CN101453409B - Information Broadcasting Method, Device and System Supporting Hybrid Access of Terminals - Google Patents

Abstract

The invention discloses an information broadcasting method, an information device and an information broadcasting system supporting the hybrid access of terminals. The method comprises: configuring different secure access mechanisms corresponding to different secure capacities of the terminals and secure mechanism identifiers corresponding to the secure access mechanisms in a network access point entity; when the network access point entity transmits a broadcasting messages to the terminals, transmitting different broadcasting messages according to different secure access mechanisms, wherein the different broadcast messages carry the secure mechanism identifiers corresponding to the different secure access mechanisms. The method, the device and the system support the hybrid access of terminals with different secure capacities through one network access point, thereby reducing network investment and operation and maintenance costs.

Description

Information Broadcasting Method, Device and System Supporting Hybrid Access of Terminals

technical field

The present invention relates to the field of wireless communication, in particular to an information broadcasting method, a device and a system supporting hybrid access of terminals. the

Background technique

In a WLAN (Wireless Local Area Network, wireless local area network) network, terminals with different security capabilities need to access the WLAN network. Terminals with different security capabilities adopt different security mechanisms when accessing the network. For example, for a terminal that can support a security authentication mechanism, a corresponding security mechanism needs to be used to access the terminal, and for a terminal that cannot support a security authentication mechanism, an open mechanism needs to be used to access the terminal. Usually, the access control for the terminal is implemented by the access point (Access Point, AP) entity, and the identity of the AP is identified by the SSID (Service Set Identifier, service set identifier). service number. the

At present, in order to solve the problem that terminals with different security capabilities can mix access to the WLAN network, the technical solution adopted is: set up multiple APs, different APs enable different security access mechanisms, and each AP targets terminals that support a certain security access mechanism. Perform access control and processing. When the network side paging terminals supporting different security capabilities, the AP corresponding to the terminal's security capabilities sends a broadcast message, which carries the SSID corresponding to the AP. When the terminal receives the broadcast message, it uses the security capabilities supported by the terminal to initiate an access request to the corresponding AP according to the SSID in the broadcast message. After receiving the request from the terminal, the corresponding AP uses the security access mechanism supported by the AP. Process the access request of the terminal. the

In the existing technology, different SSIDs are used to provide multiple secure access mechanisms, and different APs are used to realize mixed access of terminals supporting different security capabilities. The disadvantage is that if there are both secure users and For open users, at least two APs need to be set up by adopting the existing technical solutions, one for security users to enable security authentication mechanism, and the other for open users to enable open mechanism, so as to realize the simultaneous access of terminals with different security capabilities to the network. It can be seen that adopting this technical solution requires setting up multiple APs, which increases network investment and operation and maintenance costs.

Contents of the invention

The embodiment of the present invention discloses an information broadcasting method supporting mixed access of terminals and its device and system, so as to realize mixed access to terminals with different security capabilities through one network access point entity. the

The information broadcasting method supporting terminal mixed access disclosed in the embodiment of the present invention includes the following steps:

Configure different virtual network access point entities corresponding to different security capabilities of the terminal on the network access point entity, and configure the corresponding security access mechanism and address identifier for the virtual network access point entity, and the address identifier is The security mechanism identification corresponding to the security access mechanism;

When the network access point entity sends a broadcast message to the terminal, it sends different broadcast messages according to different security access mechanisms, and the different broadcast messages carry security mechanisms corresponding to the different security access mechanisms logo. the

The network access point device disclosed in the embodiment of the present invention includes:

A configuration module, configured to configure different virtual network access point entities corresponding to different security capabilities of terminals on the network access point device, and configure corresponding security access mechanisms and address identifiers for the virtual network access point entities, The address identification is the security mechanism identification corresponding to the security access mechanism; it is also used to generate different broadcast messages according to the different security mechanisms, which carry the security mechanism identification corresponding to the different security mechanisms;

The communication interface module is used for sending the generated multiple broadcast messages respectively. the

The terminal disclosed in the embodiment of the present invention includes:

