WO2016184351A1

WO2016184351A1 - Ip address allocation method and system for wireless network

Info

Publication number: WO2016184351A1
Application number: PCT/CN2016/081952
Authority: WO
Inventors: 朴云
Original assignee: 阿里巴巴集团控股有限公司
Priority date: 2015-05-21
Filing date: 2016-05-13
Publication date: 2016-11-24
Also published as: CN106304400A; CN106304400B

Abstract

Proposed are an IP address allocation method and system for a wireless network. The method comprises: generating an authenticator random number and sending same to a client; receiving a client random number of the client, MIC and DHCP request information which are sent by the client; checking the MIC, determining response information about the DHCP request information, and sending whether to install an encryption/integration key and response information to the client; and receiving determination information sent by the client, so as to complete sharing key authentication with the client, and according to an IP address, conducting communication with the client. By means of the IP address allocation method for a wireless network in the embodiments of the present invention, the time needed for the client to access or switch a wireless network is reduced, further, the time for the client to affect an application layer when the client accesses or switches the wireless networks is reduced.

Description

Wireless network IP address allocation method and system

The present application claims priority to Chinese Patent Application Serial No. No. No. No. No. No. No. No. No. No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No

Technical field

The present invention relates to the field of wireless communication technologies, and in particular, to a method, a system, an authentication end, and a client for allocating an IP address of a wireless network.

Background technique

In wireless networks such as Wi-Fi (Wireless-Fidelity), for security and convenience, WPA (Pre-shared key)-based WPA (Wi-Fi Protected Access) is generally used to protect wireless networks. Security system).

However, when accessing such a wireless network, the authentication end, such as a wireless access point AP (Wireless Access Point) and a client, such as a station station, pass EAPOL-key (EAP (Extensible Authentication Protocol)). Over LAN (Local Area Network) key) The four-way handshake of the packet is used for authentication and key negotiation. After the key negotiation is successful, if the client sets the dynamic IP acquisition mode, it needs to pass DHCP (Dynamic). Host Configuration Protocol, which obtains or renews the last used IP address. A related problem of the related art is that when a client accesses a wireless network or switches a wireless network, IP address acquisition or renewal is started only after the connection of the wireless link layer, and it takes a long time to establish an effective network.

Summary of the invention

The present invention aims to solve at least one of the technical problems in the related art to some extent.

To this end, a first object of the present invention is to provide an IP address allocation method for a wireless network. This approach reduces the time it takes for the client to access or switch to the wireless network.

A second object of the present invention is to provide an IP address allocation system for a wireless network.

A third object of the present invention is to provide an authentication terminal.

A fourth object of the present invention is to propose a client.

In order to achieve the above object, a method for allocating an IP address of a wireless network according to an embodiment of the present invention includes: Generating an authentication end random number and sending it to the client; receiving a client random number sent by the client, a message integrity check code MIC, and dynamic host configuration protocol DHCP request information, where the client generates the client a random number, and generating a temporary pairwise key PTK according to the authentication end random number, the client random number, the paired master key PMK, the authentication end attribute information, and the client attribute information; And generating, by the client random number, the paired master key PMK, the authentication end attribute information, and the client attribute information, the temporary pair key PTK, and verifying the MIC, and Determining response information of the DHCP request information, and sending, to the client, whether to install an encryption/global key and the response information, so that the client installs an encryption/global key and according to the response information Determining an IP address; receiving the determination information sent by the client to complete shared key authentication with the client, and communicating with the client according to the IP address.

The IP address allocation method of the wireless network in the embodiment of the present invention completes the application or renewal of the client IP address while the client performs the four-way handshake, so that the application can be applied after the shared key authentication of the wireless link connection is established. Or renew the IP address, that is, as long as the shared-key authentication of the wireless link connection is established, the upper-layer application can start to send and receive data, no need to apply or renew the IP address, thereby reducing the client connection. The time required to enter or switch the wireless network further reduces the impact time on the application layer when the client accesses or switches the wireless network.

