CN101431409B - Method for implementing secret communication in different wireless local area network - Google Patents

Abstract

The present invention relates to a method for realizing secure communication in different wireless local area networks, including: (1) Presetting identification information and a key management information table in the encryption device, and the key management information table is stored in each key management server (2) Install and run a dedicated driver program on the communication terminal; (3) The encryption device sends an authentication request to the wireless access point; (4) The wireless access point performs authentication according to the identification information contained in the authentication request. If the authentication is successful, it generates key distribution information, retrieves the corresponding key, sends the retrieved key to the wireless access point, and makes the encryption key The key distribution information is sent to the encryption device; (5) the encryption device receives the key distribution information, and uses the key distribution information to retrieve the corresponding key; (6) the wireless access point and the encryption device respectively use the obtained key Encrypt and decrypt the data transmitted in the wireless channel.

Description

A method that can realize secure communication in different wireless local area networks

【Technical field 】

The invention relates to a secure communication method between a communication terminal and a wireless access point in a wireless local area network, in particular to a method for realizing wireless access and secure communication of a communication terminal in different wireless local area networks by using an encryption device. the

【Background technique】

At present, the wireless access system of WLAN (Wireless Local Area Network, wireless local area network) is usually composed of a wireless network card, a wireless access point (AP, Access Point), a wireless access gateway (AG, Access Server) and a wireless access server ( AS, Access Server) and other parts. The more common networking method is to connect terminal devices such as computers and PDAs through wireless network cards, replacing the original wired network cards in the above devices, so as to realize wireless connections between terminal devices, terminal devices and wireless access points, and complete wireless channel communication. detection, selection, control and management, and can realize gain control of wireless reception, power control of transmitting end and other functions. the

Compared with wired transmission, the confidentiality of wireless transmission is poor, so some additional security measures are needed to ensure the communication security between the wireless access point and each communication terminal, such as user authentication, information encryption, etc. There are many existing encryption methods, which generally include software encryption and hardware encryption. Software encryption is to add a software module specially responsible for encryption and decryption in the application layer of the communication system. Since the encryption and decryption keys of this encryption method and the data appearing in the encryption and decryption process all appear in the memory of the machine, they are easy to be deciphered. In addition, due to the large amount of calculation of the encryption algorithm, the encryption and decryption process occupies a large amount of system resources and cannot be tolerated. Hardware encryption is to store the encryption cipher algorithm and key in dedicated hardware, which is connected to the communication terminal through the communication interface. The encryption and decryption process is to first transmit the data to the dedicated hardware through the communication interface, and then the hardware in the hardware Microprocessor to complete encryption and decryption. Although the above-mentioned hardware encryption fundamentally overcomes the shortcomings of the above-mentioned software encryption, if all the data to be encrypted and decrypted and all the processed data need to be transmitted between the communication terminal and the dedicated hardware through the communication interface, the transmission of the communication interface The speed will affect the transmission speed of the communication terminal in the wireless local area network, and the frequent data transmission between the communication terminal and the dedicated hardware will also occupy a large amount of system resources. the

The wireless LAN standard IEEE802.11 uses Wired Equivalent Privacy (WEP) technology to encrypt information. WEP is a symmetric encryption technology, that is, both encrypted communication parties use the same key for encryption and decryption. In practical applications, for security reasons, different users should use different keys. Usually, the key is distributed by the network administrator and stored in the two communication parties, that is, the communication terminal and the wireless access point (AP). This approach to key management has many drawbacks. First of all, in this key management mode, in order to support user roaming, each wireless access point (AP) should store all user keys, and every time a user's key is added or modified, the network manager must To add or modify the user's key on all wireless access points (APs), the task of key management is quite heavy, and the storage capacity of the wireless access points (APs) may not meet the requirements. In addition, since the key is stored in the user's communication terminal and wireless access point respectively, the key stored in the communication terminal is obviously insecure, which provides an opportunity for others to steal the key. the

【Content of invention】

The invention provides a method for realizing secure communication in different wireless local area networks. The technical problem to be solved is to prevent the communication terminal from participating in communication security processing, and realize its connection and transmission with different wireless local area networks by means of an external encryption device Encryption and decryption of data to effectively ensure communication security. the

