WO2012068815A1

WO2012068815A1 - Method for preventing impostors in wireless access network, and access point

Info

Publication number: WO2012068815A1
Application number: PCT/CN2011/072402
Authority: WO
Inventors: 彭永超; 郭辉; 刘昕颖; 唐珂
Original assignee: 中兴通讯股份有限公司
Priority date: 2010-11-22
Filing date: 2011-04-02
Publication date: 2012-05-31
Also published as: CN102480729A; CN102480729B

Abstract

Provided are a method for preventing impostors in a wireless access network, and an access point. The method comprises: establishing a virtual access point or multiple virtual access points, each of which has a corresponding Basic Service Set Identifier (BSSID); connecting a terminal to a virtual access point according to the Media Access Control (MAC) address of the terminal and authenticating the terminal; for the legal terminal passing the authentication, binding the Internet Protocol (IP) address and/or MAC address of the legal terminal with the BSSID of the virtual access point connected with the legal terminal and determining binding relationship between the legal terminal and the virtual access point; according to the binding relationship, forwarding data frames transmitted from the legal terminal and discarding data frames transmitted from the terminal of an impostor. The present invention can realize the aim of preventing impostors in an 802.11 wireless access network with the application of technical solutions of the present invention.

Description

Method and access point for preventing spoofing users in wireless access network

The present invention relates to the field of mobile communications, and in particular to a method and an access point for preventing a counterfeit user in a radio access network. Background technique

Currently, one of the commonly used authentication methods in the 802.11 radio access network established by network operators is network (Web) authentication. In this way, the access point (AP, Access Point) is required to be advertised as an open system. The user terminal can be connected to the AP without entering a password, and the IP address can be dynamically obtained. However, at this time, the user terminal accesses the network is limited, and can only access a limited number of addresses, for example, a Domain Name System (DNS) server, a Web Portal server, and the like. When the user opens the browser and accesses any page, it will be redirected to the Web Portal server. The Web Portal server will push a web login page to the user, prompting the user to enter the username and password. If the user pre-opens the corresponding business in the business hall, you can directly enter the user name and password that you applied for when you opened the service. If not, you can enter your mobile number and receive a temporary username and password on your phone. When the user is authenticated, various services can be used normally.

The advantage of using the web authentication method is that the user terminal does not need to download and install the customized client software, that is, the login process can be completed using the browser. The disadvantage is that the air packets exchanged between the user terminal and the AP are usually not encrypted, and there is a security risk. One of the more serious ones is a fake user. The fake user uses the air packet capture tool to capture the empty Chinese interaction between other user terminals and the AP, and obtains the MAC address and IP address of the authenticated legal terminal. Then modify the MAC address and IP address of your wireless network card to a legitimate terminal. In this way, fake If it does not come out, the counterfeit terminal can use the service that the legitimate terminal can use without authentication. The expenses incurred by the counterfeit user will be counted in the account of the legitimate user, which will harm the interests of the legitimate user and will also harm the interests of the operator.

In the related art, other commonly used authentication methods in the radio access network also have a pre-shared key and

802.1x certification. Most wireless access networks that use these two authentication methods encrypt the packets transmitted over the air. If they are not encrypted, there will be problems with counterfeit users.

Currently, in a wired access network, a method for preventing a fake user from being bound to a physical port by using an IP (Internet Protocol) address + Medium Access Control (MAC) address is generally adopted. That is, after the user passes the authentication, the switch binds the IP address + MAC address (or only the IP address or MAC address) of the terminal to the physical port to which it is connected. If a packet with the same IP address or MAC address comes in from other physical ports, It will be considered illegal and will be discarded. However, there is a prerequisite for implementing the above method: The legal terminal and the fake terminal are connected to different physical ports. Even if the source MAC address and IP address of the packet are the same, the incoming physical port can be used to determine which terminal sent the packet.

