CN106714158B - A kind of WiFi access method and device - Google Patents

Abstract

The present invention provides a WiFi access method and device, wherein the WiFi access method includes: sending registration information to an access point detection platform for access point registration, and receiving registration information returned by the access point detection platform after checking the registration information Successful result; the registration information includes access authentication related information and public key; receive the connection verification request sent by the WiFi client, use the preset private key to generate authentication information and send it to the WiFi client, and send the authentication information sent by the WiFi client to the WiFi client. The connection access request is forwarded to the access point detection platform; the authentication success result notification fed back after the access point detection platform uses the public key in the registration information to legally authenticate the authentication information, establishes a WiFi connection with the WiFi client. The embodiment of the present invention improves the security of WiFi verification, avoids malicious tampering of data information, prevents access to phishing WiFi access points, and realizes secure access to WiFi.

Description

A kind of WiFi access method and device

technical field

The present invention relates to the technical field of information security, and in particular, to a WiFi access method and device.

Background technique

With the development and popularization of the mobile Internet, when dining in restaurants or cafes, mobile Internet users will take out their mobile phones or tablet computers with Internet access functions to search for free WiFi wireless networks. "advertisment. However, free WiFi can come with no small security risks. Some criminals can use a computer with a wireless network card and a network packet analysis software in a public place to build a wireless hotspot, and build a phishing WiFi without a password. If the user uses the WiFi, criminals can steal sensitive information such as bank passwords of mobile Internet users in a short period of time.

SUMMARY OF THE INVENTION

The purpose of the embodiments of the present invention is to provide a WiFi access method and device, which improves the security of WiFi verification, avoids malicious tampering of data information, prevents access to phishing WiFi access points, and realizes secure WiFi access.

In order to achieve the above object, an embodiment of the present invention provides a WiFi access method, which is applied to a WiFi access point, and the WiFi access method includes:

Send registration information to an access point detection platform for access point registration, and receive a successful registration result returned by the access point detection platform after checking the registration information; wherein the registration information includes access authentication related information and public key;

Receive the connection verification request sent by the WiFi client, use the preset private key to generate authentication information and send it to the WiFi client, and forward the connection access request including the authentication information sent by the WiFi client to the access point detection platform;

Receive an authentication success result notification fed back after the access point detection platform uses the public key in the registration information to legally authenticate the authentication information, and establish a WiFi connection with the WiFi client.

Wherein, when receiving the successful registration result returned by the access point detection platform after checking the registration information, the address configuration of the access point detection platform is simultaneously received, and the address of the access point detection platform is stored. to a whitelist.

Wherein, the step of generating authentication information by using a preset private key and sending it to the WiFi client includes:

generating an access point random number Rc, encrypting the Rc with the access point private key to obtain a first encrypted random number EAPs (Rc), the Rc and the EAPs (Rc) forming the authentication information;

Send the Rc and the EAPs (Rc) to the WiFi client, which is generated by the WiFi client according to the authentication information, the registration information of the current access point acquired by scanning, and the WiFi client The client random number Rs and the corresponding digest value of each part are encrypted with the public key of the detection platform to generate the connection access request.

Wherein, the forwarding of the connection access request including the authentication information sent by the WiFi client to the access point detection platform is specifically:

The connection access request is transparently transmitted to the access point detection platform according to the address of the access point detection platform stored in the whitelist.

The receiving access point detection platform uses the public key in the registration information to perform legal authentication on the authentication information and feeds back a notification of a successful authentication result, and establishes a WiFi connection with the WiFi client, which specifically includes:

Receive the authentication success result notification, and simultaneously receive the second encrypted random number E _APp (Rs) sent by the access point detection platform, where the E _APp (Rs) is the encryption obtained by the access point detection platform. The resulting Rs is decrypted and then encrypted with the access point public key;

Use the access point private key to decrypt the _EAPp (Rs) to obtain the Rs;

Using the Rs and the Rc as factors, a key generation algorithm is used to generate a shared key Ks with the WiFi client and store it securely, establish a connection with the WiFi client, and realize the transmission of information.

An embodiment of the present invention provides a WiFi access method, which is applied to a WiFi client, and the access method includes:

Scan the WiFi access point list, and send a connection verification request to the first WiFi access point in the WiFi access point list;

When the first WiFi access point is an access point successfully registered on the access point detection platform in advance, receiving authentication information generated by the first WiFi access point using a private key;

sending a connection access request including the authentication information to the access point detection platform for legality authentication;

Receive the legitimacy test result sent by the access point detection platform and forwarded by the first WiFi access point and signed by the private key of the access point detection platform, and establish access to the first WiFi connections between points.

Wherein, the connection access request is the WiFi client according to the authentication information, the registration information of the current access point obtained by scanning, the client random number Rs generated by the WiFi client, and the corresponding digest value of each part. Generated after encryption with the public key of the access point detection platform, the authentication information includes the access point random number Rc generated by the first WiFi access point and the Rc obtained by encrypting the Rc with the access point private key The first encrypted random number EAPs(Rc).

Wherein, the receiving the validity check result sent by the access point detection platform and forwarded by the first WiFi access point and signed by the private key of the access point detection platform, establishes a connection with the first WiFi access point. A connection between WiFi access points, specifically:

After receiving the validity check result, use the received Rc and the generated Rs as factors to use a key generation algorithm to generate a shared key Ks with the first WiFi access point, store it securely, and establish The connection with the first WiFi access point realizes the transmission of information.

Wherein, the method also includes:

When the first WiFi access point is not an access point that has been successfully registered on the access point detection platform in advance, the WiFi client terminates the authentication process and prompts the user that the legality of the first WiFi access point cannot be determined. sex.

An embodiment of the present invention further provides a WiFi access method, which is applied to an access point detection platform, and the WiFi access method includes:

Receive the registration information sent by a WiFi access point, check the current WiFi access point, store the registration information in the legal access point list after the verification is successful, and return the successful registration result to the current WiFi access point, Make the current WiFi access point use the preset private key to generate authentication information;

receiving a connection access request including the authentication information sent by the WiFi client;

According to the received connection access request, use the public key in the registration information to legally authenticate the authentication information, and send a notification of the successful authentication result to the current WiFi access point, so that the current WiFi access point establishes an the connection of the WiFi client described above.

The authentication information includes: the access point random number Rc and the first encrypted random number EAPs (Rc) obtained by encrypting the Rc with the access point private key; the connection access request is the WiFi client According to the authentication information, the registration information of the current access point obtained by scanning, the client random number Rs generated by the WiFi client, and the corresponding digest values of each part are encrypted with the public key of the access point detection platform. .