In order to achieve the above object, an IP address allocation system for a wireless network according to an embodiment of the present invention includes: an authentication end and a client, where the authentication end is configured to generate an authentication end random number and send the same to the client. The client is configured to generate a client random number, and generate a temporary pair according to the authentication end random number, the client random number, the paired master key PMK, the authentication end attribute information, and the client attribute information. Key PTK, and sending the client random number, the message integrity check code MIC, and the dynamic host configuration protocol DHCP request information to the authentication end; the authentication end is further configured to use the authentication terminal random number, Generating the temporary pairwise key PTK by the client random number, the paired master key PMK, the authentication end attribute information, and the client attribute information, and verifying the MIC and determining The response information of the DHCP request information, and sending, to the client, whether to install an encryption/global key and the response information; the client is further configured to install an encryption/global key and according to the A determine the IP address information, and transmits the determined information to the verifier to complete the shared key authentication and authentication of the client terminal, and communicate according to the IP address and the terminal authentication.

The IP address allocation system of the wireless network in the embodiment of the present invention completes the application or renewal of the client IP address while the authentication end and the client perform the four-way handshake, so as long as the shared key authentication of the wireless link connection is established. You can apply for or renew your IP address. That is, as long as the shared-layer authentication of the wireless link connection is established, the upper-layer application can start to send and receive data without having to apply or renew the IP address. Client The time required to access or switch the wireless network further reduces the impact time on the application layer when the client accesses or switches the wireless network.

The authentication end of the third aspect of the present invention includes: a first generation module, configured to generate an authentication end random number; and a first sending module, configured to send the authentication end random number to the client; a first receiving module, configured to receive a client random number, a message integrity check code MIC, and dynamic host configuration protocol DHCP request information sent by the client, where the client generates the client random number, and Generating a temporary pairwise key PTK according to the authentication end random number, the client random number, the paired master key PMK, the authentication end attribute information, and the client attribute message; and the second generating module is configured to perform the authentication according to the authentication a temporary random number, the client random number, the paired master key PMK, the authentication end attribute information, and the client attribute information to generate the temporary pair key PTK; a verification module, configured to The MIC performs verification; the confirmation module is configured to determine response information of the DHCP request information; and the second sending module is configured to send, to the client, whether to install an encryption/global key and the response And the second receiving module is configured to receive the determining information sent by the client to complete the sharing with the client. Key authentication and communication with the client based on the IP address.

The authentication end of the embodiment of the present invention receives the DHCP request information while receiving the client random number and the MIC sent by the client, and sends the response information of the DHCP request information while sending the encryption/integration key, so that The authentication end and the client perform the four-way handshake to complete the application or renewal of the client IP address, thereby reducing the time required for the client to access or switch the wireless network, and further reducing the client access or switching. The impact time on the application layer when the wireless network.

In order to achieve the above object, the client of the fourth aspect of the present invention includes: a first receiving module, configured to receive an authentication end random number sent by the authentication end; a first generating module, configured to generate a client random number; a generating module, configured to generate a temporary pairwise key PTK according to the authentication end random number, the client random number, the paired master key PMK, the authentication end attribute information, and the client attribute information; the first sending module uses And sending the client random number, the message integrity check code MIC, and the dynamic host configuration protocol DHCP request information to the authentication end; and the second receiving module is configured to receive whether the encryption end is installed by the authentication end. And a response information of the DHCP request information to install an encryption/global key and determine an IP address according to the response information; a second sending module, configured to send the determining information to the authentication end to complete the The authentication end and the client share the shared key authentication, and communicate with the authentication end according to the IP address.

The client in the embodiment of the present invention sends the DHCP request information while transmitting the client random number and the MIC, and receives the response information of the DHCP request information while receiving the encryption/integration key, so that the acknowledgement is made. The client and the client perform the four-way handshake to complete the application or renewal of the client IP address, thereby reducing the time required for the client to access or switch the wireless network, and further reducing the client access or switching. The impact time on the application layer when the wireless network.

The additional aspects and advantages of the invention will be set forth in part in the description which follows.