The broadcast message receiving module is used to receive and parse the broadcast message sent by the network access point device, and the broadcast message carries a security mechanism identifier corresponding to the security capability of the terminal;

An access request initiating module, configured to initiate an access request, where the access request carries a security mechanism identifier corresponding to the security capability of the terminal. the

The information broadcasting system supporting hybrid access of terminals disclosed in the embodiment of the present invention includes a network access point device and a terminal, wherein

The network access point device is configured to configure different virtual network access point entities corresponding to different security capabilities of terminals, and configure corresponding security access mechanisms and address identifiers for the virtual network access point entities, the The address identifier is the security mechanism identifier corresponding to the security access mechanism, and different broadcast messages are sent according to different security access mechanisms respectively, and the different broadcast messages carry information corresponding to the different security access mechanisms Safety mechanism identification;

The terminal is configured to receive and parse the broadcast message and initiate an access request according to the correctly parsed broadcast message, where the access request carries a security mechanism identifier corresponding to the security capability of the terminal. the

In the above-mentioned embodiments of the present invention, by configuring various security mechanisms and corresponding security mechanism identifiers on the network access point entity for terminals with various security capabilities, when the network access point entity sends a broadcast message, the configured Different security access mechanisms send corresponding broadcast messages, which carry the corresponding security mechanism identifiers, so that terminals with different security capabilities can be broadcast through one network access point entity, and terminals with different security capabilities can be connected through one network access point. The entry point entity accesses the network, reducing network investment and operation and maintenance costs. the

Description of drawings

FIG. 1 is a schematic diagram of an information broadcast process for mixed access of terminals supporting different security capabilities in an embodiment of the present invention;

Fig. 2 is a schematic diagram of the physical layer implementation of the network access point entity in the embodiment of the present invention;

FIG. 3 is a schematic flow diagram of mixed access of terminals with different security capabilities in an embodiment of the present invention;

4 is a schematic diagram of a terminal initiating an access request according to a preset security policy in an embodiment of the present invention;

Fig. 5 is a schematic diagram of classifying users on a network access point entity in an embodiment of the present invention;

6 is a schematic structural diagram of a network access point device according to an embodiment of the present invention;

Fig. 7 is one of the structural schematic diagrams of the terminal of the embodiment of the present invention;

FIG. 8 is a second structural schematic diagram of a terminal according to an embodiment of the present invention. the

Detailed ways

In the embodiments of the present invention, security access mechanisms corresponding to terminals with different security capabilities and security mechanism identifiers corresponding to security access mechanisms are configured on the network access point entity, and when the network access point entity sends a broadcast message to the terminal At the same time, broadcast messages carrying different security mechanism identifiers are sent according to different security access mechanisms, so that terminals with different security capabilities can initiate access requests corresponding to the security capabilities of the terminals according to the received and correctly parsed broadcast messages, realizing Mixed access to terminals with different security capabilities is performed through one network access point entity. the

Embodiments of the present invention will be described in detail below in conjunction with the accompanying drawings. the

In the embodiment of the present invention, in a certain area, a physical network access point entity (AP) is set up for the WLAN network, and the physical AP is uniquely identified by a physical address, that is, a MAC (Media Access Control, Media Access Control) address . On the physical AP, at least two security access mechanisms are configured for the security capabilities of the terminal, and security mechanism identifiers corresponding to the configured security access mechanisms are configured. The security mechanism identifier is obtained by mapping the unique identifier of the physical AP. In a specific implementation, a reversible masking technique can be used to derive multiple different BSSIDs (Basic Service Set Identifier, Basic Service Set Identifier) from the MAC address of the physical AP as Safety mechanism identification. The multiple derived BSSIDs can uniquely obtain the MAC address of the physical AP through corresponding reversible operations, so the derived BSSIDs can uniquely identify the physical AP. the

Create a virtual AP corresponding to each BSSID on the physical AP, use the BSSID as the address of the corresponding virtual AP, and assign different security policies to each virtual AP, including broadcast message sending policies and access request processing policies, so that each virtual AP Access processing can be performed for terminals with different security capabilities. the

