CN111556503B - Personal WIFI hotspot management method based on Windows operating system - Google Patents

Abstract

The present invention discloses a personal WIFI hotspot management method based on Windows operating system. By reversing the WIFI module of Windows operating system, the execution process of WIFI hotspot request is analyzed, and effective management of terminal WIFI hotspot is realized through driver layer filtering technology. It includes generating a list of legal network hotspot information at the server end, setting the network hotspot information of the terminal computer at the server end, and monitoring the change of the network hotspot information of the terminal computer at the terminal computer. Since Windows operating system has no interface to manage WIFI hotspots, terminal users can privately connect to WIFI hotspots at will, which brings security risks and management problems to the network. This method solves the problem that network hotspots in large-scale local area networks cannot be managed by the server end through the remote unified planning of the terminal computer network hotspot list and the real-time monitoring of the terminal computer. It also solves the problem that the management of illegal hotspots is large in workload, low in efficiency, and cannot be automatically maintained, greatly improves work efficiency, reduces maintenance costs, and has a wide range of applications.

Description

A personal WIFI hotspot management method based on Windows operating system

Technical Field

The invention belongs to the technical field of computer network security management, and in particular relates to a personal WIFI hotspot management method based on Windows operating system.

Background technique

The terminal computer can privately connect to WIFI at will, which will bring security risks to the computer network and even cause network congestion. Therefore, it is necessary to effectively manage the WIFI hotspots in the computer network to ensure the safe and stable operation of the computer network. When the user network is large in scale, ensuring that the WIFI hotspots of a large number of terminal computers in the user network can be effectively managed requires a large amount of manpower to set up one by one, which is very inefficient, and the operation and maintenance costs are bound to increase. The present invention analyzes the execution process of the WIFI hotspot request by reversing the Windows operating system WIFI module, and realizes high reliability and high security management of the terminal WIFI through the driver layer filtering technology. In summary, in order to ensure that the WIFI hotspots in the computer network can be effectively managed, an efficient and secure WIFI hotspot management method is needed.

Summary of the invention

The main purpose of the present invention is to provide a personal WIFI hotspot management method based on Windows operating system, which fundamentally and effectively manages the behavior of terminal computer users privately connecting to WIFI, and can remotely plan the network hotspot information of all terminal computers in the computer network through a server.

In order to achieve the above object, the technical solution adopted by the present invention is as follows:

A personal WIFI hotspot management method based on Windows operating system, comprising the following steps:

a. The server generates a list of legal network hotspot information:

The server will plan all WIFI hotspot information in the network and generate a list of legal network hotspot information on the server;

b. The server sets the network hotspot information of the terminal computer:

The server sets a list of legal network hotspot information of terminal computers that need to be managed on the server;

The server notifies the terminal computer that needs to be managed according to the list of legal network hotspot information;

The terminal computer to be managed uses kernel layer API hooking technology to set the illegal WIFI hotspot of the terminal computer to be unable to connect;

c. The terminal computer monitors the changes of the network hotspot information of its terminal computer;

The managed terminal computer saves the legal network hotspot information list sent by the server to the legal SSID list of its terminal computer;

The managed terminal computers utilize kernel layer API hooking technology to monitor the changes of network hotspot information of the terminal computers in real time through the device IO control interface.

In the step c, the managed terminal computer uses the kernel layer API hooking technology to set a hook monitoring program to monitor the device IO control request of the terminal computer;

The managed terminal computer sets a hook monitoring program to monitor the device IO control request of its terminal computer in real time, including the following steps:

c1. If the managed terminal computer detects that its terminal computer has a request for device IO control, continue to execute step c2; if the managed terminal computer does not detect that its terminal computer has a request for device IO control, execute step c5;

c2. The managed terminal computer sets a hook monitoring program to obtain parameter information carried by the monitoring operation;

The parameter information carried by the monitoring operation includes a device IO request code, a device IO request input parameter, and a device IO request output parameter;

When the device IO request code in the parameter information carried by the monitoring operation is an NDIS_OID query request, the first 4 bytes of the input parameter are the request identifier, and the output parameter is an array of available SSIDs in the system;

c3. The managed terminal computer checks whether the IO request code in the parameter carried by the incoming monitoring operation is a WIFI hotspot management request;

If the managed terminal computer checks that the IO request code in the parameters carried by the incoming monitoring operation is equal to the NDIS_OID query request, and the first 4 bytes of the device IO request input parameter are equal to the system SSID predefined identifier, then this request is identified as a WIFI hotspot management request, and step c4 is continued; if the managed terminal computer checks that the IO request code in the parameters carried by the incoming monitoring operation is not equal to the NDIS_OID query request, then this request is not a WIFI hotspot management request, and step c5 is executed;

c4. Analyze and manage WIFI hotspot management requests;