Wherein, according to the received connection access request, using the public key in the registration information to legally authenticate the authentication information, including:

Decrypt the connection access request by using the private key of the access point detection platform to complete the integrity check of the information;

Search the list of legitimate access points through the registration information of the current WiFi access point;

If the exact corresponding item is found, decrypt the E _APs (Rc) with the public key of the current WiFi access point, and compare whether the decryption result is the same as the received Rc. If they are the same, the authentication success result is obtained.

Wherein, when the current WiFi access point is a legitimate access point, the method further includes:

Encrypt the decrypted Rs with the public key of the current WiFi access point to obtain a second encrypted random number E _APp (Rs);

The E _APp (Rs) and the authentication success result notification are sent to the current WiFi access point.

Wherein, the method also includes:

If the corresponding item is searched, but the decryption result is different from the received Rc, the authentication failure result is obtained;

If no corresponding item is found, the authentication failure result is obtained.

An embodiment of the present invention further provides a WiFi access device, which is applied to a WiFi access point, and the WiFi access device includes:

a first processing module, configured to send registration information to an access point detection platform for access point registration, and receive a successful registration result returned by the access point detection platform after checking the registration information; wherein the registration information Including access authentication related information and public key;

The second processing module is configured to receive a connection verification request sent by the WiFi client, generate authentication information by using a preset private key and send it to the WiFi client, and access the connection containing the authentication information sent by the WiFi client. forwarding the request to the access point detection platform;

The third processing module is configured to receive an authentication success result notification fed back after the access point detection platform uses the public key in the registration information to legally authenticate the authentication information, and establish a WiFi connection with the WiFi client.

Wherein, the WiFi access device further includes:

A receiving storage module, used for the first processing module to receive the address configuration of the access point detection platform when receiving the registration success result returned by the access point detection platform after checking the registration information, and to store the access point detection platform at the same time. The address of the access point detection platform is stored in a whitelist.

Wherein, the second processing module includes:

The generating submodule is used for generating the random number Rc of the access point, and encrypting the Rc with the private key of the access point to obtain the first encrypted random number EAPs(Rc), and the Rc and the EAPs(Rc) constitute the Certification Information;

a first sending submodule, configured to send the Rc and the EAPs (Rc) to the WiFi client, and the WiFi client obtains the registration of the current access point according to the authentication information and scanning The information, the client random number Rs generated by the WiFi client, and the corresponding digest values of each part are encrypted with the public key of the detection platform to generate the connection access request.

Wherein, the second processing module is further used for:

The connection access request is transparently transmitted to the access point detection platform according to the address of the access point detection platform stored in the whitelist.

Wherein, the third processing module includes:

A receiving submodule, configured to receive the second encrypted random number E _APp (Rs) sent by the access point detection platform when receiving the authentication success result notification, where the E _APp (Rs) is the access point The detection platform is generated by decrypting the obtained encrypted Rs and then encrypting it with the access point public key;

The first decryption submodule is used to decrypt the _EAPp (Rs) using the access point private key to obtain the Rs;

The connection sub-module is configured to use the Rs and the Rc as factors to generate a shared key Ks with the WiFi client using a key generation algorithm and store it securely, establish a connection with the WiFi client, and implement information transmission.

An embodiment of the present invention further provides a WiFi access device, which is applied to a WiFi client, and the access device includes:

a scanning and sending module, configured to scan the WiFi access point list, and send a connection verification request to the first WiFi access point in the WiFi access point list;

a first receiving module, configured to receive authentication information generated by the first WiFi access point using a private key when the first WiFi access point is an access point successfully registered on the access point detection platform in advance;

a first sending module, configured to send a connection access request including the authentication information to the access point detection platform for legality authentication;

The fourth processing module is configured to receive the legitimacy test result sent by the access point detection platform and forwarded by the first WiFi access point and signed by the private key of the access point detection platform, and establish and connection between the first WiFi access points.

Wherein, the connection access request is the WiFi client according to the authentication information, the registration information of the current access point obtained by scanning, the client random number Rs generated by the WiFi client, and the corresponding digest value of each part. Generated after encryption with the public key of the access point detection platform, the authentication information includes the access point random number Rc generated by the first WiFi access point and the Rc obtained by encrypting the Rc with the access point private key The first encrypted random number EAPs(Rc).

Wherein, the fourth processing module is further used for:

After receiving the validity check result, use the received Rc and the generated Rs as factors to use a key generation algorithm to generate a shared key Ks with the first WiFi access point, store it securely, and establish The connection with the first WiFi access point realizes the transmission of information.

Wherein, the device also includes:

A termination module, configured to terminate the authentication process when the first WiFi access point is not an access point successfully registered on the access point detection platform in advance, and prompt the user that the legality of the first WiFi access point cannot be determined sex.

An embodiment of the present invention further provides a WiFi access device, which is applied to an access point detection platform, and the WiFi access device includes:

The fifth processing module is used to receive the registration information sent by a WiFi access point, check the current WiFi access point, store the registration information in the list of legal access points after the verification is successful, and record the successful registration result Return the current WiFi access point, so that the current WiFi access point uses the preset private key to generate authentication information;

a second receiving module, configured to receive a connection access request including the authentication information sent by the WiFi client;

The sixth processing module is configured to use the public key in the registration information to legally authenticate the authentication information according to the received connection access request, and send a notification of a successful authentication result to the current WiFi access point, so that the current The WiFi access point establishes a connection with the WiFi client.

The authentication information includes: the access point random number Rc and the first encrypted random number EAPs (Rc) obtained by encrypting the Rc with the access point private key; the connection access request is the WiFi client According to the authentication information, the registration information of the current access point obtained by scanning, the client random number Rs generated by the WiFi client, and the corresponding digest values of each part are encrypted with the public key of the access point detection platform. .

Wherein, the sixth processing module includes:

The second decryption submodule is used to decrypt the connection access request by using the private key of the access point detection platform to complete the integrity check of the information;

The search submodule is used to search the list of legal access points through the registration information of the current WiFi access point;

The processing sub-module is used to decrypt the E _APs (Rc) with the public key of the current WiFi access point if the exact corresponding item is found, and compare whether the decryption result is the same as the received Rc, and if they are the same, the authentication success result is obtained.

Wherein, when the current WiFi access point is a legitimate access point, the device further includes:

an encryption module for encrypting the decrypted Rs with the public key of the current WiFi access point to obtain a second encrypted random number E _APp (Rs);

The second sending module is configured to send the E _APp (Rs) and the authentication success result notification to the current WiFi access point.