When the network side needs to send broadcast messages to terminals with different security capabilities, physical APs send broadcast messages through corresponding virtual APs, and the broadcast messages sent by each virtual AP carry the BSSID corresponding to the virtual AP. the

The above implementation process may be shown in FIG. 1 . In Figure 1, a reversible masking technique is used on a physical AP, and three addresses (MAC 1, MAC 2, and MAC 3) are derived from the MAC address of the physical AP as security mechanism identifiers. Configure 3 virtual APs (VAP1, VAP2, and VAP3) on the physical AP, where VAP1 is configured with security policy 1 for implementing security mechanism 1 (such as WAPI+SMS4, that is, using WAPI (WLAN Authentication and Privacy Infrastructure, WLAN identification and security infrastructure) certificate authentication and SMS4 encryption mechanism), MAC 1 is used as the MAC address of VAP1; VAP2 is configured with security policy 2, which is used to implement security mechanism 2 (such as OPEN, that is, an open mechanism), MAC 2 is used as the MAC address of VAP1; security policy 3 is configured on VAP3 to implement security mechanism 3 (such as WPA2+AES, that is, WPA2 authentication and AES encryption mechanism), and MAC 3 is used as the MAC address of VAP1. When the AP sends broadcast messages to terminals with different security capabilities, VAP1, VAP2, and VAP3 send broadcast messages respectively. Among them, the broadcast message sent by VAP1 carries MAC 1 and other information (such as SSID); the broadcast message sent by VAP2 carries MAC 2 and other information (such as SSID); the broadcast message sent by VAP3 carries MAC 3 and other information (such as SSID). For the time division multiplexing system, the AP uses the time division multiplexing mechanism to send broadcast messages, that is, different virtual APs send broadcast messages in different time slots, as shown in Figure 1, the physical AP divides 100ms into 16 time slots, according to the mask Allocate time slot 1 for VAP1, time slot 2 for VAP2, and time slot 3 for VAP3; for frequency division multiplexing system, AP uses frequency division multiplexing mechanism to send broadcast messages, that is, different virtual APs simultaneously on different frequencies Send a broadcast message. the

The physical AP sends the broadcast information by sending Beacon frames. Usually, the Beacon frame has a BSSID field. In the above process, MAC 1, MAC 2, and MAC 3 derived from the MAC address are used as the BSSID field value of the Beacon frame. To identify the physical AP and the corresponding security access mechanism. the

The implementation process shown in FIG. 1 can be realized by improving the physical layer of the physical AP, and the implementation method can be shown in FIG. 2 . Normally, the NIC driver of a physical AP is divided into two layers: the hardware description layer (ie, the HAL layer) and the 802.11 management layer. Among them, the HAL layer is an abstraction of the network card hardware, which mainly defines parameters related to the hardware, and the 802.11 management layer is mainly used to process the 802.11 protocol. the

In the embodiment of the present invention, 3 addresses are derived as BSSID by the MAC address of the physical AP, as shown in Figure 2, define 3 virtual AP objects (VAP1, VAP2 and VAP3) on the 802.11 management layer, each virtual AP object It has its own MAC address (identified by BSSID), security policy (including security rules and Beacon frame broadcast rules), and can also include a terminal table, which is used to save terminal user information connected to the AP. Each virtual AP The object is an independent network device for the network layer, and has an independent data sending and receiving channel. It can be seen that since the MAC address of the virtual AP object is derived from the MAC address of the AP, only one MAC address needs to be stored on the network card of the physical AP, which reduces the storage space and facilitates modification of the address of the physical network card. the

For the architecture shown in Figure 2, the process of implementing mixed access of terminals with different security capabilities can be shown in Figure 3, where Terminal 1 supports the WAPI+SMS4 security mechanism, Terminal 2 supports the OPEN security mechanism, and Terminal 3 supports WPA2+ AES security mechanism, when the network side needs to send broadcast messages to terminals with different security capabilities, VAP1, VAP2, and VAP3 respectively use different time slots (in time division multiplexing systems) or different frequencies according to their respective Beacon frame broadcast rules (In a frequency division multiplexing system) each Beacon frame is sent through the MAC+RF layer. The Beacon frame sent by VAP1 carries information such as BSSID1, the Beacon frame sent by VAP2 carries information such as BSSID2, and the Beacon frame sent by VAP3 carries information such as BSSID1. BSSID3 and other information. the