The present invention relates to a method for realizing secure communication in different wireless local area networks. Multiple wireless access points (APs) are set, and each wireless access point belongs to multiple different key management servers. The method includes Following steps: (1) preset unique identification information and key management information table in the encryption device with wireless network card function, this key management information table stores all keys in each key management server, and can Retrieve the corresponding key according to the key distribution information; (2) connect the encryption device with the function of the wireless network card to the communication terminal and obtain power supply, install and run the special driver program for the wireless network card of the encryption device on the communication terminal; (3) Utilize the wireless network card function of encrypting device to set up the wireless channel with wireless access point, and encrypting device sends to wireless access point the authentication request that comprises identification information; Perform authentication, if the authentication is successful, the key management server generates key distribution information, retrieves the corresponding key according to the key distribution information, sends the retrieved key to the wireless access point, and makes the generated The key distribution information is sent to the encryption device through the wireless access point; (5) The wireless access point directly receives the key from the authentication device, and the encryption device receives the key distribution information, and uses the key distribution information in the key management information The corresponding key is retrieved from the table; (6) The wireless access point and the encryption device respectively use the obtained key to encrypt and decrypt the data transmitted in the wireless channel. the

In the aforementioned method for realizing secure communication in different wireless local area networks, different business group information is set in each of the wireless access points; a key database for storing keys is set in the key management server, In addition, the same key database as each key management server and the service group information of each wireless access point are stored in the key management information table, and the service group information is established and encrypted according to the key management server to which the wireless access point belongs. Key database correspondence; the encryption device obtains the service group information of the connected wireless access point through the wireless channel established with the wireless access point, and makes the encryption device search for the key in the key database corresponding to the service group information. The key corresponding to the distribution information. the

In the foregoing method for realizing secure communication in different wireless local area networks, the service group information is the service group identifier of the wireless access point. the

In the foregoing method for realizing secure communication in different wireless local area networks, after the encryption device authenticates the wireless access point successfully, the wireless access point sends the service group information of the wireless access point to the encryption device. the

In the aforementioned method for realizing secure communication in different wireless local area networks, the communication terminal outputs the data sent to the wireless local area network to the encryption device through the communication interface module, and the encryption device encrypts the data to the wireless interface through the wireless local area network module. The access point sends: the encryption device receives the encrypted data sent by the wireless access point through the wireless local area network module, and outputs the encrypted data to the communication terminal through the communication interface module after decrypting the data. the

Aforesaid method that can realize confidential communication in different wireless local area networks, described communication interface module is for USB interface module, SATA interface module, ISA interface module, PCI interface module or PCMCIA interface module. the

In the aforementioned method for realizing secure communication in different wireless local area networks, the encryption device obtains power supply through the electrical connection between the power terminal provided in the communication interface module and the power output terminal of the communication terminal. the

As mentioned above, the method for realizing secure communication in different wireless local area networks in the present invention has the following beneficial effects:

The method of the present invention that can realize secure communication in different wireless local area networks is to realize the wireless connection between the communication terminal and the wireless access point through the connection between the external encryption device and the communication terminal, and the data transmitted between the communication terminal and the wireless local area network are encrypted. The device receives and sends, and avoids the encryption and decryption work to be completed in the communication terminal, thus, the security of wireless communication can be guaranteed, and the data security has also been significantly improved, and the encryption device can be used to complete the wireless communication. Encryption and decryption work, greatly saving system resources. More importantly, by connecting the encryption device and installing the driver program, more communication terminals can be more conveniently connected to the wireless local area network. the

The communication method of the present invention does not need the key distribution process from the wireless access point to the communication terminal, but distributes the key through the key management server, and then sends the distributed key to the wireless access point, and sends the key distribution information Send it to the encryption device, the encryption device retrieves the corresponding key, and uses the encryption device's confidentiality function for the stored information to effectively guarantee the security of the encryption key and the key generation algorithm, thereby ensuring communication security. the

The present invention utilizes the encryption device's function of confidentially storing data to securely store the keys stored in the key management servers of multiple wireless local area networks, so that communication terminal users can roam across areas larger than the coverage of the key management servers , In addition, because the wireless access point does not need to manage user information, the structure of the wireless access point is simplified and the cost is reduced. the

【Description of drawings】

Fig. 1 is a structural block diagram of an encryption device of the present invention. the