Wherein, the device also includes:

The first authentication module is used to obtain the authentication failure result if the corresponding item is searched, but the decryption result is different from the received Rc;

The second authentication module is used to obtain the authentication failure result if no corresponding item is found.

The beneficial effects of the above-mentioned technical solutions of the present invention are as follows:

After the WiFi access point completes the registration and authentication in the access point detection platform, the user connects to the WiFi access point through the WiFi client. The WiFi access point uses the preset private key to generate authentication information and sends it to the WiFi client. The connection access request containing authentication information is transparently transmitted to the access point detection platform through the WiFi access point, and the access point detection platform verifies the legitimacy of the WiFi access point, confirms the legal identity of the access point, and will verify the The result is encrypted and sent to the WiFi client, and the WiFi client accesses the legal access point according to the verification result. It can improve the security of WiFi verification, avoid malicious tampering of data information, prevent access to phishing WiFi access points, and realize secure WiFi access.

Description of drawings

FIG. 1 is a schematic diagram 1 of steps of a WiFi access method according to an embodiment of the present invention;

FIG. 2 is a schematic diagram 2 of steps of a WiFi access method according to an embodiment of the present invention;

FIG. 3 is a schematic diagram 3 of steps of a WiFi access method according to an embodiment of the present invention;

4 is a schematic diagram of an overall flow of a WiFi access method according to an embodiment of the present invention;

FIG. 5 is a schematic diagram of a WiFi access device according to an embodiment of the present invention.

Detailed ways

In order to make the technical problems, technical solutions and advantages to be solved by the present invention more clear, the following will be described in detail with reference to the accompanying drawings and specific embodiments.

An embodiment of the present invention provides a WiFi access method, which is applied to a WiFi access point. As shown in FIG. 1 , the WiFi access method includes:

Step S101: Send registration information to an access point detection platform for access point registration, and receive a successful registration result returned by the access point detection platform after checking the registration information; wherein the registration information includes access authentication Relevant information and public key;

Step S102: Receive the connection verification request sent by the WiFi client, use a preset private key to generate authentication information and send it to the WiFi client, and forward the connection access request including the authentication information sent by the WiFi client to the WiFi client. the access point detection platform;

Step S103: Receive an authentication success result notification fed back after the access point detection platform uses the public key in the registration information to legally authenticate the authentication information, and establish a WiFi connection with the WiFi client.

Specifically, the WiFi access point sends information such as the identity information of the access point, the WiFi access point name SSID, the media access control value MAC, the authentication method, and the public key to the access point through HTTPS (hypertext transport protocol server). The access point detection platform performs registration, wherein the access authentication related information includes: the identity information of the access point, the WiFi access point name SSID, the media access control value MAC and the authentication method. After the registration is completed, a successful registration result after checking the registration information returned by the access point detection platform is received. After successful registration, you can receive the connection verification request sent by the WiFi client, use the preset private key to generate authentication information after receiving the connection verification request, send the authentication information to the WiFi client, and the WiFi client sends the connection containing the authentication information Access request. After the WiFi access point receives the connection access request, it forwards it to the access point detection platform through HTTPS. After the access point detection platform verifies the authentication information legally, it returns a notification of the successful authentication result and receives the authentication. After a successful result notification, establish a WiFi connection with the WiFi client.

After completing the registration and authentication in the access point detection platform through the WiFi access point, the WiFi access point uses the preset private key to generate authentication information and send it to the WiFi client. The WiFi client sends the connection access request containing the authentication information via The WiFi access point is transparently transmitted to the access point detection platform, and the access point detection platform verifies the legitimacy of the WiFi access point. After confirming the legal identity of the access point, the WiFi access point establishes a connection between the WiFi access point and the WiFi client. WiFi connection improves the security of WiFi authentication, avoids malicious tampering of data information, prevents access to phishing WiFi access points, and realizes secure WiFi access.

In the above embodiment of the present invention, when receiving the registration success result returned by the access point detection platform after checking the registration information, the address configuration of the access point detection platform is simultaneously received, and the access point detection platform The addresses of the point detection platforms are stored in a whitelist.

Specifically, the WiFi access point includes a whitelist, and multiple addresses are stored in the whitelist. When the client accesses the addresses in the whitelist, it does not need to be authenticated and can directly access. When the WiFi access point receives the successful registration result returned by the access point detection platform, it also receives the address configuration of the access point detection platform, and stores the address of the access point detection platform in the whitelist. When sending a message, through the address of the access point detection platform stored in the whitelist, the message can be directly transparently transmitted to the access point detection platform through HTTPS.

In the above embodiment of the present invention, in step S102, generating authentication information using a preset private key and sending it to the WiFi client includes:

Step S1021: Generate an access point random number Rc, encrypt the Rc with the access point private key to obtain a first encrypted random number EAPs (Rc), and the Rc and the EAPs (Rc) form the authentication information;

Step S1022: Send the Rc and the EAPs (Rc) to the WiFi client, and the WiFi client obtains the registration information of the current access point and the WiFi according to the authentication information and scanning. The client random number Rs generated by the client and the corresponding digest value of each part are encrypted with the public key of the detection platform to generate the connection access request.

Specifically, after receiving the connection verification request sent by the WiFi client, the WiFi access point uses the random number generation unit to generate Rc, and then uses the access point private key to encrypt Rc to obtain EAPs (Rc), which will be composed of Rc and EAPs ( The authentication information composed of Rc) is sent to the WiFi client.

The WiFi client generates Rs after receiving Rc and EAPs (Rc), and then uses the detection platform public key to encrypt the connection connection according to the authentication information, the registration information of the current access point obtained by scanning, Rs and the corresponding digest value of each part. input request.

In the above embodiment of the present invention, in step S102, the connection access request including the authentication information sent by the WiFi client is forwarded to the access point detection platform, specifically:

The connection access request is transparently transmitted to the access point detection platform according to the address of the access point detection platform stored in the whitelist.

Specifically, the address of the access point detection platform is stored in the whitelist of the WiFi access point. When accessing the address in the whitelist, no authentication is required, and the access can be performed directly. When forwarding the connection access request to the access point detection platform, the address of the access point detection platform stored in the whitelist is used to directly transparently transmit the connection access request to the access point detection platform through HTTPS.