DRAWINGS

The above and/or additional aspects and advantages of the present invention will become apparent and readily understood from

1 is a flow chart of a method for allocating an IP address of a wireless network according to an embodiment of the present invention;

2 is a flow chart of a four-way handshake in accordance with one embodiment of the present invention;

3 is a structural block diagram of an IP address allocation system of a wireless network according to an embodiment of the present invention;

4 is a structural block diagram of an authentication end according to an embodiment of the present invention;

FIG. 5 is a structural block diagram of a client according to an embodiment of the present invention.

detailed description

The embodiments of the present invention are described in detail below, and the examples of the embodiments are illustrated in the drawings, wherein the same or similar reference numerals are used to refer to the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are intended to be illustrative of the invention and are not to be construed as limiting. Rather, the invention is to cover all modifications, modifications and equivalents within the spirit and scope of the appended claims.

In the description of the present invention, it should be noted that the terms "connected" and "connected" are to be understood broadly, and may be, for example, a fixed connection, a detachable connection, or an integral, unless otherwise explicitly defined and defined. Ground connection; it can be mechanical connection or electrical connection; it can be directly connected or indirectly connected through an intermediate medium. The specific meaning of the above terms in the present invention can be understood in a specific case by those skilled in the art. Further, in the description of the present invention, the meaning of "a plurality" is two or more unless otherwise specified.

Any process or method description in the flowcharts or otherwise described herein may be understood to represent a module, segment or portion of code that includes one or more executable instructions for implementing the steps of a particular logical function or process. And the scope of the preferred embodiments of the invention includes additional implementations, in which the functions may be performed in a substantially simultaneous manner or in an opposite order depending on the functions involved, in the order shown or discussed. Be It will be understood by those skilled in the art to which the embodiments of the present invention pertain.

In the related art, in order to ensure the security of wireless communication, when establishing a wireless link connection between the authentication end and the client, the shared key authentication between the authentication end and the client is first performed, and the client re-applies after the shared key authentication. Or renew the IP address, according to the IP address of the application or renewal, the data can be forwarded and received between the authentication end and the client. However, this process causes the wireless link to be connected when the client accesses or switches the wireless network. It takes a long time. The shared key authentication between the authentication end and the client is implemented by a four-way handshake. If the IP address can be applied or renewed at the same time as the four-way handshake, the application or renewal of the IP address can be saved. Based on such a concept, the present invention provides a method, a system, an authentication end, and a client for assigning an IP address of a wireless network, and the time required for the wireless link to be connected when the client accesses or switches the wireless network is reduced. A detailed description will be made below with reference to the drawings.

1 is a flow chart of a method for allocating an IP address of a wireless network according to an embodiment of the present invention, and FIG. 2 is a flow chart of a four-way handshake according to an embodiment of the present invention. The IP address allocation method of the wireless network according to the embodiment of the present invention will be described below with reference to FIG. 1 and FIG.

As shown in FIG. 1, the IP address allocation method of the wireless network includes:

S101. The authentication end generates an authentication end random number ANonce (Authenticator Nonce) and sends it to the client. The authentication end may be a wireless access point (AP, Wireless Access Point), a wireless router, etc.; the client may be a station, a mobile device, a wireless device, or the like. That is to say, the authentication end and the client are devices arranged in the wireless network, and the authentication end is responsible for the identity authentication of the client and communicates with the client. The specific device of the authentication end and the client is not limited in the embodiment of the present invention.

Specifically, the authentication end random number is a value that is used only once by the authentication end, and the type may include at least one of a timestamp, a large random number, and a serial number. The authentication end is the authenticator, and the client is the applicant. The authentication end first broadcasts the authentication end random number within the wireless network to enable the client in the wireless network range to receive the authentication end random number.

As shown in Figure 2, the authentication end sends the authentication end random number to the client, that is, the authentication end and the client perform the first handshake. That is, the authentication end sends a message 1 to the client, and the message 1 includes the authentication end generation. The authentication end random number.

In an embodiment of the present invention, the authentication end and the client perform data transmission through an EAPOL-KEY (Extensible Authentication Protocol) over LAN (Local Area Network) packet. During the first handshake, the authentication end sends an EAPOL-KEY packet carrying the authentication terminal random number to the client.

S102: The authentication end receives the client random number sent by the client, and the MIC (Message Integrity Code, message) Integrity check code) and DHCP (Dynamic Host Configuration Protocol) request information, wherein the client generates a client random number, and according to the authentication end random number, the client random number, the PMK (Pairwise Master Key, The pairwise master key), the authentication end attribute information, and the client attribute information generate a PTK (Pairwise Transient Key). In addition, the authentication end attribute information and the client side attribute information may be information uniquely indicating the corresponding device, for example, a device unique identifier, a MAC (Media Access Control) address, and the like.