The managed terminal computer sets a hook monitoring program to convert the device IO request output parameter in the parameter information carried by the terminal computer monitoring operation obtained into an SSID array, and cyclically compares each node in the SSID array. If the node SSID name in the SSID array is in the legal SSID list of the terminal computer, the next node in the SSID array is traversed; if the node SSID name in the SSID array is not in the legal SSID list of the terminal computer, the node in the SSID array is deleted;

c5. Return the parameter information carried by the monitoring operation, including the device IO request code, the device IO request input information parameters, and the device IO request output parameters, to the operating system;

The managed terminal computer monitors the device IO control request using the kernel API hooking technology and executes step c1.

The beneficial effects of the present invention are:

The personal WIFI hotspot management method based on Windows operating system of the present invention is applicable to Windows XP and above operating systems. Through reverse analysis of Windows operating system and kernel layer hooking, WIFI management function is developed. This technology has good versatility and is suitable for the management of mainstream personal portable WIFI devices on the market, filling the gap of WIFI management in Windows operating system. Blacklist and whitelist management of WIFI can be realized by this technology. Since it is realized by interception of driver layer device control interface, it has good device compatibility and system security.

BRIEF DESCRIPTION OF THE DRAWINGS

1 is a flow chart of a personal WIFI hotspot management method based on Windows operating system of the present invention;

2 is a flow chart of step c of the personal WIFI hotspot management method based on Windows operating system of the present invention;

FIG. 3 is a schematic diagram of the structure of the application environment of the embodiment of the present invention.

Detailed ways

The personal WIFI hotspot management method based on Windows operating system of the present invention is further described in detail below in conjunction with the drawings and embodiments.

The personal WIFI hotspot management method based on Windows operating system of the present invention can remotely and uniformly plan the network hotspot list of terminal computers through the server end, and adopts the method of real-time monitoring of terminal computers to solve the problem that network hotspots in large-scale local area networks cannot be managed, and the problem that the management of illegal hotspots is large in workload, low in efficiency, high in system resource occupation, and cannot be centrally and uniformly planned and automatically maintained, thereby greatly improving work efficiency, reducing operation and maintenance costs, and having a wide range of applications.

Example

For example, there are 100 terminal computers in a local area network, terminal computers PC1, PC2, ..., PC100, and a server computer (SERVER). The network hotspot information of the 100 terminal computers is managed and when there is a network hotspot control request, it is ensured that it is legal network hotspot information. The personal WIFI hotspot management method based on the Windows operating system of the present invention specifically includes the following steps:

a. The server generates a list of legal network hotspot information:

The server computer uniformly plans the WIFI hotspot information of all 100 terminal computers in the local area network, uniformly plans the legal network hotspot information of terminal computers PC1 to PC100 as TP-LINK_001 and TP-LINK_002, and stores the legal network hotspot information list of all 100 terminal computers on the terminal computer;

b. The server sets the network hotspot information of the terminal computer:

The server computer sets a list of legal network hotspot information of 100 terminal computers to be managed on the server computer, including legal network hotspot information of terminal computers PC1 to PC100 as P-LINK_001 and P-LINK_002;

The server computer notifies 100 terminal computers that need to be managed according to the legal network hotspot information list;

The 100 terminal computers that need to be managed use kernel layer API hooking technology to design illegal WIFI hotspots of the terminal computers to be unable to connect;

c. Managed terminal computers monitor changes in network hotspot information of their terminal computers;

The 100 managed terminal computers save the legal network hotspot information list sent by the server computer to the legal SSID list of each terminal computer;

The legal SSID list is P-LINK_001, P-LINK_002;

The managed terminal computer uses the kernel layer API hooking technology to monitor the changes of the network hotspot information of the terminal computer in real time through the device IO control interface. The specific working steps are as follows:

c1. In this embodiment, the managed terminal computer PC100 requests to connect to the non-office WIFI hotspot LINK_X, so the managed terminal computer PC100 can detect that there is a request for device IO control on its terminal computer, and continue to execute step c2; if the managed terminal computers PC1 to PC99 fail to detect that there is a request for device IO control on their terminal computers, execute step c5;

c2. The managed terminal computer PC100 sets a hook monitoring program to obtain parameter information carried by the monitoring operation, including the device IO request code 0x0012c804, the device IO request input parameter 0x8cd91200, and the device IO request output parameter 0x8cd91400;