In the above-mentioned embodiment of the present invention, step S103 includes:

Step S1031: Receive the authentication success result notification, and simultaneously receive the second encrypted random number E _APp (Rs) sent by the access point detection platform, where the E _APp (Rs) is a pair of data used by the access point detection platform. The obtained encrypted Rs is decrypted and then encrypted with the access point public key;

Step S1032, decrypt the _EAPp (Rs) using the access point private key to obtain the Rs;

Step S1033 , using the Rs and the Rc as factors to generate a shared key Ks with the WiFi client using a key generation algorithm and store it securely, establish a connection with the WiFi client, and implement information transmission.

Specifically, when the WiFi access point receives the notification of the successful authentication result sent by the access point detection platform, it also receives the encrypted Rs obtained by the access point detection platform and is sent by the access point detection platform to decrypt and reuse the access point. _EAp (Rs) generated after the point of public key encryption. After receiving the _EAPp (Rs), use the access point private key to decrypt the _EAPp (Rs) to obtain Rs. According to the obtained Rs and the Rc generated by the WiFi access point itself, the key generation algorithm is used to generate the shared key Ks with the WiFi client, and the calculated Ks is stored securely to realize the communication between the WiFi access point and the WiFi client. connection to transfer information.

An embodiment of the present invention further provides a WiFi access method, which is applied to a WiFi client. As shown in FIG. 2 , the access method includes:

Step S201, scan the WiFi access point list, and send a connection verification request to the first WiFi access point in the WiFi access point list;

Step S202, when the first WiFi access point is an access point that has been successfully registered on the access point detection platform in advance, receiving authentication information generated by the first WiFi access point using a private key;

Step S203, sending a connection access request including the authentication information to the access point detection platform for legality authentication;

Step S204: Receive the validity check result sent by the access point detection platform and forwarded by the first WiFi access point and signed by the private key of the access point detection platform, and establish a connection with the first WiFi access point. Connection between WiFi access points.

Specifically, the WiFi client scans the list of WiFi access points, and sends a connection verification request to the first WiFi access point. When the first WiFi access point is an access point that has been successfully registered on the access point detection platform in advance , the WiFi client receives the authentication information generated by the first WiFi access point using the private key; when the first WiFi access point is not an access point that has been successfully registered on the access point detection platform in advance, the WiFi client terminates the authentication process, The user is prompted that the legitimacy of the first WiFi access point cannot be determined, and the user decides whether to continue the connection.

When the WiFi client receives the authentication information generated by the first WiFi access point using the private key, it sends a connection access request including the authentication information to the access point detection platform, and the access point detection platform connects to the first WiFi The validity of the point is verified, and the verification result is sent to the WiFi client. The WiFi client will receive the inspection result sent by the access point detection platform and forwarded by the first WiFi access point, and the inspection result will be signed by the private key of the access point detection platform, indicating the reliability and authenticity of the inspection result. After receiving the inspection result sent by the access point detection platform and signed by the private key of the access point detection platform, use the public key of the access point detection platform to decrypt the detection result, if the first WiFi access point is a legitimate access point Access point, you can establish a connection with the first WiFi access point.

If the legality of the first WiFi access point cannot be verified, the user is prompted that the legality of the first WiFi access point cannot be determined, and the user decides whether to continue; if the first WiFi access point is not legal, the user is prompted to access the If the point is illegal, there is a risk of phishing, and it is up to the user to decide whether to continue or directly prohibit the user from accessing.

In the above embodiment of the present invention, the connection access request is the WiFi client according to the authentication information, the registration information of the current access point obtained by scanning, the client random number Rs generated by the WiFi client, and The corresponding digest value of each part is generated by encrypting with the public key of the access point detection platform, and the authentication information includes the access point random number Rc generated by the first WiFi access point and the private key pair of the access point. The first encrypted random number EAPs (Rc) obtained by encrypting the Rc.

Specifically, after receiving the authentication information sent by the first WiFi access point, the WiFi client generates Rs, and then according to the authentication information, the registration information of the first WiFi access point obtained by scanning, Rs and corresponding digest values of each part The connection access request is generated after encryption with the public key of the detection platform, wherein the registration information of the WiFi access point at least includes: the identity information of the WiFi access point, the name SSID of the WiFi access point, the media access control value MAC, the authentication method, the public key.

In the above embodiment of the present invention, step S204 is specifically:

After receiving the validity check result, use the received Rc and the generated Rs as factors to use a key generation algorithm to generate a shared key Ks with the first WiFi access point, store it securely, and establish The connection with the first WiFi access point realizes the transmission of information.

Specifically, after receiving the validity check result, the WiFi client knows that the first WiFi access point is a legitimate access point, and generates a key according to the received Rc sent by the first WiFi access point and the generated Rs. The algorithm generates a shared key Ks with the first WiFi access point, and stores the calculated Ks securely, so as to realize the connection between the WiFi client and the first WiFi access point, and realize the transmission of information.

An embodiment of the present invention further provides a WiFi access method, which is applied to an access point detection platform. As shown in FIG. 3 , the WiFi access method includes:

Step S301: Receive registration information sent by a WiFi access point, check the current WiFi access point, store the registration information in a list of legal access points after the verification is successful, and return the registration success result to the current WiFi access point. Access point, so that the current WiFi access point uses the preset private key to generate authentication information;

Step S302, receiving a connection access request including the authentication information sent by the WiFi client;

Step S303: According to the received connection access request, use the public key in the registration information to legally authenticate the authentication information, and send a notification of the successful authentication result to the current WiFi access point, so that the current WiFi access point A connection to the WiFi client is established.

Specifically, after receiving the registration information sent by a WiFi access point, check the registration information submitted by the WiFi access point, and after the registration authentication is successful, store the information in the list of legal access points, and the list records the identity information of the access point , Access point name SSID, media access control value MAC, authentication method, public key and other information. The successful registration result is returned to the current WiFi access point, so that the current WiFi access point uses the preset private key to generate authentication information. Then, a connection access request including authentication information and forwarded by the current WiFi access point and sent by the WiFi client is received.

It should be noted that when the access point detection platform returns the successful registration result to the current WiFi access point, it also sends its own address configuration to the current WiFi access point, and the current WiFi access point will The addresses are stored in a whitelist, and there are multiple addresses stored in the whitelist. When a client accesses an address in the whitelist, it does not need to be authenticated and can directly access. When the current WiFi access point sends a connection access request to the access point detection platform, it can directly transparently transmit the connection access request to the access point detection platform through HTTPS through the address of the access point detection platform stored in the whitelist. .

After receiving the connection access request containing the authentication information sent by the client, use the public key in the registration information to legally authenticate the authentication information. The access point establishes a connection with the WiFi client.