Terminal 1, terminal 2, and terminal 3 can receive and analyze the Beacon frame according to the conventional process, and initiate an access request according to the correctly parsed Beacon frame. Normally, Terminal 1, Terminal 2, and Terminal 3 can receive all Beacon frames. If the Beacon frame can be parsed correctly, an access request will be initiated according to the security capability of the terminal, which carries the BSSID obtained from the Beacon frame. the

The physical AP calculates the MAC address from the BSSID carried in the access request according to the inverse operation of the algorithm used to generate the BSSID. If the calculated MAC address matches its own MAC address, it accepts the access request. Since BSSID1, BSSID2, and BSSID3 are all derived from the MAC address of a physical AP, the physical AP can receive access requests carrying these BSSIDs. After receiving the access request, the physical AP sends the access request to the corresponding virtual AP for processing according to the BSSID therein. In Fig. 3, the access requests of terminal 1, terminal 2 and terminal 3 are respectively sent to VAP1, VAP2 and VAP3 for processing. After each terminal completes security authentication with the corresponding VAP and negotiates an encryption key, the AP writes the key and the security policy of the terminal into the storage unit of the AP MAC, and corresponds to the terminal's MAC. When the terminal's encrypted data passes through the AP, the AP searches the AP MAC storage unit for keys and security policies through the terminal's MAC address in the data header, and calls different algorithms through different security policies (such as calling the algorithm in the storage unit) The algorithm SMS4 or AES) decrypts the data and sends the data to the corresponding VAP in the 802.11 management layer for processing. The encryption process when the AP sends data is the same as the decryption process of the received data. If the corresponding key found by the AP is empty when receiving the data, the data will not be decrypted, but will be directly handed over to the VAP whose security mechanism is OPEN in the 802.11 management layer (such as VAP2 in Figure 3) for processing. the

After the AP sends the broadcast message, the terminal can receive and analyze the broadcast message in the existing way, and initiate an access request. When the security capability of the terminal can support multiple access mechanisms, the terminal can correctly parse out multiple broadcast messages carrying different security mechanism identifiers. In view of this situation, the embodiment of the present invention improves the terminal to increase its access flexibility. the

In the embodiment of the present invention, in view of the above situation, the terminal can initiate an access request in the following ways:

Method 1: Preset a security policy on the terminal. The selection policy defines which security access mechanism to choose to initiate an access request when the terminal receives multiple different broadcast messages (Beacon frames carrying different BSSIDs). In the embodiment of the present invention, the security policy can be set in the form of setting a profile on the terminal side. When the terminal receives multiple different broadcast messages, it selects a security access mechanism to initiate an access request according to a preset security policy. Fig. 4 shows an implementation manner of initiating an access request according to a security policy. the

In Figure 4, after receiving Beacon frames (Beacon1, Beacon2, and Beacon3) carrying different BSSIDs, the terminal compares it with the local preset security policy, and selects the corresponding security access mechanism to initiate an access request according to the comparison result. For example, when the preset security policy on the terminal is to initiate an access request based on the received and correctly parsed first Beacon frame, after receiving and correctly parsing the first Beacon frame, the terminal queries the local security policy to associate with the The security access mechanism corresponding to the BSSID in the Beacon frame, and use this mechanism to initiate an access request; when the security policy preset on the terminal is selected according to the priority of the security access mechanism, the terminal will receive and correctly parse the The security access mechanism corresponding to the BSSID in the output Beacon frame queries the local preset security policy to obtain the priority of each security access mechanism, and selects the security access mechanism with the highest priority to initiate an access request. the

Method 2: On the basis of method 1, the terminal displays all the security access mechanism information corresponding to the received broadcast message to the user, and the user selects an appropriate security access mechanism, and the terminal adopts the security access mechanism selected by the user Initiate an access request. the