In a wireless access network, there is a difference between an AP and a switch in a wired access network. The wireless channel working by the AP can be regarded as a physical port. Generally, an AP can only work on one or two wireless channels at any time (some APs support 802.11 a/b/g, and can work at 2.4G and 5G simultaneously. Channel), so the AP has only one or two physical ports. Both the legal terminal and the terminal are connected to the AP through the same physical port. Therefore, the method of binding the physical port to the IP+MAC is not applicable in the wireless access network. Therefore, there is an urgent need for a method of preventing fraudulent users that can be applied to a wireless access network. Summary of the invention

The present invention provides a method and an access point for preventing a spoofing user in a radio access network. In the case that a packet transmitted over the air in the WTRU is not encrypted, the attack of the spoofing user can be prevented.

The present invention provides a method for preventing a fake user in a wireless access network, including: Establishing one or more virtual access points, where the virtual access point has a basic service set identifier BSSID corresponding thereto;

Connect the terminal to a virtual access point according to the MAC address of the terminal, and authenticate the terminal;

Bind the IP address and/or MAC address of the legal terminal to the BSSID of the virtual access point connected to the legal terminal to determine the binding relationship between the legal terminal and the virtual access point.

The data frame sent by the legal terminal is forwarded according to the binding relationship, and the data frame sent by the fake terminal is discarded.

The invention also provides an access point, comprising:

a first establishing module, configured to establish one or more virtual access points, where the virtual access point has a basic service set identifier BSSID corresponding thereto;

a connection module, configured to connect the terminal to a virtual access point according to the MAC address of the terminal; and an authentication module, configured to authenticate the terminal;

The second establishing module is configured to bind the IP address and/or the MAC address of the legal terminal to the BSSID of the virtual access point connected to the legal terminal for the authenticated legal terminal, and determine the binding of the legal terminal and the virtual access point. Relationship

The processing module is configured to forward the data frame sent by the legal terminal according to the binding relationship, and discard the data frame sent by the fake terminal.

The beneficial effects of the present invention are as follows:

By establishing a VAP, the IP+MAC of the legal terminal is bound to the VAP, which solves the problem that the prior art cannot prevent the counterfeit user when the packet transmitted over the air in the radio access network is not encrypted, and can implement the 802.11 wireless connection. The purpose of preventing users from impersonating users in the network is to protect the interests of legitimate users and operators. DRAWINGS

1 is a flowchart of a method for preventing a spoofing user in a radio access network according to an embodiment of the present invention; FIG. 2 is a schematic diagram of an AP preventing a counterfeit user from being processed according to an embodiment of the present invention;

3 is a signaling flowchart of a call hook function according to an embodiment of the present invention;

4 is a flowchart of a call connection establishment hook function according to an embodiment of the present invention;

FIG. 5 is a flowchart of a call disconnection hook function according to an embodiment of the present invention; FIG.

6 is a flowchart of invoking an authentication end hook function according to an embodiment of the present invention;

7 is a flowchart of calling a forwarding hook function according to an embodiment of the present invention;

FIG. 8 is a schematic structural diagram of an access point according to an embodiment of the present invention. detailed description

As mentioned above, in the wired access network, the method of binding the physical port by IP+MAC is often used to prevent users from being used, but this method is not applicable in the radio access network. In order to solve the problem that the prior art can prevent the counterfeit user from being transmitted over the air in the radio access network, the present invention provides a method and an access point for preventing a counterfeit user in the radio access network. Aiming at the characteristics of 802.11 radio access network, a method of IP+MAC binding virtual access point (VAP) is proposed, which realizes the purpose of preventing counterfeit users in 802.11 radio access network. The present invention will be further described in detail below in conjunction with the drawings and embodiments. It is understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention.

Method embodiment

According to an embodiment of the present invention, a method for preventing a spoofing user in a radio access network is provided. FIG. 1 is a flowchart of a method for preventing a spoofing user in a radio access network according to an embodiment of the present invention, as shown in FIG. A method for preventing a fake user in a radio access network according to an embodiment of the present invention includes the following processing:

Step 101: Establish one or more virtual access points, where the virtual access point has a basic service set identifier (BSSID, Basic Service Set Identifier) corresponding thereto; That is to say, multiple VAPs are established on the AP, and multiple VAPs work on the same channel, have the same Service Set Identifier (SSID), but have different BSSIDs. The VAPs send out beacon frames, which carry different BSSIDs. After receiving the beacon frame, the terminal can determine that different VAPs are sent according to the carried BSSID, and the terminal can consider that the beacon frame is sent by multiple APs.