According to the device IO request code 0x0012c804 in the parameter information carried by the monitoring operation of the managed terminal computer PC100, it can be judged that it is an NDIS_OID query request. Therefore, the first 4 bytes 0xD010217 of the device IO request input parameter in the parameter information carried by the monitoring operation of the managed terminal computer PC100 are the request identifier, and the device IO request output parameter is 0x8cd91400. The system can use the SSID array LINK_X, P-LINK_001, and P-LINK_002;

c3. The managed terminal computer PC100 checks that the device IO request code 0x0012c804 in the parameters carried by the incoming monitoring operation is equal to the NDIS_OID query request 0x0012c804, and the first 4 bytes 0xD010217 of its device IO request input parameter are equal to the system SSID predefined identifier 0xD010217, so the request of the managed terminal computer PC100 is identified as a WIFI hotspot management request, and step c4 is continued; (If the managed terminal computer PC100 checks that the device IO request code in the parameters carried by the incoming monitoring operation is not equal to the NDIS_OID query request, the request is identified as a non-WIFI hotspot management request, and step c5 is executed;)

c4. Analyze and manage WIFI hotspot management requests;

The managed terminal computer PC100 sets the hook monitoring program to convert the device IO request output parameter 0x8cd91400 in the parameter information carried by the terminal computer monitoring operation into the SSID array LINK_X, P-LINK_001, P-LINK_002, and cyclically compares each node LINK_X, P-LINK_001, P-LINK_002 in the SSID array. LINK_X is not in the SSID legal list, so the node is deleted. P-LINK_001 and P-LINK_002 are in the legal list, so they are retained.

c5. The managed terminal computer PC100 sets the hook monitoring program to return the parameter information carried by its monitoring operation, including the device IO request code 0x0012c804, the device IO request input information parameter 0x8cd91200, and the device IO request output parameter 0x8cd91400, to its operating system;

The managed terminal computer PC100 monitors the request for device IO control by using the kernel API hooking technology and executes step c1.

Claims (1)

1. A personal WIFI hotspot management method based on Windows operating system, comprising the following steps: a. The server generates a list of legal network hotspot information: The server will plan all WIFI hotspot information in the network and generate a list of legal network hotspot information on the server; b. The server sets the network hotspot information of the terminal computer: The server sets a list of legal network hotspot information of terminal computers that need to be managed on the server; The server notifies the terminal computer that needs to be managed according to the list of legal network hotspot information; The terminal computer to be managed uses kernel layer API hooking technology to set the illegal WIFI hotspot of the terminal computer to be unable to connect; c. The terminal computer monitors the changes of the network hotspot information of its terminal computer; The managed terminal computer saves the legal network hotspot information list sent by the server to the legal SSID list of its terminal computer; The managed terminal computers use kernel layer API hooking technology to monitor the changes of network hotspot information of the terminal computers in real time through the device IO control interface; The managed terminal computer uses the kernel layer API hooking technology to set a hook monitoring program to monitor the device IO control request of the terminal computer; The managed terminal computer sets a hook monitoring program to monitor the device IO control request of its terminal computer in real time, including the following steps: c1. If the managed terminal computer detects that its terminal computer has a request for device IO control, continue to execute step c2; if the managed terminal computer does not detect that its terminal computer has a request for device IO control, execute step c5; c2. The managed terminal computer sets a hook monitoring program to obtain parameter information carried by the monitoring operation; The parameter information carried by the monitoring operation includes a device IO request code, a device IO request input parameter, and a device IO request output parameter; When the device IO request code in the parameter information carried by the monitoring operation is an NDIS_OID query request, the first 4 bytes of the input parameter are the request identifier, and the output parameter is an array of available SSIDs in the system; c3. The managed terminal computer checks whether the IO request code in the parameter carried by the incoming monitoring operation is a WIFI hotspot management request; If the managed terminal computer checks that the IO request code in the parameters carried by the incoming monitoring operation is equal to the NDIS_OID query request, and the first 4 bytes of the device IO request input parameter are equal to the system SSID predefined identifier, then this request is identified as a WIFI hotspot management request, and step c4 is continued; if the managed terminal computer checks that the IO request code in the parameters carried by the incoming monitoring operation is not equal to the NDIS_OID query request, then this request is not a WIFI hotspot management request, and step c5 is executed; c4. Analyze and manage WIFI hotspot management requests; The managed terminal computer sets a hook monitoring program to convert the device IO request output parameter in the parameter information carried by the terminal computer monitoring operation obtained into an SSID array, and cyclically compares each node in the SSID array. If the node SSID name in the SSID array is in the legal SSID list of the terminal computer, the next node in the SSID array is traversed; if the node SSID name in the SSID array is not in the legal SSID list of the terminal computer, the node in the SSID array is deleted; c5. Return the parameter information carried by the monitoring operation, including the device IO request code, the device IO request input information parameters, and the device IO request output parameters, to the operating system; The managed terminal computer monitors the device IO control request using the kernel API hooking technology and executes step c1.