Specifically, after obtaining the authentication end random number sent by the authentication end, the client generates a client random number SNoplic (Supplicant Nonce), and the client random number is a value that the client uses only once, and the type may include a timestamp, a large random number, and At least one of a serial number and the like. Then, the client generates a PTK according to the authentication end random number, the client random number, the PMK, the authentication end attribute information, and the client attribute information, thereby implementing the PTK update of the client. Then, as shown in FIG. 2, the client sends the client random number, MIC, and DHCP request information to the authentication end, that is, the client and the authentication end perform a second handshake, that is, the client sends a message to the authentication terminal. The message 2 includes the client-side random number, MIC, and DHCP request information generated by the client, and the authentication terminal receives the message 2.

Similarly, in one embodiment of the invention, the client adds the client random number, MIC, and DHCP request information to the EAPOL-KEY packet and sends it to the authentication terminal.

S103. The authentication end generates a PTK according to the authentication end random number, the client random number, the PMK, the authentication end attribute information, and the client attribute information, and checks the MIC, determines the response information of the DHCP request information, and sends the response information to the client. Whether to install the encryption/global key and response information so that the client installs the encryption/global key and determines the IP address based on the response information.

Specifically, after receiving the message 2, the authentication end obtains the client random number generated by the client, and generates a PTK according to the authentication end random number, the client random number, the PMK, the authentication end attribute information, and the client attribute information, thereby authenticating End the PTK update.

In an embodiment of the present invention, after the authentication end completes the update of the PTK, the method for allocating the IP address of the wireless network further includes: the authentication end forwards the DHCP request information to the DHCP server; and the authentication end receives the response information fed back by the DHCP server. Specifically, as shown in FIG. 2, the client adds the DHCP request information to the message 2 of the second handshake, and the authentication end forwards the received DHCP request information to the DHCP server for processing, and obtains the processing result of the DHCP server. Usually, if the authentication end is a home router, this DHCP server is the authentication end itself.

After obtaining the response information, the authentication end sends the response information and the group temporary key GTK (Group Transient Key) to the client. As shown in Figure 2, the authentication end and the client perform a third handshake, that is, sending a message 3 to the client. The message 3 includes response information and GTK to cause the client to determine whether to install an encryption/global key. Similarly, in one embodiment of the invention, the authentication end adds the response information and GTK to the EAPOL-KEY packet and sends it to the client.

S104. The authentication end receives the determination information sent by the client to complete the shared key authentication of the wireless access point and the client, and communicates with the client according to the IP address.

Specifically, the client and the non-authentication end perform the fourth handshake, and after the client sends the information to the authentication end, the client determines that the shared key authentication of the authentication end and the client is completed, to confirm the result of the four-way handshake, and also The IP address of the client is determined based on the response information.

The IP address allocation method of the wireless network in the embodiment of the present invention completes the application or renewal of the client IP address while the authentication end and the client perform the four-way handshake, so as long as the shared key authentication of the wireless link connection is established. You can apply for or renew your IP address. That is, as long as the shared-layer authentication of the wireless link connection is established, the upper-layer application can start to send and receive data without having to apply or renew the IP address. The time required for the client to access or switch the wireless network further reduces the impact on the application layer when the client accesses or switches the wireless network.

In one embodiment of the invention, the request information and the reply message are respectively added to the EAPOL-KEY packet as an extension of the key data KEY data in the vendor specific information element VSIE format. Specifically, the four-way handshake and the EAPOL-KEY packet may refer to related protocols such as 802.11, and the VSIE format may also refer to related protocols such as 802.11, and details are not described herein again.

In one embodiment of the invention, the request information and the reply message respectively omit the sname and file fields. Thereby, the length of the VSIE formed by the DHCP request information and the DHCP response information is reduced, and the sname and file fields of the DHCP request information are omitted in the transmission process, and the receiving side (ie, the authentication end) processes the two fields as 0 by default. deal with.