Step 102: Connect the terminal to a virtual access point according to the MAC address of the terminal, and authenticate the terminal.

In step 102, connecting the terminal to a virtual access point requires the following processing: 1. When the terminal needs to connect to the virtual access point, it is determined according to the MAC address of the terminal whether there is a terminal connection with the same MAC address of the terminal. To the virtual access point; 2. In the case that it is determined that the terminal having the same MAC address as the terminal is connected to the virtual access point, the terminal is allowed to connect to the virtual access point; 3. determining the virtual access If the terminal already has the same terminal as the terminal MAC address, the terminal is refused to connect to the virtual access point, forcing the terminal to connect to other virtual access points.

In a wireless network, the connection is easily disconnected, and the terminal connected first is not necessarily the legal terminal. Therefore, when the terminal wants to connect to a VAP, the AP needs to check whether the terminal with the same MAC address is connected to the VAP. If there is, the terminal is denied to connect to the VAP, and then the terminal will automatically try to connect the other with the same. The VAP of the SSID, thereby forcing the fake terminal to connect to the legal terminal to a different VAP.

Step 103: Bind the IP address and/or MAC address of the legal terminal to the BSSID of the virtual access point connected to the legal terminal for the authenticated legal terminal, and determine the binding relationship between the legal terminal and the virtual access point.

It should be noted that the 802.11 data frame header sent by the terminal carries the BSSID. Since the legal terminal and the fake terminal are connected to different VAPs, the BSSIDs included in the frames sent by them are different, and the AP can distinguish which frame is sent by the terminal according to the BSSID.

Preferably, in an actual application, a terminal authorization status table may also be established, where The end authorization status table includes: an IP address, a MAC address, a BSSID, and an authorization status, and the authorization status includes: restricted, authorized, and prohibited.

In step 103, binding the IP address and/or the MAC address of the legal terminal to the BSSID of the virtual access point connected to the legal terminal is performed as follows: 1. According to the terminal authorization status table, Whether there is an entry that matches the MAC address and BSSID of the legal terminal. If yes, the authorization status of the entry is modified to be authorized and the corresponding IP address is saved. 2. According to the terminal authorization status table, it is determined whether it is legal or not. The entry whose MAC address matches but does not match the BSSID of the legal terminal, if any, changes the authorization status of the entry to disabled.

Step 104: Forward the data frame sent by the legal terminal according to the binding relationship, and discard the data frame sent by the fake terminal.

In step 104, the data frame sent by the legal terminal is forwarded according to the binding relationship, and the data frame sent by the fake terminal is discarded as follows: 1. According to the terminal authorization status table, it is determined whether the MAC address and the BSSID of the legal terminal match. The entry, if any, determines whether the source IP address in the legitimate terminal matches the IP address in the entry; 2. If the IP address matches, the authorization status in the entry is determined; 3. In the authorization status If it is authorized, the packet is forwarded. When the authorization status is forbidden, the packet is discarded. When the authorization status is determined to be restricted, it is further determined whether the destination IP address in the packet is within the allowed address range. If the number of the allowed address ranges, the packet is forwarded. If the packet is not in the allowed range, the packet is discarded.

That is, after the legitimate terminal passes the Web authentication, the AP binds its IP/MAC address to the VAP to which it is connected. In this way, the BSSID included in the frame sent by the legal terminal is the same as the BSSID of the bound VAP, and is allowed to pass. The frame sent by the fake terminal is discarded by the AP because the BSSID it contains is inconsistent with the BSSID of the bound VAP. , thus playing a role in preventing counterfeit terminals.