In the embodiment of the present invention, it is also possible to classify users on the AP based on the above-mentioned framework for realizing mixed access of terminals with different security capabilities, so that different types of users can enter different VLANs (virtual local area networks), and realize flexible access to terminal users. management and control. Fig. 5 shows an implementation manner of classifying users on the AP. the

In Figure 5, 3 VAPs (VAP1, VAP2, and VAP3) are set on the AP, and 3 virtual local area networks (VLAN1, VLAN2, and VLAN3) are respectively identified by 3 BSSIDs (BSSID1, BSSID2, and BSSID3), so that the three BSSIDs are divided into 3 different VLANs. Label the data processed by VAP1 with BSSID1; label the data processed by VAP2 with BSSID2; Belong to VLAN2, so that the terminals connected to VAP3 belong to VLAN3. In the above implementation manner, the VLANs divided by the BSSID mark mark the data passing through each VAP with the corresponding BSSID label, so that the terminals connected to different VAPs belong to different VLANs. In addition, the VLANs identified by the SSIDs can also be marked with corresponding SSID labels on the data passing through each VAP, so that the terminals connected to different VAPs belong to different VLANs. the

Embodiments of the present invention also provide a network access point device supporting mixed access of terminals with different security capabilities, a terminal, and a communication system supporting mixed access of terminals with different security capabilities. the

Referring to FIG. 6, it is a network access point device that supports hybrid access of terminals provided by an embodiment of the present invention. The network access point device includes a configuration module and a communication interface module, wherein,

The configuration module is used to configure different security access mechanisms corresponding to different security capabilities of the terminal and security mechanism identifiers corresponding to the security access mechanisms on the network access point device, and is also used to generate different security mechanisms according to these different security mechanisms. The broadcast message carries the security mechanism identifier corresponding to the corresponding security mechanism. The configuration module can be located at the wireless network card driver layer of the network access point device;

The communication interface module is used to respectively send the broadcast messages generated by the configuration module, and is also used to receive the access request initiated by the terminal. The communication interface module can be located at the MAC and radio frequency (MAC+RF) layer of the network access point device. the

The configuration module of the above-mentioned network access point device includes a configuration sub-module and at least two virtual network access point devices, wherein:

The configuration sub-module is used to configure different virtual network access point devices corresponding to different security capabilities of terminals on the network access point device, and configure corresponding security access mechanisms and address identifiers for each virtual network access point device, namely , each virtual access point device has its own address identifier and security policy, wherein the security policy includes security rules and Beacon frame broadcast rules, and the address identifier is a security mechanism identifier corresponding to the security access mechanism. The security mechanism identifier can be obtained by mapping the unique identifier (such as MAC address) of the network access point device. Specifically, a reversible algorithm is used to derive the BSSID from the MAC address of the network access point device as the security mechanism identifier. The virtual access point device is used to generate a broadcast message corresponding to the security access mechanism of the virtual access point device, which carries the security access identifier of the virtual access point device, and is also used to use the virtual access point device to correspond to The secure access mechanism processes the access request of the terminal. the

The above-mentioned virtual access point device includes a broadcast message processing unit and an access request processing unit, wherein:

The broadcast message processing unit is used to generate a broadcast message corresponding to the security access mechanism of the virtual access point device, which carries the security mechanism identifier of the virtual access point device, and sends the broadcast message through the communication interface module; the access request The processing unit is used to receive the access request sent by the terminal, the security mechanism identifier carried in the access request is consistent with the security mechanism identifier of the virtual access point device sending the broadcast message, and adopt the security mechanism corresponding to the virtual access point device access mechanism. the

The above-mentioned communication interface module is a time division multiplexing module or a frequency division multiplexing module. The time division multiplexing module is used to send broadcast messages corresponding to the security capabilities of the terminals through different time slots; the frequency division multiplexing module is used to send broadcast messages corresponding to the security capabilities of the terminals through different frequencies. the

When receiving the access request, the communication interface module receives the access request and sends it to the The security mechanism identifies the corresponding virtual access point device for processing. the