In the above embodiment of the present invention, the authentication information includes: the access point random number Rc and the first encrypted random number EAPs (Rc) obtained by encrypting the Rc with the access point private key; the connection access request It is that the WiFi client uses the access point detection platform according to the authentication information, the registration information of the current access point obtained by scanning, the client random number Rs generated by the WiFi client, and the corresponding digest values of each part. Generated after public key encryption.

Specifically, the Rc generated by the current WiFi access point and the EAPs (Rc) obtained by encrypting the Rc with the private key of the access point constitute the authentication information. After receiving the authentication information sent by the current WiFi access point, the WiFi client generates Rs, and then uses the public key of the detection platform according to the authentication information, the registration information of the current WiFi access point obtained by scanning, Rs and the corresponding digest value of each part. A connection access request is generated after encryption.

In the above-mentioned embodiment of the present invention, step S303 includes:

Step S3031, decrypt the connection access request by using the private key of the access point detection platform to complete the integrity check of the information;

Step S3032, searching for a list of legitimate access points through the registration information of the current WiFi access point;

Step S3033: If a complete corresponding item is found, decrypt the E _APs (Rc) with the public key of the current WiFi access point, compare whether the decryption result is the same as the received Rc, and if they are the same, obtain a successful authentication result.

Specifically, the connection access request is decrypted by using the private key of the access point detection platform to obtain authentication information. The authentication information includes Rc and E _APs (Rc), the registration information of the current WiFi access point and the Rs and each part of the authentication information. Digest value, search the list of legal access points through the registration information of the current WiFi access point: if the exact corresponding item is found, decrypt the E _APs (Rc) with the public key of the current WiFi access point, and compare the decryption result with the received Rc Whether they are the same, if they are the same, the access point is valid, and the authentication success result is obtained.

In the foregoing embodiment of the present invention, when the current WiFi access point is a legitimate access point, the method further includes:

Step S304, encrypting the decrypted Rs with the public key of the current WiFi access point to obtain a second encrypted random number E _APp (Rs);

Step S305: Send the E _APp (Rs) and the authentication success result notification to the current WiFi access point.

Specifically, after confirming that the current WiFi access point is a legitimate access point, encrypt the obtained Rs with the public key of the current WiFi access point to obtain E _APp (Rs), and then notify the E _APp (Rs) and the successful authentication result. Send to the current WiFi access point, after the current WiFi access point decrypts E _APPp (Rs), obtain Rs, use Rs and Rc to generate the shared key Ks with the WiFi client, and establish the WiFi access point and WiFi client The connection between them realizes the transmission of information.

In the above-mentioned embodiment of the present invention, the method further includes:

If the corresponding item is searched, but the decryption result is different from the received Rc, the authentication failure result is obtained;

If no corresponding item is found, the authentication failure result is obtained.

When searching the legal access point list through the registration information of the current WiFi access point, if the corresponding item is found, decrypt the E _APs (Rc) with the public key of the current WiFi access point, obtain the decrypted Rc, and compare the decrypted Whether the Rc is the same as the received Rc, if the two are different, it means that the authentication fails, and if no corresponding item is found, it also proves that the authentication fails.

As shown in Figure 4, it is a schematic diagram of the overall flow of the embodiment of the present invention:

Step S401, the WiFi access point sends the registration information consisting of identity information and the name SSID of the WiFi access point, the media access control value MAC, the authentication method, the public key and other information to the access point detection platform through HTTPS for registration authentication.

Step S402: The access point detection platform checks the registration information submitted by the WiFi access point. After the registration and authentication is successful, the information is stored in a list of legal access points, and the list records the identity information of the WiFi access point and the identity information of the WiFi access point. Name SSID, media access control value MAC, authentication method, public key and other information.

Step S403, the access point detection platform informs the WiFi access point of the successful registration result and the address configuration of the access point detection platform.

Step S404 , the WiFi access point configures the address of the access point detection platform into the whitelist, which is used to subsequently release the connection access request sent by the WiFi client.

Step S405, the WiFi client scans the list of WiFi access points, and clicks one of the access points to connect.

Step S406, the WiFi client sends a connection verification request to the access point.

Step S407: The legitimate access point registered on the access point detection platform receives the connection verification request, generates a random number Rc, and encrypts the E _APs (Rc) with the private key.

Step S408: The legal access point registered on the access point detection platform sends the Rc and E _APs (Rc) to the WiFi client; the legal access point that is not registered on the access point detection platform cannot complete the subsequent authentication process, The WiFi client terminates the access point authentication process, prompting the user that the legitimacy of the access point cannot be determined, and the user decides whether to continue.

Step S409, the WiFi client generates a random number Rs, collects the SSID, MAC, authentication method, Rc, E _APs (Rc), Rs and other information of the access point, and calculates the summary value of these information, and combines the above information and its summary value. The connection access request is formed after encryption with the public key of the detection platform.

Step S410, the WiFi client transparently transmits the connection access request from the access point to the access point detection platform through HTTPS.

Step S411, the access point detection platform decrypts the connection access request with the private key, and after completing the integrity check of the information, searches the list of legal access points through the access point information: if a complete corresponding item is found, use the legal access point Decrypt the E _APs (Rc) with the public key of the access point, and compare whether the decryption result is the same as the received Rc. If they are the same, it means that the access point is legal and not forged, and then encrypt the decrypted Rs with the access point's public key. E _APp (Rs); If the corresponding item is searched, but the decryption result is different from the received Rc, it means that the access point is forged; if the corresponding item is not searched, the legitimacy of the access point cannot be verified.

Step S412 , the access point detection platform sends the access point legality detection result to the access point together with the signature of the private key of the detection platform and the _EAPp (Rs).

Step S413 , the access point decrypts the E _APp (Rs) with its own private key to obtain Rs, and uses Rs and Rc as factors to generate a shared key Ks with the client using a key generation algorithm and store it securely.

Step S414, the access point forwards the detection result and the signature of the legitimacy of the access point sent by the access point detection platform to the client.

Step S415, the WiFi client decrypts the result returned by the detection platform with the public key of the detection platform, and performs the following operations according to the result: if the access point is valid, use the key generation algorithm to generate a shared key with the client using Rs and Rc as factors Ks and stored securely, start the operation of connecting the access point, and the messages sent to the access point will be encrypted by Ks; if the access point cannot be verified, the user will be prompted that the legitimacy of the access point cannot be determined, and the user decides Whether to continue; if the access point is illegal, it will prompt the user that the access point is illegal and there is a risk of phishing, and the user decides whether to continue or directly prohibit the user from accessing.