In addition, when the terminal is disconnected, the following processing is further included: 1. According to the terminal authorization status table, it is checked whether there is an entry of a MAC address and a BSSID matching the terminal, and if an entry exists, Then check whether the authorization status of the entry is authorized; 2. If the authorization status of the entry is authorized, delay the disconnection and set a predetermined time, if the authorization status of the entry is not authorized, immediately disconnect; 3 After the scheduled time expires, check if the terminal is still online. If it is online, keep the connection. Otherwise, disconnect.

The above technical solutions of the embodiments of the present invention are described in detail below with reference to the accompanying drawings. 2 is a schematic diagram of an AP preventing a fake user from processing according to an embodiment of the present invention. As shown in FIG. 2, a wireless access module of an AP is configured to establish a connection with a wireless terminal, disconnect, and detect whether the terminal remains connected. The packet forwarding module of the AP is configured to forward the packet received from the wireless network to the wired network, or conversely, forward the packet received from the wired network to the wireless network. The Web Portal authentication module of the AP is used to implement the Web portal authentication process.

The anti-counterfeiting module of the AP is used to distinguish, judge, and block the function of the fake terminal. According to the technical solution of the embodiment of the present invention, the anti-counterfeiting module is newly added to the AP, and the anti-counterfeiting module is mainly used to: 1. When receiving the request for establishing a connection, check whether the terminal with the same MAC is connected to the same VAP, if any 2, refuse to connect; 2, when receiving the request to disconnect, check whether the terminal is online, in case the request is from a fake terminal; 3, after the Web portal authentication is passed, establish the binding of the IP address, MAC address and VAP relationship. 4. When forwarding a packet, determine whether to allow forwarding based on the binding relationship between the IP+MAC and the VAP.

In addition, the anti-counterfeiting module maintains a terminal authorization status table. The entry format in the table is: <IP address, MAC address, BSSID, authorization status>. There are three values for the authorization status: restricted, authorized, and forbidden. Restricted means that only the terminal is allowed to access the DHCP server, the DNS server, the Web portal server, etc.; the authorization is to allow the terminal to access the external network normally;

It should be noted that, in practical applications, the above functions of the anti-counterfeiting module are represented by a series of hook functions, including: an authentication end hook function, a WLAN-EAH forwarding hook function, an ETH-WLAN forwarding hook function, a connection establishment hook function, and a connection. Disconnect the hook function. The above hook functions are called by other modules at the appropriate time. Figure 3 is a representation of an embodiment of the present invention The signaling flow chart of the hook function, as shown in Figure 3, includes the following processing:

Step 1: The terminal interacts with the AP, and the AP invokes a connection to establish a hook function to implement an 802.11 connection process.

Step 2: The terminal interacts with the DHCP server to dynamically obtain an IP address. From this point on, when forwarding the packet sent by the terminal and sent to the terminal, the AP will invoke the WLAN-EAH forwarding hook function and the ETH-WLAN forwarding hook function respectively;

Step 3: The terminal interacts with the Web portal server, and after performing Web portal authentication, the AP invokes the authentication end hook function;

Step 4: After the authentication succeeds, the terminal accesses the external network.

Step 5: The terminal interacts with the AP, and the AP invokes the connection disconnection hook function to implement the 802.11 disconnection process.

According to the 802.11 protocol, the process of establishing a wireless connection includes three steps of detecting, authenticating, and associating. Upon receiving the authentication frame, the wireless access module invokes the connection establishment hook function of the anti-counterfeiting module, the parameter passed is the MAC address of the terminal, and the BSSID of the VAP to which it is connected. FIG. 4 is the call connection establishment in the embodiment of the present invention. The flow chart of the hook function, as shown in Figure 4, includes the following processing:

Step 401: Search for a terminal authorization status table, and check whether an entry with a MAC address and a BSSID match exists.

Step 402, if yes, send an authentication (Authentication) with a status code of 37 to the terminal, rejecting the authentication request;

Step 403, if not, add an entry in the terminal authorization status table, and set the initial authorization status to be restricted, because the terminal has not obtained the IP address at this time, and the initial IP address is set to 0.