In one embodiment of the invention, the request information and the response message are respectively encrypted with an EAPOL-KEY Encryption Key KEK (EAPOL-Key Encryption Key). This ensures safety.

In order to implement the above embodiments, an embodiment of the present invention also proposes an IP address allocation system for a wireless network.

3 is a structural block diagram of an IP address allocation system of a wireless network according to an embodiment of the present invention. As shown in FIG. 3, the IP address allocation system of the wireless network includes an authentication end 10 and a client 20.

Specifically, the authentication end 10 is configured to generate an authentication end random number and send it to the client 20. The authentication end random number is a value that the authentication end 10 uses only once, and the type may include at least one of a time stamp, a large random number, and a serial number. The authentication terminal 10 is an authenticator, the client 20 is an applicant, and the authentication terminal 10 first broadcasts within the wireless network. The authentication end random number is such that the client 20 in the wireless network can receive the authentication terminal random number

As shown in FIG. 2, the authentication end 10 sends the authentication end random number to the client 20, that is, the authentication end 10 and the client 20 perform the first handshake, that is, the authentication end 10 sends a message 1 to the client 20, and the message is sent. 1 includes an authentication end random number generated by the authentication terminal 10.

In one embodiment of the invention, the authentication terminal 10 and the client 20 perform data transmission via the EAPOL-KEY packet. That is, at the first handshake, the authentication end 10 sends an EAPOL-KEY packet carrying the authentication terminal random number to the client 20.

The client 20 is configured to generate a client random number, and generate a PTK according to the authentication end random number, the client random number, the PMK, the authentication end, and the client attribute information, and send the client random number, the MIC, and the DHCP request information to the authentication end. 10. First, after obtaining the authentication end random number sent by the authentication end 10, the client 20 generates a client random number, and the client random number is a value used by the client 20 only once, and the type may include a timestamp, a large random number, a serial number, and the like. At least one of them. Then, the client 20 generates a PTK according to the authentication end random number, the client random number, the PMK, the authentication end attribute information, and the client attribute information, thereby implementing the PTK update of the client. Then, as shown in FIG. 2, the client 20 sends the client random number, MIC, and DHCP request information to the authentication terminal 10, that is, the client 20 and the authentication terminal 10 perform a second handshake, that is, the client 20 The authentication terminal 10 sends a message 2, which includes the client random number, MIC and DHCP request information generated by the client 20, and the authentication terminal 10 receives the message 2.

Likewise, in one embodiment of the invention, client 20 adds the client random number, MIC, and DHCP request information to the EAPOL-KEY packet and sends it to the authentication terminal 10.

The authentication terminal 10 is further configured to generate a PTK according to the authentication end random number, the client random number, the PMK, the authentication end attribute information, and the client attribute information, check the MIC, determine the response information of the DHCP request information, and provide the client with the response information. End 20 sends whether to install the encryption/global key and response information. More specifically, after receiving the message 2, the authentication end 10 obtains the client random number generated by the client 20, and generates a PTK according to the authentication end random number, the client random number, the PMK, the authentication end attribute information, and the client attribute information. Thus, the authentication terminal 10 completes the update of the PTK. The authentication terminal 10 transmits the response information and the GTK to the client 20 after obtaining the response information. As shown in FIG. 2, the authentication end 10 and the client 20 perform a third handshake, that is, send a message 3 to the client 20, and the message 3 includes response information and GTK, so that the client 20 determines whether to install encryption/holisticity. Key. Likewise, in one embodiment of the invention, the authentication terminal 10 adds the response information and GTK to the EAPOL-KEY packet and sends it to the client 20.

The client 30 is further configured to install an encryption/integration key and determine an IP address according to the response information, and send the determination information to the authentication terminal 10 to complete the shared key authentication of the authentication terminal 10 and the client 20, and according to the IP address and the authentication. End 10 to communicate. More specifically, the client 20 and the authentication terminal 10 perform a fourth handshake, and after the client 20 sends the determination information to the authentication terminal 10, it is determined that the shared key authentication of the authentication terminal 10 and the client 20 is completed to confirm the fourth time. The result of the secondary handshake, meanwhile, also determines the IP address of the client 20 based on the response information.