Referring to FIG. 7 and FIG. 8, they are schematic diagrams of the terminal structure provided by the embodiment of the present invention, the terminal includes a broadcast message receiving module and an access request initiating module, wherein:

The broadcast message receiving module is used to receive and parse the broadcast message sent by the network access point device, which carries the security mechanism identification corresponding to the security capability of the terminal;

The access request initiating module is used to initiate an access request, which carries a security mechanism identifier corresponding to the security capability of the terminal. The security mechanism identifier is obtained by mapping the unique identifier of the network access point device, specifically: using a reversible algorithm to derive the security mechanism identifier from the physical address (MAC address) of the network access point device. the

When the terminal's security capability supports multiple security access mechanisms, that is, it can correctly parse broadcast messages carrying different security mechanism identifiers, then after receiving and correctly parsing multiple broadcast messages, the terminal can carry Select from the security access mechanism corresponding to the security mechanism identifier, and use the selected security access mechanism to initiate an access request; or, display the corresponding security access mechanism information for the user to choose, and initiate an access request according to the user's choice Access request. the

When a terminal selects from security access mechanisms corresponding to multiple security mechanism identifiers, the terminal may also include a configuration module and a selection module, as shown in Figure 7, where:

The configuration module is used to configure the security mechanism selection strategy; the selection module is used to select the security access mechanism corresponding to the security mechanism identifiers carried in the received and correctly parsed multiple broadcast messages according to the security mechanism selection strategy, and adopt the selection The security access mechanism issued by the system initiates an access request through the access request initiating module. the

When the terminal initiates an access request according to the user's selection, the terminal may also include a display module and a selection module, as shown in Figure 8, wherein:

The display module is used to display the security access mechanism information corresponding to the security mechanism identifiers carried in the received and correctly parsed multiple broadcast messages for the user to select; the selection module is used to receive the security access mechanism selected by the user, and adopt the The security access mechanism initiates an access request through the access request initiating module. the

The communication system supporting mixed access of terminals provided by the embodiment of the present invention includes a network access point device and a terminal. The structure of the network access point device may be shown in FIG. 6, and the structure of the terminal may be shown in FIG. 7 or 8. ,in:

The network access point device is used to configure different security access mechanisms corresponding to different security capabilities of the terminal and security mechanism identifiers corresponding to the security access mechanisms, and to send different broadcast messages according to different security access mechanisms. The broadcast messages respectively carry security mechanism identifiers corresponding to the above-mentioned configured security access mechanisms, and the above-mentioned security mechanism identifiers are obtained by mapping the unique identifier of the network access point device. The network access point device is further configured to receive the access request when an identifier matching its own unique identifier is obtained according to the security mechanism identifier mapping carried in the access request, and use the security mechanism identifier corresponding to the The security access mechanism processes the access request. the

The terminal is configured to receive and parse the broadcast message, and initiate an access request according to the correctly parsed broadcast message, which carries a security mechanism identifier corresponding to the security capability of the terminal. When the terminal receives and correctly parses multiple broadcast messages carrying different security mechanism identifiers, it selects from the security access mechanisms corresponding to the security mechanism identifiers carried in these broadcast messages, and uses the selected security access mechanism to initiate An access request; or, display the security access mechanism information corresponding to the security mechanism identifiers carried in these broadcast messages for the user to select, and initiate an access request according to the user's selection. the

In summary, the above embodiments of the present invention configure multiple virtual APs on physical APs for terminals with different security capabilities, configure different security mechanisms and MAC addresses on different virtual APs, and broadcast beacons by different virtual APs. frame, which carries the MAC address of the virtual AP (identified by BSSID), so that when terminals with different security capabilities receive and parse out the corresponding Beacon frame, they can initiate an access request according to the Beacon frame, which carries the MAC address of the corresponding virtual AP , so that the corresponding virtual AP can obtain the access request and use the corresponding security mechanism to process it, thereby realizing mixed access to terminals with multiple security capabilities by using one physical AP, reducing network investment and operation and maintenance costs. the

Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalent technologies, the present invention also intends to include these modifications and variations. the

Claims (20)

1. a support terminal mixes the information broadcast method that inserts, and it is characterized in that, comprising:

The different security capabilities of counterpart terminal dispose different virtual network access point entities respectively on the Network Access Point entity, and be the safe access mechanism and the address designation of described virtual network access point physical arrangements correspondence, described address designation is the security mechanism sign corresponding with described safe access mechanism;

When described Network Access Point entity when terminal sends broadcast, send different broadcasts according to different safe access mechanisms respectively, carry and the described different corresponding security mechanism sign of safe access mechanism in the described different broadcast.