As shown in Figure 3, when the terminal is disconnected, Disassociation or Deauthentication is sent. At this time, the wireless access module calls the connection disconnection hook function of the anti-counterfeiting module, and the parameters passed are the MAC address of the terminal, and the VAP of the connected terminal. BSSID. FIG. 5 is a flowchart of a call disconnection hook function according to an embodiment of the present invention. As shown in FIG. 5, the following processing is included:

Step 501: Search for a terminal authorization status table, and check whether an entry with a MAC address and a BSSID match exists.

Step 502, if there is a matching entry, check whether the authorization status is authorized.

Step 503: If the authorization status of the matching entry is authorized, the connection is delayed and the timer is started; otherwise, the connection is immediately disconnected.

Step 504: After the timer expires, check whether the terminal is still online. If yes, the connection state is still maintained. Otherwise, the connection is disconnected.

It should be noted that sometimes the fake terminal sends a Deauthentication frame after receiving the Authentication frame rejecting the authentication request. If the AP is received as a Deauthentication frame from the normal terminal, it will be disconnected immediately, which will affect the normal terminal. It is therefore necessary to delay the disconnection and check if the terminal is actually disconnected.

When the authentication of the web portal is completed, if the authentication is passed, the authentication end hook function is invoked, and the parameters passed are the IP address, the MAC address, the BSSID, and the like of the terminal. FIG. 6 is a flowchart of calling the authentication end hook function according to the embodiment of the present invention. As shown in Figure 6, the following processing is included:

Step 601, if the authentication does not pass, return directly;

Step 602: Search for a terminal authorization status table, and check whether there is an entry that matches the MAC address and the BSSID.

Step 603, if there is a matching entry, change the authorization status of the entry to authorized, and save the IP address;

Step 604: Search the terminal authorization status table to check whether there is an entry whose MAC address matches but the BSSID does not match;

Step 605, if there is such an entry, it is considered to be a fake terminal, and the authorization status of the entry is changed to prohibited.

After the terminal is connected, the forwarding hook function of the anti-counterfeiting module is called when the packet is forwarded. The parameters that are transmitted are the IP address of the packet, the MAC address, and the VAP used for sending and receiving the message. FIG. 7 is a flowchart of calling the forwarding hook function according to the embodiment of the present invention. As shown in FIG. 7, the following processing is included:

Step 701: Search for a terminal authorization status table, and check whether there is an entry that matches the MAC address and the BSSID.

Step 702: If yes, compare the source IP address in the packet with the IP address in the entry. If the IP addresses are equal, or the IP address in the entry is all 0, it is considered to be a match;

Step 703: If the IP address is also matched, check the authorization status. If it is authorized, it is allowed to forward; if it is forbidden, the packet is discarded;

Step 704, if the status is restricted, it is also checked whether the destination IP is within the allowed address range. If not, the packet is discarded. Otherwise, forwarding is allowed.

Since the BSSID is included in the 802.11 frame, it is not in the Ethernet frame. In order to distinguish the packets from which the terminal is located on the wired side, you can map different BSSIDs to different VIDs, or MAC address translation and IP address translation when forwarding packets.

It should be noted that the technical solution of the embodiment of the present invention can establish only one VAP, and only the connection establishment and connection disconnection hook functions are reserved in the anti-counterfeiting module. The disadvantage of this simplification scheme is that it thinks that the first connection is a legitimate terminal, and the latter connection is a fake terminal. In fact, the opposite situation may occur. If it occurs, the connection of the legitimate terminal is erroneously rejected, so It is recommended to use the above technical solutions.

Device embodiment

An access point is provided according to an embodiment of the present invention. FIG. 8 is a schematic structural diagram of an access point according to an embodiment of the present invention. As shown in FIG. 8, an access point according to an embodiment of the present invention includes: The module 80, the connection module 81, the authentication module 82, the second setup module 83, and the processing module 84. It should be noted that the connection module 81 in the embodiment of the present invention is equivalent to the wireless access module in FIG. 2, and the authentication module 82 is equivalent. In the Web Portal authentication module in FIG. 2, some functions in the processing module 84 are equivalent to the packet forwarding module in FIG. 2, and the first establishing module 80 and the second establishing module are 83, and other functions in the processing module 84 are equivalent to the anti-counterfeiting module of FIG. The respective modules of the embodiments of the present invention are described in detail below.

