminal uses the root certificate to verify the server certificate, then the verification process is simple, but the terminal cannot detect security risks

Engineering Contradiction:

Improvecertificate verification processVSAvoidsecurity risk detection

Core Design Contradiction:

Device complexityVSDifficulty of detecting and measuring

Solution Approach 1:

The patent maintains simplicity in the verification process while improving security by inverting the verification logic. Instead of checking if the server certificate matches the root certificate (simple but insecure), the terminal checks if the server certificate is different from the root certificate (still simple but secure). The terminal obtains identity verification information from both certificates and compares them, passing verification only when they differ. This inverted approach keeps the process straightforward while enabling effective security risk detection.

Inventive Principle:

Principle #13The other way round (Inversion)

Data Source

PatentUS20260019413A1Network access control method, apparatus and device, and storage medium

Publication Date: 2026.01.15 DOUYIN VISION CO LTD

AI summary

Embodiments of the present disclosure relate to a network access control method, apparatus and device, and a storage medium. The network access control method includes: receiving a certificate verification request sent by a terminal, and returning a certificate verification response to the terminal, wherein the certificate verification response carries a preset server certificate, the certificate verification response is used for instructing the terminal to verify the preset server certificate based on a root certificate installed in the terminal, and identity verification information of the root certificate is partially or fully different from identity verification information of the preset server certificate; and receiving a verification result returned by the terminal for the preset server certificate, and in a case where the verification result indicates that certificate verification succeeds, determining that the terminal has a security risk and interrupting a network access communication link of the terminal. In the embodiments of the present disclosure, when the terminal successfully verifies the preset server certificate, the terminal may be prevented from accessing a network by interrupting the network access communication link with the terminal, thereby improving the security of the network.