2. the method for claim 1 is characterized in that, described security mechanism sign is obtained by the unique identification mapping of described Network Access Point entity;

When sign that the security mechanism sign mapping of carrying in the access request that described Network Access Point entity is initiated according to terminal obtains being complementary with self described unique identification, receive described access request.

3. method as claimed in claim 2, it is characterized in that, described security mechanism sign is obtained by the unique identification mapping of described Network Access Point entity, is specially: adopt reversible algorithm to be derived by the physical address of described Network Access Point entity and obtain described security mechanism sign.

4. the method for claim 1 is characterized in that, when described Network Access Point entity sent broadcast, different virtual access point entities sent different broadcasts, wherein carries the security mechanism sign corresponding with respective virtual access point entity.

5. method as claimed in claim 4 is characterized in that, different virtual access point entities sends different broadcasts, is specially: different virtual access point entities sends different broadcasts by different time slots or frequency respectively.

6. the method for claim 1 is characterized in that, described Network Access Point entity sends and also comprises step after the described broadcast:

Terminal receives described broadcast and resolves, and initiates to insert request according to the broadcast that correctly parses, mechanism sign wherein safe to carry;

The access request that described Network Access Point entity receiving terminal is initiated, and adopt corresponding security mechanisms to handle according to the security mechanism sign of wherein carrying.

7. method as claimed in claim 6 is characterized in that, when terminal receives and correctly parses a plurality of broadcast, also comprises step:

The security mechanism of carrying respectively from described a plurality of broadcasts identifies the pairing safe access mechanism to be selected, and adopts the safe access mechanism of selecting to initiate to insert request; Perhaps, show that the security mechanism that a plurality of broadcasts are carried respectively identifies pairing safe access mechanism information for user's selection, and initiate to insert request according to user's selection.

8. the method for claim 1 is characterized in that, also comprises:

The safe access mechanism information of the sign of the terminal of described Network Access Point entity stores accessed network and this terminal;

When the terminal of described accessed network when described Network Access Point entity sends data, described Network Access Point entity adds the safe access mechanism information corresponding identification information with described terminal in the data of described user terminal, described identification information is used to identify the affiliated Virtual Local Area Network of described terminal.

9. a support terminal mixes the network insertion point apparatus that inserts, and it is characterized in that, comprising:

Configuration module, the different virtual network access point entity of different security capabilities configurations that is used for difference counterpart terminal on the network insertion point apparatus, and be the safe access mechanism and the address designation of described virtual network access point physical arrangements correspondence, described address designation is the security mechanism sign corresponding with described safe access mechanism; Also be used for generating different broadcasts, wherein carry and the described different corresponding security mechanism sign of security mechanism according to described different security mechanism;

Communication interface modules is used for sending respectively a plurality of broadcasts of generation.

10. network insertion point apparatus as claimed in claim 9 is characterized in that, described configuration module comprises configuration submodule and at least 2 virtual network access point apparatus, wherein

The configuration submodule, the different virtual network access point apparatus of different security capabilities configurations that is used for difference counterpart terminal on described network insertion point apparatus, and be corresponding safe access mechanism and the address designation of described virtual network access point apparatus configuration, described address designation is the described security mechanism sign corresponding with described safe access mechanism;

The virtual access point device is used to generate the broadcast corresponding with the safe access mechanism of this virtual access point device, wherein carries the security mechanism sign of this virtual access point device; Also be used to adopt the safe access mechanism of this virtual access point device correspondence that the access request of terminal is handled.