Fig. 2 is a schematic diagram of a method for realizing secure communication in different wireless local area networks according to the present invention. the

【Detailed ways】

In order to further illustrate the technical means and functions adopted by the present invention to achieve the intended purpose, the detailed description is as follows in conjunction with the accompanying drawings and embodiments. the

Please refer to shown in Fig. 1, it is the structural block diagram of encryption device of the present invention, and this encryption device comprises:

Microprocessor module: responsible for data calculation, by calling the data and programs in the data storage module and program storage module, to perform encryption and decryption operations, to complete the encryption and decryption of the information transmitted in the communication, and to prepare to send it through the wireless LAN module The data is encrypted, and the data obtained through the wireless LAN module is decrypted. the

Program storage module: connected with the microprocessor module, it mainly stores encryption and integrity protection algorithms, which can be stored in the form of ciphertext. After power-on, it is loaded into the cryptographic arithmetic unit, and the ciphertext is decrypted and restored to run again. the

Data storage module: used to securely store all master keys and key pairs of asymmetric encryption algorithms in multiple key management servers. The storage module is transferred into the microprocessor module to participate in calculation. the

Communication interface module: connected to the microprocessor module through a data line, used to connect with a terminal requiring encryption (that is, a communication terminal). the

Wireless local area network module: connected with the microprocessor module, used to establish the connection between the wireless local area network and the microprocessor. The microprocessor module sends the encrypted data through the wireless local area network module and receives it from the wireless local area network. After the data is decrypted, it is transmitted to the communication terminal through the communication interface module. the

The above-mentioned communication interface module is preferably a USB interface module. Since the USB interface is plug-and-play and supports very high data transmission rates, it is not only convenient for communication terminals that are not equipped with wireless network cards to be connected to wireless LANs, but also has a high transmission speed. The advantages of high and communication security. the

Specifically, the above-mentioned wireless local area network module includes a baseband unit and an RF unit, and the baseband unit modulates/demodulates the data of the microprocessor module; the RF unit processes the data of the baseband unit into high-frequency signals for Transmit, also receive and process high frequency signals. The above-mentioned microprocessor module also has a RAM module for accessing input and output data, intermediate calculation results, data exchanged with external memory, and temporary storage data. the

For security needs, it is possible to update and manage the key, and it is also possible to update the cryptographic algorithm. Therefore, the microprocessor module also includes a key management module responsible for updating and managing the key and responsible for An algorithm management module for updating and managing encryption algorithms. the

Please refer to shown in accompanying drawing 2, be the flowchart of the method that can realize secure communication in different wireless local area networks of the present invention. Each wireless local area network is provided with a wireless access point (AP), each wireless access point is managed by a key management server, and multiple wireless access points are managed by multiple different key management servers. The method that the present invention can realize secure communication in different wireless local area networks comprises the following steps:

(1) Preset unique identification information and key management information table in the encryption device with wireless network card function, the key management information table stores all the keys in each key management server, and can press the key Assign information to retrieve the corresponding key;

(2) Connect the encryption device with wireless network card function to the communication terminal and obtain power supply, install and run the special driver program for the wireless network card of the encryption device on the communication terminal;

(3) The wireless network card function of the encryption device establishes a wireless channel with the wireless access point, and the encryption device sends an authentication request including identification information to the wireless access point;

(4) The wireless access point authenticates the encryption device according to the identification information contained in the authentication request. If the authentication is successful, the key management server generates key distribution information, and retrieves the corresponding key according to the key distribution information, and sends The retrieved key is sent to the wireless access point, and the generated key distribution information is sent to the encryption device through the wireless access point;

(5) The wireless access point directly receives the key from the authentication device, and the encryption device receives the key distribution information, and uses the key distribution information to retrieve the corresponding key in the key management information table;

(6) The wireless access point and the encryption device respectively use the obtained key to encrypt and decrypt the data transmitted in the wireless channel. the

In the above steps, each wireless access point should be set with different business group information that can represent its identity; a key database for storing keys is set in the key management server, and stored in the key management information table. Each key management server has the same key database and business group information of each wireless access point, and establishes a corresponding relationship between the business group information and the key database according to the key management server to which the wireless access point belongs; the encryption device communicates with the wireless The wireless channel established by the access point obtains the service group information of the connected wireless access point, and enables the encryption device to search for the key corresponding to the key distribution information in the key database corresponding to the service group information. The above service group information is the service group identifier of the wireless access point. the