An embodiment of the present invention further provides a WiFi access device, which is applied to a WiFi access point. As shown in FIG. 5 , the WiFi access device includes:

The first processing module 10 is configured to send registration information to an access point detection platform for access point registration, and receive a successful registration result returned by the access point detection platform after checking the registration information; wherein the registration The information includes access authentication related information and public key;

The second processing module 20 is configured to receive a connection verification request sent by the WiFi client, generate authentication information by using a preset private key and send it to the WiFi client, and send the connection connection containing the authentication information sent by the WiFi client. forwarding the incoming request to the access point detection platform;

The third processing module 30 is configured to receive an authentication success result notification fed back after the access point detection platform uses the public key in the registration information to legally authenticate the authentication information, and establish a WiFi connection with the WiFi client .

In the foregoing embodiment of the present invention, the WiFi access device further includes:

The receiving storage module 40 is used for the first processing module 10 to receive the address configuration of the access point detection platform when receiving the registration success result returned by the access point detection platform after checking the registration information, and to The address of the access point detection platform is stored in a white list.

In the foregoing embodiment of the present invention, the second processing module 20 includes:

The generating sub-module 21 is used for generating the random number Rc of the access point, and encrypting the Rc with the private key of the access point to obtain the first encrypted random number EAPs (Rc), and the Rc and the EAPs (Rc) are composed of the authentication information;

The first sending sub-module 22 is configured to send the Rc and the EAPs (Rc) to the WiFi client, and the WiFi client scans and obtains the current access point according to the authentication information. The registration information, the client random number Rs generated by the WiFi client, and the corresponding digest values of each part are encrypted with the public key of the detection platform to generate the connection access request.

In the above embodiment of the present invention, the second processing module 20 is further configured to:

The connection access request is transparently transmitted to the access point detection platform according to the address of the access point detection platform stored in the whitelist.

In the foregoing embodiment of the present invention, the third processing module 30 includes:

The receiving sub-module 31 is configured to receive the second encrypted random number E _APp (Rs) sent by the access point detection platform when receiving the authentication success result notification, and the E _APp (Rs) is the access point detection platform. The point detection platform decrypts the obtained encrypted Rs and encrypts it with the access point public key;

The first decryption submodule 32 is used for decrypting the _EAPp (Rs) using the access point private key to obtain the Rs;

The connection sub-module 33 is used to use the Rs and the Rc as factors to generate a shared key Ks with the WiFi client using a key generation algorithm and store it securely, establish a connection with the WiFi client, and realize the transmission of information .

An embodiment of the present invention further provides a WiFi access device, which is applied to a WiFi client, and the access device includes:

The scanning and sending module 40 is configured to scan the WiFi access point list, and send a connection verification request to the first WiFi access point in the WiFi access point list;

A first receiving module 50, configured to receive authentication information generated by the first WiFi access point using a private key when the first WiFi access point is an access point that has been successfully registered on the access point detection platform in advance;

a first sending module 60, configured to send a connection access request including the authentication information to the access point detection platform for legality authentication;

The fourth processing module 70 is configured to receive the validity check result sent by the access point detection platform and forwarded by the first WiFi access point and signed by the private key of the access point detection platform, and establish connection to the first WiFi access point.

In the above embodiment of the present invention, the connection access request is the WiFi client according to the authentication information, the registration information of the current access point obtained by scanning, the client random number Rs generated by the WiFi client, and The corresponding digest value of each part is generated by encrypting with the public key of the access point detection platform, and the authentication information includes the access point random number Rc generated by the first WiFi access point and the private key pair of the access point. The first encrypted random number EAPs (Rc) obtained by encrypting the Rc.

In the above embodiment of the present invention, the fourth processing module 70 is further configured to:

After receiving the validity check result, use the received Rc and the generated Rs as factors to use a key generation algorithm to generate a shared key Ks with the first WiFi access point, store it securely, and establish The connection with the first WiFi access point realizes the transmission of information.

In the above-mentioned embodiment of the present invention, described device also comprises:

The termination module 80 is configured to terminate the authentication process when the first WiFi access point is not an access point successfully registered on the access point detection platform in advance, and prompt the user that the first WiFi access point cannot be determined. legality.

An embodiment of the present invention further provides a WiFi access device, which is applied to an access point detection platform, and the WiFi access device includes:

The fifth processing module 90 is configured to receive the registration information sent by a WiFi access point, check the current WiFi access point, store the registration information in the list of legal access points after the verification is successful, and register the successful registration The result is returned to the current WiFi access point, so that the current WiFi access point uses the preset private key to generate authentication information;

The second receiving module 100 is configured to receive a connection access request including the authentication information sent by the WiFi client;

The sixth processing module 110 is configured to use the public key in the registration information to legally authenticate the authentication information according to the received connection access request, and send a notification of a successful authentication result to the current WiFi access point, so that The current WiFi access point establishes a connection with the WiFi client.

In the above embodiment of the present invention, the authentication information includes: the access point random number Rc and the first encrypted random number EAPs (Rc) obtained by encrypting the Rc with the access point private key; the connection access request It is that the WiFi client uses the access point detection platform according to the authentication information, the registration information of the current access point obtained by scanning, the client random number Rs generated by the WiFi client, and the corresponding digest values of each part. Generated after public key encryption.

In the foregoing embodiment of the present invention, the sixth processing module 110 includes:

The second decryption sub-module 111 is configured to decrypt the connection access request by using the private key of the access point detection platform to complete the integrity check of the information;

A search sub-module 112, configured to search for a list of legitimate access points through the registration information of the current WiFi access point;

The processing sub-module 113 is configured to decrypt the E _APs (Rc) with the public key of the current WiFi access point if a complete corresponding item is found, and compare whether the decryption result is the same as the received Rc, and if they are the same, obtain a successful authentication result.

In the foregoing embodiment of the present invention, when the current WiFi access point is a legitimate access point, the device further includes:

An encryption module 120, configured to encrypt the decrypted Rs with the public key of the current WiFi access point to obtain a second encrypted random number E _APp (Rs);

The second sending module 130 is configured to send the E _APp (Rs) and the authentication success result notification to the current WiFi access point.

In the above-mentioned embodiment of the present invention, the device further includes:

The first authentication module 140 is used to obtain the authentication failure result if the corresponding item is searched, but the decryption result is different from the received Rc;

The second authentication module 150 is configured to obtain an authentication failure result if no corresponding item is found.