11. network insertion point apparatus as claimed in claim 10 is characterized in that, described virtual access point device comprises:

The broadcast processing unit is used to generate described broadcast, wherein carries the security mechanism sign of this virtual access point device;

Insert requesting processing, be used to adopt the safe access mechanism of this virtual access point device correspondence that the access request that receives is handled, the security mechanism sign of carrying in the described access request is consistent with the security mechanism sign of this virtual access point device.

12. network insertion point apparatus as claimed in claim 10 is characterized in that, described security mechanism sign is obtained by the unique identification mapping of described network insertion point apparatus;

Receive described access request during sign that the security mechanism sign mapping that described communication interface modules also is used for carrying in the access request that sends according to terminal obtains being complementary with self described unique identification, and send to described security mechanism sign corresponding virtual access point apparatus and handle.

13. network insertion point apparatus as claimed in claim 9 is characterized in that, described communication interface modules is time division multiplexing module or frequency division multiplexing module;

Described time division multiplexing module is used for sending described respectively and the corresponding broadcast of security capabilities terminal by different time slots;

Described frequency division multiplexing module is used for sending described respectively and the corresponding broadcast of security capabilities terminal by different frequencies.

14. a terminal is characterized in that, comprising:

The broadcast receiver module is used to receive and resolve the broadcast that the network insertion point apparatus sends, and carries the security capabilities corresponding security mechanisms sign with described terminal in the described broadcast;

Insert the request initiation module, be used for initiating to insert request, carry security capabilities corresponding security mechanisms sign in the described access request with described terminal.

15. terminal as claimed in claim 14, it is characterized in that, described security mechanism sign is obtained by the unique identification mapping of described network insertion point apparatus, is specially: adopt reversible algorithm to be derived by the physical address of described network insertion point apparatus and obtain described security mechanism sign.

16. terminal as claimed in claim 14 is characterized in that, also comprises:

Configuration module is used to dispose the security mechanism selection strategy;

Select module, be used for according to described security mechanism selection strategy, the security mechanism of carrying respectively from a plurality of broadcasts that receive and correctly parse identifies the pairing safe access mechanism to be selected, and adopts the safe access mechanism of selecting to initiate to insert by described access request initiation module and ask.

17. terminal as claimed in claim 14 is characterized in that, also comprises:

Display module is used to show that the security mechanism that reception and a plurality of broadcasts that correctly parse are carried respectively identifies pairing safe access mechanism information for user's selection;

Select module, be used to receive user-selected safe access mechanism, and adopt this safe access mechanism to initiate to insert request by described access request initiation module.

18. a support terminal mixes the communication system that inserts, and it is characterized in that, comprises network insertion point apparatus and terminal;

Described network insertion point apparatus, be used for the different virtual network access point entity of different security capabilities configurations of counterpart terminal respectively, and be the safe access mechanism and the address designation of described virtual network access point physical arrangements correspondence, described address designation is the security mechanism sign corresponding with described safe access mechanism, and send different broadcasts according to different safe access mechanisms respectively, carry and the described different corresponding security mechanism sign of safe access mechanism in the described different broadcast;

Described terminal is used to receive and resolve described broadcast and initiates the access request according to the broadcast that correctly parses, and carries the security capabilities corresponding security mechanisms sign with described terminal in the described access request.

19. communication system as claimed in claim 18 is characterized in that, described security mechanism sign is obtained by the unique identification mapping of described network insertion point apparatus;

Described network insertion point apparatus also is used for receiving described access request when the sign that the mapping of the security mechanism of carrying according to described access request sign obtains being complementary with self described unique identification, and employing identifies corresponding safe access mechanism with described security mechanism described access request is handled.

20. communication system as claimed in claim 18, it is characterized in that, described terminal also is used for when receiving and correctly parsing a plurality of broadcast, the security mechanism of carrying respectively from described a plurality of broadcasts identifies the pairing safe access mechanism to be selected, and adopts the safe access mechanism of selecting to initiate to insert request; Perhaps, show that the security mechanism that a plurality of broadcasts are carried respectively identifies pairing safe access mechanism information for user's selection, and initiate to insert request according to user's selection.

Images