The IP address allocation system of the wireless network in the embodiment of the present invention completes the application or renewal of the client IP address while the authentication end and the client perform the four-way handshake, so as long as the shared key authentication of the wireless link connection is established. You can apply for or renew your IP address. That is, as long as the shared-layer authentication of the wireless link connection is established, the upper-layer application can start to send and receive data without having to apply or renew the IP address. The time required for the client to access or switch the wireless network further reduces the impact on the application layer when the client accesses or switches the wireless network.

In one embodiment of the invention, the request information and the reply message respectively omit the sname and file fields. Therefore, the length of the VSIE formed by the DHCP request information and the DHCP response information is reduced, and the sname and file fields of the DHCP request information are omitted in the transmission process, and the receiving party (ie, the authentication terminal 10) treats the two fields by default. 0 processing.

In an embodiment of the present invention, the IP address allocation system of the wireless network further includes: a DHCP server (not shown), the authentication terminal 10 is further configured to forward the DHCP request information to the DHCP server, and the DHCP server is configured to access the wireless access. Send a response message at 10 o'clock. More specifically, as shown in FIG. 2, after completing the update of the PTK, the authentication terminal 10 forwards the received DHCP request information to the DHCP server for processing, and obtains the processing result of the DHCP server. Generally, if the authentication terminal 10 is a home router, this DHCP server is the authentication terminal 10 itself.

In order to implement the above embodiments, an embodiment of the present invention also proposes an authentication end.

4 is a structural block diagram of an authentication end according to an embodiment of the present invention. As shown in FIG. 4, the authentication terminal 10 includes: a first generation module 110, a first sending module 120, a first receiving module 130, a second generating module 140, a checking module 150, a confirming module 160, a second sending module 170, and The second receiving module 180.

Specifically, the first generation module 110 is configured to generate an authentication end random number. The authentication end random number is only 10 for the authentication end. With one value, the type may include at least one of a time stamp, a large random number, and a serial number.

The first sending module 120 is configured to send the authentication end random number to the client 20. In an embodiment of the present invention, the first sending module 120 sends the authentication end random number to the client 20 through the EAPOL-KEY packet.

The first receiving module 130 is configured to receive the client random number, the MIC, and the DHCP request information sent by the client 20, where the client 20 generates a client random number, and the client random number is a value used by the client only once, and the type may be The method includes: performing at least one of a timestamp, a large random number, and a serial number, and generating a temporary pairwise key PTK according to the authentication end random number, the client random number, the PMK, the authentication end, and the attribute information of the client, thereby implementing the client. 20 PTK updates. The client 20 sends the client random number, MIC and DHCP request information to the first receiving module 130. Similarly, in one embodiment of the invention, the client 20 adds the client random number, MIC and DHCP request information to the EAPOL. The -KEY packet is sent to the first receiving module 130.

The second generation module 140 is configured to generate a temporary pairwise key PTK according to the authentication end random number, the client random number, the PMK, the authentication end attribute information, and the client attribute information, so that the authentication end 10 completes the update of the PTK.

The verification module 150 is used to verify the MIC.

The confirmation module 160 is configured to determine response information for the DHCP request information. More specifically, the confirmation module 160 forwards the DHCP request information to the DHCP server; the confirmation module 160 receives the response information fed back by the DHCP server. If the authentication terminal 10 is a home router, the DHCP server is the authentication terminal 10 itself.

The second sending module 170 is configured to send to the client 20 whether to install the encryption/global key and the response information, so that the client 20 installs the encryption/integration key and determines the IP address according to the response information. In one embodiment of the present invention, the second sending module 170 transmits whether to send the encryption/integration key and response information to the client 20 via the EAPOL-KEY packet.

The second receiving module 180 is configured to receive the determination information sent by the client 20 to complete the shared key authentication of the authentication terminal 10 and the client 20, and communicate with the client 20 according to the IP address. In one embodiment of the invention, client 20 transmits the determination information to second receiving module 180 via the EAPOL-KEY packet.

In one embodiment of the invention, the request information and the reply message respectively omit the sname and file fields. Therefore, the length of the VSIE formed by the DHCP request information and the DHCP response information is reduced, and the sname and file fields of the DHCP request information are omitted in the transmission process, and the receiving side (ie, the authentication end 10) processes the two fields by default. Treat as 0.