The wireless access point may send the service group information of the wireless access point to the encryption device after the encryption device successfully authenticates the wireless access point. the

Specifically, in the above step (6), the communication terminal outputs the data sent to the wireless local area network to the encryption device through the communication interface module, and the encryption device encrypts the data and sends it to the wireless access point through the wireless local area network module; The encryption device described above receives the encrypted data sent by the wireless access point through the wireless local area network module, and outputs the encrypted data to the communication terminal through the communication interface module after decrypting the data. the

The communication interface module mentioned above is a USB interface module, a SATA interface module, an ISA interface module, a PCI interface module, or a PCMCIA interface module. The encryption device obtains power supply through the electrical connection between the power terminal provided in the communication interface module and the power output terminal of the communication terminal. the

Claims (7)

1. the method that can realize secure communication in different wireless local area network is provided with a plurality of WAP (wireless access point) (AP), and each WAP (wireless access point) belongs to a plurality of different Key Management servers, it is characterized in that said method comprising the steps of:

(1) preset unique identification information and key management information table in having the encryption device of wireless network card function, this key management information table stores the whole keys in each Key Management server, and can transfer corresponding key by encryption key distribution information;

(2) encryption device with wireless network card function is connected with communication terminal and obtains power supply, on communication terminal, install and the wireless network card specific drivers of operation encryption device;

(3) utilize the wireless network card function foundation of encryption device and the wireless channel of WAP (wireless access point), encryption device sends the authentication request that comprises identification information to WAP (wireless access point);

(4) WAP (wireless access point) authenticates encryption device according to the identification information that comprises in the authentication request, if authentication success, then Key Management server generates encryption key distribution information, transfer corresponding key according to this encryption key distribution information, this key of transferring is sent to WAP (wireless access point), and make the encryption key distribution information of this generation be sent to encryption device through WAP (wireless access point);

(5) WAP (wireless access point) directly receives key from authenticate device, and encryption device receives encryption key distribution information, and utilizes this encryption key distribution information to transfer corresponding key in the key management information table;

(6) WAP (wireless access point) and encryption device use respectively the key that obtained to the data of in wireless channel, transmitting encrypt, decryption processing.

2. the method that can realize secure communication in different wireless local area network according to claim 1 is characterized in that being provided with different service groups information in each described WAP (wireless access point); Be provided with the key database of storage key in the described Key Management server, and in the key management information table, store the key database identical and the service groups information of each WAP (wireless access point), and set up the corresponding relation of service groups information and key database according to the Key Management server under the WAP (wireless access point) with each Key Management server; Encryption device is by knowing the service groups information of the WAP (wireless access point) that is connected with the wireless channel that WAP (wireless access point) is set up, and makes encryption device search the key corresponding with encryption key distribution information in the key database corresponding with this service groups information.

3. the method that can realize secure communication in different wireless local area network according to claim 2 is characterized in that the service set identifier of described service groups information for this WAP (wireless access point).

4. the method that can realize secure communication in different wireless local area network according to claim 2 is characterized in that at encryption device that behind the authentication success of WAP (wireless access point) WAP (wireless access point) sends the service groups information of this WAP (wireless access point) to encryption device.

5. the method that can in different wireless local area network, realize secure communication according to claim 1, it is characterized in that described communication terminal will export encryption device to by the communication interface modules that encryption device comprised to the data that WLAN (wireless local area network) sends, this encryption device sends to WAP (wireless access point) by the Wireless LAN module that self comprised after with this data encryption; Described encryption device receives the enciphered data that WAP (wireless access point) sends by described Wireless LAN module, and this enciphered data deciphering back is being exported to communication terminal by communication interface modules.

6. the method that can realize secure communication in different wireless local area network according to claim 5 is characterized in that described communication interface modules is to be usb interface module, SATA interface module, ISA interface module, pci interface module or pcmcia interface module.

7. the method that can in different wireless local area network, realize secure communication according to claim 5, it is characterized in that of the electric connection of described encryption device by the power output terminal of the power supply terminal that is provided with in the described communication interface modules and communication terminal, thus the power supply that obtains.

Images