The first establishing module 80 is configured to establish one or more virtual access points, where the virtual access point has a basic service set identifier BSSID corresponding thereto;

That is, the first establishing module 80 establishes multiple VAPs on the AP, and multiple VAPs work on the same channel, and have the same Service Set Identifier (SSID), but have different BSSIDs. The VAPs send out beacon frames, which carry different BSSIDs. After receiving the beacon frame, the terminal can determine that different VAPs are sent according to the carried BSSID, and the terminal can consider that the beacon frame is sent by multiple APs.

The connection module 81 is configured to connect the terminal to a virtual access point according to the MAC address of the terminal;

Specifically, the connection module 81 includes:

a first determining sub-module, configured to determine, according to the MAC address of the terminal, whether a terminal with the same MAC address of the terminal is connected to the virtual access point when the terminal needs to be connected to the virtual access point; The sub-module is configured to connect the terminal to the virtual access point when the first determining sub-module determines that the terminal that is not the same as the MAC address of the terminal is connected to the virtual access point. The first judging sub-module determines that the virtual access point has a terminal with the same MAC address as the terminal, and refuses to connect the terminal to the virtual access point.

The authentication module 82 is configured to authenticate the terminal. The second establishing module 83 is configured to bind the IP address and/or the MAC address of the legal terminal to the BSSID of the virtual access point connected to the legal terminal, and determine the legal terminal and the legal terminal. Binding relationship of the virtual access point;

Preferably, in an actual application, the access point according to the embodiment of the present invention further includes: a state table establishing module, configured to establish a terminal authorization state table, where the terminal authorization state table includes: an IP address, a MAC The address, the BSSID, and the authorization status, the authorization status includes: restricted, authorized, and forbidden;

Specifically, the entry format in the terminal authorization status table is: <IP address, MAC address, BSSID, authorization status>. There are three values for the authorization status: restricted, authorized, and forbidden. Restricted, it means that only the terminal is allowed to access the DHCP server, the DNS server, the Web portal server, etc.; the authorization is to allow the terminal to access the external network normally;

The second establishing module 83 is specifically configured to: determine, according to the terminal authorization status table, whether there is an entry that matches the MAC address and the BSSID of the legal terminal, and if yes, modify the authorization status of the entry to Authorizing, and saving the corresponding IP address; determining, according to the terminal authorization status table, whether there is an entry that does not match the MAC address of the legal terminal, and does not match the BSSID of the legal terminal, if yes, the entry The authorization status is modified to be prohibited;

The processing module 84 is configured to forward the data frame sent by the legal terminal according to the bonding relationship, and discard the data frame sent by the fake terminal.

The processing module 84 is specifically configured to: determine, according to the terminal authorization status table, whether there is an entry that matches the MAC address and the BSSID of the legal terminal, and if yes, determine a source IP address in the legal terminal Whether the IP address in the entry matches; if the IP address matches, the authorization status in the entry is determined; when it is determined that the authorization status is authorized, then Sending the packet, when it is determined that the authorization status is forbidden, discarding the packet, and when determining that the authorization status is a restriction, further determining whether the destination IP in the packet is in an allowed address range If the packet is within the allowed address range, the packet is forwarded, and if it is not within the allowed address range, the packet is discarded.

That is, after the legitimate terminal passes the web authentication, the processing module 84 binds its IP/MAC address to its connected VAP. In this way, the BSSID included in the frame sent by the legal terminal is the same as the BSSID of the bound VAP, and is allowed to pass. The frame sent by the fake terminal is discarded by the AP because the BSSID it contains is inconsistent with the BSSID of the bound VAP. , thus playing a role in preventing counterfeit terminals.

In addition, the technical solution of the embodiment of the present invention may further include: a disconnection processing module, configured to check, according to the terminal authorization status table, whether there is a MAC address matching the terminal and when the terminal disconnects An entry of the BSSID exists, if the entry exists, checking whether the authorization status of the entry is authorized; if the authorization status of the entry is authorized, delaying the disconnection, and setting a predetermined time, if If the authorization status of the entry is not authorized, the connection is immediately disconnected; after the predetermined time expires, it is checked whether the terminal is still online, if online, the connection is maintained, otherwise, the connection is disconnected.

