Method and system for securely accessing portable hotspot for intelligent mobile phones

Patent metadata

Field	Value
Publication number	US-9344895-B2
Application number	US-201314388849-A
Country	US
Kind code	B2
Filing date	Jun 14, 2013
Priority date	Sep 18, 2012
Publication date	May 17, 2016
Grant date	May 17, 2016

Abstract

A method and a system for securely accessing a portable hotspot for intelligent mobile phones, comprises an intelligent mobile phone used as an AP and another intelligent mobile phone used as an STA. The AP comprises an AP NFC module and a first data transmission module; and the STA comprises an STA NFC module and a second data transmission module. The AP uses the NFC module to perform a WPA security authentication with the STA, and uses the first data transmission module to perform data encrypted transmission with the second data transmission module. In the method and the system of the present disclosure, the common WLAN authentication mechanism is not adopted, and the security authentication process between the AP and the STA is completed in the NFC manner instead.

First claim

What is claimed is:

1. A method for securely accessing a portable hotspot for intelligent mobile phones, which comprises an intelligent mobile phone used as an access point (AP) and another intelligent mobile phone used as a station (STA), the method comprising following steps of:
A. disposing near field communication (NFC) modules in the AP and the STA respectively;
B. enabling the AP and the STA to perform Wi-Fi Protected Access (WPA) security authentication in an NFC manner, wherein the step B specifically comprises following steps of interacting in the NFC manner:
B1. obtaining a pre-shared key (PSK) and a pairwise master key (PMK) by the AP according to a password, a service set identifier (SSID), an SSID length and 4096;
B2. broadcasting the SSID, a network equipment hardware address of the AP, and a first random number by the AP to the STA; and generating a second random number as well as the PSK and the PMK, obtaining a pairwise transient key (PTK) according to the PMK, the network equipment hardware address of the AP, a network equipment hardware address of the STA, the first random number and the second random number, forming a message integrity check keyword (MIC KEY) according to front 16 bytes of the PTK, and generating an MIC according to the MIC KEY and the 802.1x protocol data by the STA;
B3. transmitting the second random number, the network equipment hardware address of the STA, the 802.1x protocol data and the MIC by the STA to the AP; and obtaining the PTK according to the PMK, the network equipment hardware address of the AP, the network equipment hardware address of the STA, the first random number and the second random number, forming the MIC KEY according to the front 16 bytes of the FIXTK, and then calculating an MIC′ according to the MIC KEY and the 802.1x protocol data by the AP, wherein if MIC=MIC′, then the authentication is successful, and otherwise, the authentication fails;
C. disposing a first data transmission module and a second data transmission module in the AP and the STA respectively so that data encrypted transmission is performed between the AP and the STA via the first data transmission module and the second data transmission module.

2. The method of claim 1 , wherein the WPA security authentication is a WPA-PSK security authentication.

3. The method of claim 1 , wherein the step B2 specifically comprises: obtaining the PSK according to the password, the SSID, the SSID length and 4096 and obtaining the PMK according to the PSK by the STA.

4. A method for securely accessing a portable hotspot for intelligent mobile phones, which comprises an intelligent mobile phone used as an access point (AP) and another intelligent mobile phone used as a station (STA), the method comprising following steps of:
A. disposing NFC modules in the AP and the STA respectively;
B. enabling the AP and the STA to perform WPA security authentication in an NFC manner, wherein the step B specifically comprises following steps of interacting in the NFC manner:
B1. obtaining a PSK and a PMK by the AP according to a password, an SSID, an SSID length and 4096;
B2. broadcasting the SSID, a network equipment hardware address of the AP, and a first random number by the AP to the STA; and generating a second random number as well as the PSK and the PMK, obtaining a FIX according to the PMK, the network equipment hardware address of the AP, a network equipment hardware address of the STA, the first random number and the second random number, forming an MIC KEY according to front 16 bytes of the PTK, and generating an MIC according to the MIC KEY and the 802.1x protocol data by the STA;
B3. transmitting the second random number, the network equipment hardware address of the STA, the 802.1x protocol data and the MIC by the STA to the AP; and obtaining the PTK according to the PMK, the network equipment hardware address of the AP, the network equipment hardware address of the STA, the first random number and the second random number, forming the MIC KEY according to the front 16 bytes of the PTK, and then calculating an MIC′ according to the MIC KEY and the 802.1x protocol data by the AP, wherein if MIC=MIC′, then the authentication is successful, and otherwise, the authentication fails.

5. The method of claim 4 , further comprising following step of:
C. disposing a first data transmission module and a second data transmission module in the AP and the STA respectively so that data encrypted transmission is performed between the AP and the STA via the first data transmission module and the second data transmission module.

6. The method of claim 4 , wherein the WPA security authentication is a WPA-PSK security authentication.

7. The method of claim 4 , wherein the step B2 specifically comprises: obtaining the PSK according to the password, the SSID, the SSID length and 4096 and obtaining the PMK according to the PSK by the STA.

8. A system for securely accessing a portable hotspot for intelligent mobile phones, comprising an intelligent mobile phone used as an AP and another intelligent mobile phone used as an STA, wherein:
the AP comprises an AP NFC module and a first data transmission module;
the STA comprises an STA NFC module and a second data transmission module; and
the AP employs the AP NFC module to perform a WPA security authentication with the STA NFC module of the STA, and employs the first data transmission module to perform data encrypted transmission with the second data transmission module;
wherein the AP NFC module comprises an AP initialization module and a first calculation module; the STA NFC module comprises an STA initialization module and a second calculation module; the AP initialization module calculates a PSK and a PMK according to a password, an SSID, an SSID length and 4096, and generates a first random number, the STA initialization module calculates the PSK and the PMK according to the password, the SSID, the SSID length and 4096, and generates a second random number, the first calculation module obtains a PTK according to the PMK, a network equipment hardware address of the AP, a network equipment hardware address of the STA, the first random number and the second random number, forms an MIC KEY according to front 16 bytes of the PTK, and then calculates an MIC′ according to the MIC KEY and the 802.1x protocol data; and the second calculation module obtains the PTK according to the PMK, the network equipment hardware address of the AP, the network equipment hardware address of the STA, the first random number and the second random number, forms the MIC KEY according to the front 16 bytes of the PTK, and then calculates an MIC according to the MIC KEY and the 802.1x protocol data; and
the AP further comprises an authentication determining module, which is configured to determine whether the MIC′ and the MIC calculated by the first calculation module and the second calculation module respectively are equal to each other.

Assignees

• Huizhou Tcl Mobile Comm Co Ltd
• Huizhou Tc Mobile Comm Co Ltd

Inventors

• Wu Xiaoyong
• Wu Xinxing
• Zhou Jinggao
• Zhu Hongmei

Classifications

• H04B5/70

  specially adapted for specific purposes · CPC title

• H04B5/20

  characterised by the transmission technique; characterised by the transmission medium · CPC title

• H04W4/008

  Electricity · mapped topic

• H04L63/0428

  wherein the data content is protected, e.g. by encrypting or encapsulating the payload · CPC title

• H04L9/08

  Key distribution {or management, e.g. generation, sharing or updating, of cryptographic keys or passwords (network architectures or network communication protocols for supporting key management in a packet data network H04L63/06)} · CPC title