In the WiFi access method according to the embodiment of the present invention, after the WiFi access point completes the registration authentication in the access point detection platform, the WiFi access point uses the preset private key to generate authentication information and sends it to the WiFi client, and the WiFi client will include The connection access request of authentication information is transparently transmitted to the access point detection platform through the WiFi access point, and the access point detection platform verifies the legitimacy of the WiFi access point, confirms the legal identity of the access point, and sends the verification result. The encryption is sent to the WiFi client, and the WiFi client accesses the legal access point according to the verification result. It can improve the security of WiFi verification, avoid malicious tampering of data information, prevent access to phishing WiFi access points, and realize secure WiFi access.

It should be noted that the WiFi access device provided by the embodiment of the present invention is a device applying the above method, and all the embodiments of the above method are applicable to the device, and can achieve the same or similar beneficial effects.

The above are the preferred embodiments of the present invention. It should be pointed out that for those skilled in the art, without departing from the principles of the present invention, several improvements and modifications can be made. It should be regarded as the protection scope of the present invention.

Claims (28)

1. A WiFi access method, applied to a WiFi access point, wherein the WiFi access method comprises: Send registration information to an access point detection platform for access point registration, and receive a successful registration result returned by the access point detection platform after checking the registration information; wherein the registration information includes access authentication related information and public key; Receive the connection verification request sent by the WiFi client, use the preset private key to generate authentication information and send it to the WiFi client, and forward the connection access request including the authentication information sent by the WiFi client to the access point detection platform; Receive an authentication success result notification fed back after the access point detection platform uses the public key in the registration information to legally authenticate the authentication information, and establish a WiFi connection with the WiFi client. 2 . The WiFi access method according to claim 1 , wherein when receiving a successful registration result returned by the access point detection platform after checking the registration information, the access point detection is simultaneously received. 3 . The address configuration of the platform, and the address of the access point detection platform is stored in a white list. 3. The WiFi access method according to claim 1, wherein the step of using a preset private key to generate authentication information and send it to the WiFi client comprises: generating an access point random number Rc, and encrypting the Rc with an access point private key to obtain a first encrypted random number E _APs (Rc), and the Rc and the E _APs (Rc) form the authentication information; Send the Rc and the E _APs (Rc) to the WiFi client, and the WiFi client obtains the registration information of the current access point according to the authentication information, the scan and the WiFi client The generated client random number Rs and the corresponding digest value of each part are encrypted with the detection platform public key to generate the connection access request. 4 . The WiFi access method according to claim 2 , wherein the forwarding of the connection access request including the authentication information sent by the WiFi client to the access point detection platform, specifically: 4 . : The connection access request is transparently transmitted to the access point detection platform according to the address of the access point detection platform stored in the whitelist. 5 . The WiFi access method according to claim 3 , wherein the receiving access point detection platform uses the public key in the registration information to perform legal authentication on the authentication information and feeds back an authentication success result notification. 5 . , establishing a WiFi connection with the WiFi client, specifically including: Receive the authentication success result notification, and simultaneously receive the second encrypted random number E _APp (Rs) sent by the access point detection platform, where the E _APp (Rs) is the encryption obtained by the access point detection platform. The resulting Rs is decrypted and then encrypted with the access point public key; Use the access point private key to decrypt the _EAPp (Rs) to obtain the Rs; Using the Rs and the Rc as factors, a key generation algorithm is used to generate a shared key Ks with the WiFi client and store it securely, establish a connection with the WiFi client, and realize the transmission of information. 6. A WiFi access method, applied to a WiFi client, wherein the access method comprises: Scan the WiFi access point list, and send a connection verification request to the first WiFi access point in the WiFi access point list; When the first WiFi access point is an access point successfully registered on the access point detection platform in advance, receiving authentication information generated by the first WiFi access point using a private key; sending a connection access request including the authentication information to the access point detection platform for legality authentication; Receive the legitimacy test result sent by the access point detection platform and forwarded by the first WiFi access point and signed by the private key of the access point detection platform, and establish access to the first WiFi connections between points. 7 . The WiFi access method according to claim 6 , wherein the connection access request is obtained by the WiFi client according to the authentication information, the registration information of the current access point by scanning, the WiFi access The client random number Rs generated by the client and the corresponding digest value of each part are generated by encrypting with the public key of the access point detection platform, and the authentication information includes the access point random number generated by the first WiFi access point Rc and the first encrypted random number E _APs (Rc) obtained by encrypting the Rc with the private key of the access point. 8 . The WiFi access method according to claim 7 , wherein the receiving and forwarded by the first WiFi access point sent by the access point detection platform and sent by the access point detection platform The validity check result signed by the private key of , establishes a connection with the first WiFi access point, specifically: After receiving the validity check result, use the received Rc and the generated Rs as factors to use a key generation algorithm to generate a shared key Ks with the first WiFi access point, store it securely, and establish The connection with the first WiFi access point realizes the transmission of information. 9. WiFi access method as claimed in claim 6, is characterized in that, described method also comprises: When the first WiFi access point is not an access point that has been successfully registered on the access point detection platform in advance, the WiFi client terminates the authentication process and prompts the user that the legality of the first WiFi access point cannot be determined. sex. 10. A WiFi access method, applied to an access point detection platform, wherein the WiFi access method comprises: Receive the registration information sent by a WiFi access point, check the current WiFi access point, store the registration information in the legal access point list after the verification is successful, and return the successful registration result to the current WiFi access point, Make the current WiFi access point use the preset private key to generate authentication information; receiving a connection access request including the authentication information sent by the WiFi client; According to the received connection access request, use the public key in the registration information to legally authenticate the authentication information, and send a notification of the successful authentication result to the current WiFi access point, so that the current WiFi access point establishes an the connection of the WiFi client described above. 11. The WiFi access method according to claim 10, wherein the authentication information comprises: an access point random number Rc and a first encrypted random number E obtained by encrypting the Rc with an access point private key _APs (Rc); the connection access request is the WiFi client according to the authentication information, the registration information of the current access point obtained by scanning, the client random number Rs generated by the WiFi client, and each Part of the corresponding digest value is generated after encryption with the public key of the access point detection platform. 12 . The WiFi access method according to claim 11 , wherein, according to the received connection access request, using the public key in the registration information to legally authenticate the authentication information, comprising: 12 . : Decrypt the connection access request by using the private key of the access point detection platform to complete the integrity check of the information; Search the list of legitimate access points through the registration information of the current WiFi access point; If the exact corresponding item is found, decrypt the E _APs (Rc) with the public key of the current WiFi access point, and compare whether the decryption result is the same as the received Rc. If they are the same, the authentication success result is obtained. 