It should be noted that, in practical applications, other functions in the first establishing module 80, the second establishing module 83, and the processing module 84 are represented as a series of hook functions, including: an authentication end hook function, and a WLAN-EAH forwarding hook function. , ETH-WLAN forwarding hook function, connection establishment hook function, and connection disconnect hook function. The above hook functions are called by other modules at the appropriate time. The specific call timing and the call processing flow can be understood by referring to FIG. 3 to FIG. 7 of the foregoing method embodiment, and details are not described herein again.

It should be noted that since the BSSID is included in the 802.11 frame, it is not included in the Ethernet frame. In order to distinguish the packets from which the terminal is located on the wired side, it is possible to map different BSSIDs into different VIDs, or MAC address translation, IP address translation, etc. when forwarding the message. The technical solution of the embodiment of the present invention can establish only one VAP, and only the connection establishment and connection disconnection hook functions are reserved in the anti-counterfeiting module. The disadvantage of this simplification scheme is that it thinks that the first connection is a legitimate terminal, and the latter connection is a fake terminal. In fact, the opposite situation may occur. If it occurs, the connection of the legitimate terminal is erroneously rejected, so It is recommended to use the above technical solutions.

In the embodiment of the present invention, the IP+MAC of the legal terminal is bound to the VAP by establishing the VAP, which solves the problem that the prior art cannot prevent the counterfeit user when the packet transmitted in the air in the radio access network is not encrypted, and can implement the VAP. The purpose of preventing spoofing users in the 802.11 radio access network protects the interests of legitimate users and operators.

While the preferred embodiments of the present invention have been disclosed for purposes of illustration, those skilled in the art will recognize that various modifications, additions and substitutions are possible, and the scope of the invention should not be limited to the embodiments described above.

Claims

Claim

A method for preventing a spoofing user in a radio access network, comprising: establishing one or more virtual access points, wherein the virtual access point has a basic service set identifier BSSID corresponding thereto;

Connecting the terminal to a virtual access point according to a MAC address of the terminal, and authenticating the terminal;

Binding the IP address and/or MAC address of the legal terminal to the BSSID of the virtual access point connected to the legal terminal, and determining the legal terminal and the virtual access point. Binding relationship

Forwarding the data frame sent by the legal terminal according to the binding relationship, and discarding the data frame sent by the fake terminal.

2. The method according to claim 1, wherein the connecting the terminal to a virtual access point according to a MAC address of the terminal comprises:

When the terminal needs to connect to the virtual access point, determine, according to the MAC address of the terminal, whether a terminal with the same MAC address of the terminal is connected to the virtual access point;

When it is determined that a terminal that is not the same as the MAC address of the terminal is connected to the virtual access point, connecting the terminal to the virtual access point;

In the case that it is determined that the virtual access point has a terminal with the same MAC address of the terminal, the terminal is refused to connect to the virtual access point, and the terminal is connected to other MACs that are not connected to the terminal. The virtual access point is connected to the terminal with the same address.

The method according to claim 1 or 2, further comprising: establishing a terminal authorization status table, wherein the terminal authorization status table includes: an IP address, a MAC address, a BSSID, and an authorization status. The authorization status includes: restricted, authorized, and prohibited.

4. The method of claim 3, wherein when the terminal is disconnected, The method also includes:

Checking, according to the terminal authorization status table, whether there is an entry of a MAC address and a BSSID that matches the terminal, and if the entry exists, checking whether the authorization status of the entry is authorized;

If the authorization status of the entry is authorized, the connection is delayed, and a predetermined time is set, and if the authorization status of the entry is not authorized, the connection is immediately disconnected;

After the predetermined time expires, it is checked whether the terminal is still online, if online, the connection is maintained, otherwise, the connection is disconnected.