In one embodiment of the invention, the request information and the reply message are respectively encrypted with KEK. This ensures safety.

In order to implement the above embodiments, an embodiment of the present invention also proposes a client.

FIG. 5 is a structural block diagram of a client according to an embodiment of the present invention. As shown in FIG. 5, the client 20 includes: a first receiving module 210, a first generating module 220, a second generating module 230, a first sending module 240, a second receiving module 250, and a second sending module 260.

The first receiving module 210 is configured to receive the authentication end random number sent by the authentication end 10. In an embodiment of the present invention, the authentication end 10 sends the authentication end random number to the first receiving module 210 through the EAPOL-KEY packet.

The first generation module 220 is configured to generate a client random number.

The authentication end random number is a value that the authentication end 10 uses only once, and the type may include at least one of a time stamp, a large random number, and a serial number. The client random number is a value that is used only once in the terminal 20, and the type may include at least one of a time stamp, a large random number, and a serial number.

The second generation module 230 is configured to generate a PTK according to the authentication end random number, the client random number, the PMK, the authentication end attribute information, and the client attribute information. Thereby, the PTK update of the client 20 is implemented.

The first sending module 240 is configured to send the client random number, MIC, and DHCP request information to the authentication terminal 10. In one embodiment of the present invention, the first sending module 240 adds the client random number, MIC, and DHCP request information to the EAPOL-KEY packet and sends it to the authentication terminal 10.

The second receiving module 250 is configured to receive the response information sent by the authentication terminal 10 whether to install the encryption/integration key and the DHCP request information, to install the encryption/integration key, and determine the IP address according to the response information. In one embodiment of the present invention, the authentication terminal 10 adds the response information of whether the encryption/integration key and the DHCP request information are installed to the EAPOL-KEY packet and transmits it to the client 20.

The second sending module 260 is configured to send the determining information to the authentication end 10 to complete the shared key authentication of the authentication end 10 and the client 20, and communicate with the authentication end according to the IP address. In one embodiment of the invention, the second transmitting module 260 adds the determination information to the EAPOL-KEY packet and sends it to the authentication terminal 10.

The client in the embodiment of the present invention sends the DHCP request information while transmitting the client random number and the MIC, and receives the response information of the DHCP request information while receiving the encryption/integration key, so that the authentication end is The client performs the application or renewal of the client IP address while performing the four-way handshake, thereby reducing the time required for the client to access or switch the wireless network, and further reducing the client access or switching the wireless network. Impact time on the application layer.

It should be understood that portions of the invention may be implemented in hardware, software, firmware or a combination thereof. In the above-described embodiments, multiple steps or methods may be implemented in software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented in hardware, as in another embodiment, it can be implemented by any one or combination of the following techniques well known in the art: having logic gates for implementing logic functions on data signals. Discrete logic circuits, application specific integrated circuits with suitable combinational logic gates, programmable gate arrays (PGAs), field programmable gate arrays (FPGAs), etc.

In the description of the present specification, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" and the like means a specific feature described in connection with the embodiment or example. A structure, material or feature is included in at least one embodiment or example of the invention. In the present specification, the schematic representation of the above terms does not necessarily mean the same embodiment or example. Furthermore, the particular features, structures, materials, or characteristics described may be combined in a suitable manner in any one or more embodiments or examples.

While the embodiments of the present invention have been shown and described, the embodiments of the invention may The scope of the invention is defined by the claims and their equivalents.

Claims

A method for allocating an IP address of a wireless network, comprising:

Generate an authentication end random number and send it to the client;

Receiving, by the client, a client random number, a message integrity check code MIC, and dynamic host configuration protocol DHCP request information, where the client generates the client random number, and according to the authentication end random number The client random number, the paired master key PMK, the authentication end attribute information, and the client attribute information generate a temporary pair key PTK;

Generating the temporary pairwise key PTK according to the authentication end random number, the client random number, the paired master key PMK, the authentication end attribute information, and the client attribute information, and The MIC performs verification, determines response information of the DHCP request information, and sends to the client whether to install an encryption/holistic key and the response information, so that the client installs an encryption/integral secret And determining an IP address according to the response information;