13. The WiFi access method according to claim 12, wherein when the current WiFi access point is a legitimate access point, the method further comprises: Encrypt the decrypted Rs with the public key of the current WiFi access point to obtain a second encrypted random number E _APp (Rs); The E _APp (Rs) and the authentication success result notification are sent to the current WiFi access point. 14. The WiFi access method according to claim 12, wherein the method further comprises: If the corresponding item is searched, but the decryption result is different from the received Rc, the authentication failure result is obtained; If no corresponding item is found, the authentication failure result is obtained. 15. A WiFi access device, applied to a WiFi access point, wherein the WiFi access device comprises: a first processing module, configured to send registration information to an access point detection platform for access point registration, and receive a successful registration result returned by the access point detection platform after checking the registration information; wherein the registration information Including access authentication related information and public key; The second processing module is configured to receive a connection verification request sent by the WiFi client, generate authentication information by using a preset private key and send it to the WiFi client, and access the connection containing the authentication information sent by the WiFi client. forwarding the request to the access point detection platform; The third processing module is configured to receive an authentication success result notification fed back after the access point detection platform uses the public key in the registration information to legally authenticate the authentication information, and establish a WiFi connection with the WiFi client. 16. The WiFi access device according to claim 15, wherein the WiFi access device further comprises: A receiving storage module, used for the first processing module to receive the address configuration of the access point detection platform when receiving the registration success result returned by the access point detection platform after checking the registration information, and to store the access point detection platform at the same time. The address of the access point detection platform is stored in a whitelist. 17. The WiFi access device according to claim 15, wherein the second processing module comprises: The generating submodule is used to generate the random number Rc of the access point, and encrypt the Rc with the private key of the access point to obtain the first encrypted random number E _APs (Rc), and the Rc and the E _APs (Rc) are composed of the authentication information; The first sending submodule is configured to send the Rc and the _EAPs (Rc) to the WiFi client, and the WiFi client scans the current access point according to the authentication information and the The registration information, the client random number Rs generated by the WiFi client, and the corresponding digest values of each part are encrypted with the public key of the detection platform to generate the connection access request. 18. The WiFi access device according to claim 16, wherein the second processing module is further configured to: The connection access request is transparently transmitted to the access point detection platform according to the address of the access point detection platform stored in the whitelist. 19. The WiFi access device according to claim 17, wherein the third processing module comprises: A receiving submodule, configured to receive the second encrypted random number E _APp (Rs) sent by the access point detection platform when receiving the authentication success result notification, where the E _APp (Rs) is the access point The detection platform is generated by decrypting the obtained encrypted Rs and then encrypting it with the access point public key; The first decryption submodule is used to decrypt the _EAPp (Rs) using the access point private key to obtain the Rs; The connection sub-module is configured to use the Rs and the Rc as factors to generate a shared key Ks with the WiFi client using a key generation algorithm and store it securely, establish a connection with the WiFi client, and implement information transmission. 20. A WiFi access device, applied to a WiFi client, wherein the access device comprises: a scanning and sending module, configured to scan the WiFi access point list, and send a connection verification request to the first WiFi access point in the WiFi access point list; a first receiving module, configured to receive authentication information generated by the first WiFi access point using a private key when the first WiFi access point is an access point successfully registered on the access point detection platform in advance; a first sending module, configured to send a connection access request including the authentication information to the access point detection platform for legality authentication; The fourth processing module is configured to receive the legitimacy test result sent by the access point detection platform and forwarded by the first WiFi access point and signed by the private key of the access point detection platform, and establish and connection between the first WiFi access points. 21 . The WiFi access device according to claim 20 , wherein the connection access request is obtained by the WiFi client according to the authentication information, the registration information of the current access point by scanning, and the WiFi access point. 21 . The client random number Rs generated by the client and the corresponding digest value of each part are generated by encrypting with the public key of the access point detection platform, and the authentication information includes the access point random number generated by the first WiFi access point Rc and the first encrypted random number E _APs (Rc) obtained by encrypting the Rc with the private key of the access point. 22. The WiFi access device according to claim 21, wherein the fourth processing module is further configured to: After receiving the validity check result, use the received Rc and the generated Rs as factors to use a key generation algorithm to generate a shared key Ks with the first WiFi access point, store it securely, and establish The connection with the first WiFi access point realizes the transmission of information. 23. The WiFi access device of claim 20, wherein the device further comprises: A termination module, configured to terminate the authentication process when the first WiFi access point is not an access point successfully registered on the access point detection platform in advance, and prompt the user that the legality of the first WiFi access point cannot be determined sex. 24. A WiFi access device, applied to an access point detection platform, wherein the WiFi access device comprises: The fifth processing module is used to receive the registration information sent by a WiFi access point, check the current WiFi access point, store the registration information in the list of legal access points after the verification is successful, and record the successful registration result Return the current WiFi access point, so that the current WiFi access point uses the preset private key to generate authentication information; a second receiving module, configured to receive a connection access request including the authentication information sent by the WiFi client; The sixth processing module is configured to use the public key in the registration information to legally authenticate the authentication information according to the received connection access request, and send a notification of a successful authentication result to the current WiFi access point, so that the current The WiFi access point establishes a connection with the WiFi client. 25. The WiFi access device according to claim 24, wherein the authentication information comprises: an access point random number Rc and a first encrypted random number E obtained by encrypting the Rc with an access point private key _APs (Rc); the connection access request is the WiFi client according to the authentication information, the registration information of the current access point obtained by scanning, the client random number Rs generated by the WiFi client, and each Part of the corresponding digest value is generated after encryption with the public key of the access point detection platform. 26. The WiFi access device according to claim 25, wherein the sixth processing module comprises: The second decryption submodule is used to decrypt the connection access request by using the private key of the access point detection platform to complete the integrity check of the information; The search submodule is used to search the list of legal access points through the registration information of the current WiFi access point; The processing sub-module is used to decrypt the E _APs (Rc) with the public key of the current WiFi access point if the exact corresponding item is found, and compare whether the decryption result is the same as the received Rc, and if they are the same, the authentication success result is obtained. 27. The WiFi access device according to claim 26, wherein when the current WiFi access point is a legitimate access point, the device further comprises: an encryption module for encrypting the decrypted Rs with the public key of the current WiFi access point to obtain a second encrypted random number E _APp (Rs); The second sending module is configured to send the E _APp (Rs) and the authentication success result notification to the current WiFi access point. 28. The WiFi access device of claim 26, wherein the device further comprises: The first authentication module is used to obtain the authentication failure result if the corresponding item is searched, but the decryption result is different from the received Rc; The second authentication module is used to obtain the authentication failure result if no corresponding item is found.

Images