The method according to claim 3, wherein the BSSID of the virtual access point that connects the IP address and/or MAC address of the legal terminal to the legal terminal for the authenticated legal terminal Binding includes:

Determining, according to the terminal authorization status table, an entry that matches the MAC address and the BSSID of the legal terminal, and if yes, modifying the authorization status of the entry to be authorized, and saving the corresponding IP address;

And determining, according to the terminal authorization status table, whether there is an entry that matches the MAC address of the legal terminal, and does not match the BSSID of the legal terminal, and if yes, the authorization status of the entry is modified to be prohibited.

The method of claim 3, wherein the transmitting the data frame sent by the legal terminal according to the binding relationship, and discarding the data frame sent by the fake terminal includes:

Determining, according to the terminal authorization status table, whether there is an entry that matches the MAC address and the BSSID of the legal terminal, and if yes, determining the source IP address in the legal terminal and the IP address in the entry Whether it matches;

If the IP addresses match, determine the authorization status in the entry;

When it is determined that the authorization status is authorized, the message is forwarded, and when it is determined that the authorization status is prohibited, the message is discarded, and when the authorization status is determined to be a limit, the Whether the destination IP in the message is within the allowed address range, if the allowed address range Within the range, the text is forwarded, and if it is not within the allowed address range, the text is discarded.

7. An access point, comprising:

a connection module, configured to connect the terminal to a virtual access point according to a MAC address of the terminal;

An authentication module, configured to authenticate the terminal;

a second establishing module, configured to bind, to the legal terminal that is authenticated, the IP address and/or the MAC address of the legal terminal to the BSSID of the virtual access point connected to the legal terminal, and determine the legal terminal and the Binding relationship of the virtual access point;

The access point according to claim 7, wherein the connection module specifically includes: a first determining submodule, configured to: when the terminal needs to be connected to a virtual access point, according to the terminal The MAC address determines whether a terminal having the same MAC address as the terminal is connected to the virtual access point;

An access submodule, configured to connect the terminal to the virtual access point if the first determining submodule determines that a terminal that is not the same as the MAC address of the terminal is connected to the virtual access point. The first determining sub-module determines that the virtual access point has a terminal with the same MAC address as the terminal, refuses to connect the terminal to the virtual access point, and connects the terminal to other A virtual access point connected to the terminal with the same MAC address as the terminal.

The access point according to claim 7, wherein the device further comprises: a status table establishing module, configured to establish a terminal authorization status table, where the terminal authorization status table includes: The address, the MAC address, the BSSID, and the authorization status, the authorization status includes: restricted, authorized, and forbidden; a disconnection processing module, configured to check, according to the terminal authorization status table, whether there is an entry of a MAC address and a BSSID matching the terminal when the terminal is disconnected, and if the entry exists, check Whether the authorization status of the entry is authorized; if the authorization status of the entry is authorized, the connection is delayed, and a predetermined time is set, and if the authorization status of the entry is not authorized, the connection is immediately disconnected. After the predetermined time expires, it is checked whether the terminal is still online, if online, the connection is maintained, otherwise, the connection is disconnected.

10. The access point of claim 9 wherein:

The second establishing module is specifically configured to: determine, according to the terminal authorization status table, whether there is an entry that matches the MAC address and the BSSID of the legal terminal, and if yes, modify the authorization status of the entry to Authorized, and save the corresponding IP address; according to the terminal authorization status table, determine whether there is an entry that does not match the MAC address of the legal terminal, and does not match the BSSID of the legal terminal, if any, the entry The authorization module is modified to be disabled; the processing module is specifically configured to: determine, according to the terminal authorization status table, whether there is an entry that matches the MAC address and the BSSID of the legal terminal, and if yes, determine the legal terminal Whether the source IP address in the packet matches the IP address in the entry; if the IP address matches, the authorization status in the entry is determined; when it is determined that the authorization status is authorized, the packet is forwarded. When it is determined that the authorization status is forbidden, the message is discarded, and when the authorization status is determined to be a restriction, further judgment is performed. The object of the IP packet is within the allowable address range, if within the allowable range of addresses, forwarding the message, if not within the allowed range of addresses, the packet is discarded.