Receiving the determination information sent by the client to complete the shared key authentication with the client, and communicating with the client according to the IP address.
The method for allocating an IP address of a wireless network according to claim 1, wherein data transmission is performed by the EAPOL-KEY packet and the client.
The method for allocating an IP address of a wireless network according to claim 2, wherein the request information and the response message are respectively added to the EAPOL as an extension of key data KEY data in a vendor specific information element VSIE format. -KEY package.
The method for allocating an IP address of a wireless network according to claim 3, wherein the request information and the response message respectively omit the sname and file fields, and are encrypted by the EAPOL-KEY encryption key KEK.
The method for allocating an IP address of a wireless network according to claim 1, further comprising:

Forwarding the DHCP request information to a DHCP server;

Receiving the response information fed back by the DHCP server.
An IP address allocation system for a wireless network, comprising: an authentication end and a client, wherein

The authentication end is configured to generate an authentication end random number and send the same to the client;

The client is configured to generate a client random number, and generate a temporary paired secret according to the authentication end random number, the client random number, the paired master key PMK, the authentication end attribute information, and the client attribute information. Key PTK, and send the client random number, message integrity check code MIC and dynamic host configuration protocol DHCP request information To the authentication end;

The authentication end is further configured to generate the temporary formation according to the authentication end random number, the client random number, the paired master key PMK, the authentication end attribute information, and the client attribute information. And verifying, by the key PTK, the MIC, determining response information of the DHCP request information, and sending, to the client, whether to install an encryption/global key and the response information;

The client is further configured to install an encryption/integration key and determine an IP address according to the response information, and send the determination information to the authentication end to complete the shared key authentication of the authentication end and the client, And communicating with the authentication end according to the IP address.
The IP address allocation system for a wireless network according to claim 6, wherein the authentication end and the client perform data transmission through an EAPOL-KEY packet.
The IP address allocation system for a wireless network according to claim 7, wherein said request information and said response message are respectively added to said EAPOL as an extension of key data KEY data in a vendor specific information element VSIE format. -KEY package.
The IP address allocation system for a wireless network according to claim 8, wherein said request information and said response message respectively omit the sname and file fields, and are encrypted by an EAPOL-KEY encryption key KEK.
The IP address allocation system for a wireless network according to claim 6, further comprising: a DHCP server, wherein

The authentication end is further configured to forward the DHCP request information to the DHCP server.

The DHCP server is configured to send the response information to the authentication end.
An authentication end, which is characterized by comprising:

a first generating module, configured to generate an authentication end random number;

a first sending module, configured to send the authentication end random number to the client;

a first receiving module, configured to receive a client random number, a message integrity check code MIC, and dynamic host configuration protocol DHCP request information sent by the client, where the client generates the client random number, and Generating a temporary pairwise key PTK according to the authentication end random number, the client random number, the paired master key PMK, the authentication end attribute information, and the client attribute message;

a second generating module, configured to generate the temporary pair according to the authentication end random number, the client random number, the paired master key PMK, the authentication end attribute information, and the client attribute information Key PTK;

a verification module, configured to verify the MIC;

a confirmation module, configured to determine response information of the DHCP request information;

a second sending module, configured to send, to the client, whether to install an encryption/global key and the response information, so that the client installs an encryption/global key and determines an IP address according to the response information;

The second receiving module is configured to receive the determining information sent by the client to complete the shared key authentication with the client, and communicate with the client according to the IP address.
A client, comprising:

a first receiving module, configured to receive an authentication end random number sent by the authentication end;

a first generating module, configured to generate a client random number;

a second generating module, configured to generate a temporary pairwise key PTK according to the authentication end random number, the client random number, the paired master key PMK, the authentication end attribute information, and the client attribute information;

a first sending module, configured to send the client random number, a message integrity check code MIC, and dynamic host configuration protocol DHCP request information to the authentication end;

a second receiving module, configured to receive, by the authentication end, whether to install an encryption/global key and response information of the DHCP request information, to install an encryption/global key, and determine an IP address according to the response information;

And a second sending module, configured to send the determining information to the authentication end to complete the shared key authentication of the authentication end and the client, and communicate with the authentication end according to the IP address.