CN1812366A - Method for realizing wireless local network virtual insertion point to-point communication - Google Patents

Abstract

The invention discloses a method for realizing communication between virtual access points of a wireless local area network, so as to solve the problem that in the prior art, when communicating between virtual APs of a wireless local area network, it is impossible to correctly distinguish which virtual AP a communication message belongs to and the security cannot be set for each virtual AP. Mechanism problem. The method adds the identification mark of the target virtual access point in the sent message, and the physical access point at the receiving end can distinguish the target virtual access point of the message according to the identification mark, thereby realizing the wireless local area network virtual access point correct communication among them, and at the same time, the present invention can set different security mechanisms for different virtual APs, thereby improving network security.

Description

Method for realizing communication between virtual access points of wireless local area network

technical field

The invention relates to a virtual access point of a wireless local area network, in particular to a method for realizing communication between virtual access points of a wireless local area network.

Background technique

In the actual application of AP (Access Point, access point), SSID (Service Set Identifier, service set identifier) can have multiple purposes. For example: SSID can identify different ISPs (Internet Service Provider, Internet Service Provider). When an AP connects to STAs (Stations, end stations (wireless network cards)) belonging to multiple ISPs, it is required that the AP supports multiple SSIDs and realizes the identification of different ISPs. The SS (Service Set, service set) marks different VLANs (Virtual Local Area Network, virtual local area network) to realize the isolation between SS (Service Set, service sets). Different SSIDs can also identify different service types, such as IP telephone service, data service, video service, and so on. At this time, it is necessary to provide different QoS (Quality of Service, service quality) guarantees for different SSs. In practical applications, this requirement may exist. For example, Wi-Fi (Wireless Fidelity, wireless local area network based on IEEE 802.11b standard) mobile phone users only need low-latency phone calls.

Each SSID corresponds to a virtual AP. According to user configuration, multiple SSIDs can be configured on a physical AP, and there may be multiple virtual APs, or there may be only one virtual AP. Each virtual AP exists in the network as an independent management entity, and there are certain connections. Most of the communication between APs occurs between virtual APs, so the communication problem between virtual APs needs to be solved. In network planning, taking the most commonly used IP protocol as an example, assigning a separate IP address to each virtual AP may cause waste of resources and conflicts, so IP addresses can only be assigned to physical APs. The ports for communication between physical APs are standardized and uniform, and cannot be set for virtual APs.

As shown in Figure 1, in the prior art, there is no concept of distinguishing between physical APs and virtual APs, the communication between APs is only carried out between physical APs, and the IAPP (Inter-Access Point Protocol, internal access point protocol) module or load balancing The module notifies the communication module of the message that needs to communicate, and the communication module sends it to the remote AP. After the remote AP communication module receives the message, it notifies the corresponding IAPP module or load balancing module, and vice versa.

The IAPP module and the load balancing module are two independent modules, and there is no logical relationship between them. The only similarity is that they all need to communicate and exchange messages between APs to complete the required functions. The communication module provides the communication service between APs for the IAPP module and the load balancing module, and the communication between APs can only be carried out through the communication module.

In the existing communication scheme between APs, only the IP address and designated port of the physical AP are used to realize the communication, and each application module analyzes and distributes the content of the communication message by itself. The physical AP processes the communication information between APs by its internal IAPP module and load balancing module. In the existing AP inter-AP communication scheme, there is no information that can be used to distinguish virtual APs. The receiver needs to use the content carried in the information, such as the STA’s MAC (Media Access Control, Media Access Control) address, the AP’s BSSID (Basic Service Set Identifier, Basic Service Set Identifier) etc. to distinguish. However, it is unreliable to distinguish only by these information, because the information stored on the AP may be incomplete, and the information stored by the sending end AP and the receiving end AP of the communication may also be inconsistent. At this time, it is impossible to correctly distinguish which virtual network the communication message belongs to. AP. Due to the need for application modules to participate in the identification process of virtual APs, it is impossible to set a security mechanism for each virtual AP, thereby bringing security risks to the WLAN (Wireless Local Area Network, wireless local area network) network and increasing the workload of each application module. This leads to inefficiency and unclear protocol processing levels.

Contents of the invention

The purpose of the present invention is to provide a method for realizing communication between virtual access points in a wireless local area network, so as to solve the problem that in the prior art, when communicating between virtual APs in a wireless local area The problem of AP setting security mechanism.

In order to solve the above problems, the present invention provides the following technical solutions:

A method for realizing communication between virtual access points of a wireless local area network, comprising the steps of:

A. The virtual access point at the sending end adds the identification mark of the target virtual access point in the sent message;

B. The physical access point at the receiving end transfers the message to the corresponding target virtual access point according to the distinguishing identifier.

Before step A, the virtual access point at the sending end uses the set security mechanism to perform security processing on the sent message, and after step B, the target virtual access point uses the corresponding security mechanism to perform reverse processing on the message. The security processing on the message is encryption and/or authentication, and the inverse processing on the message is decryption and/or verification. The virtual access point at the sending end can perform security processing on the whole message or part of the message.

Also include steps between said step A and step B:

A1. The physical access point at the sending end uses the set security mechanism to perform security processing on the message with the identification mark added;

A2. The physical access point at the receiving end uses the security mechanism corresponding to step A1 to reversely process the message with the identification mark added.

The security processing in the step A1 is encryption and/or authentication, and the inverse processing in the step A2 is decryption and/or verification. In the step A1, security processing may be performed on all or part of the message with the identification mark added.

The distinguishing mark can be located anywhere in the message.

The distinguishing identifier is a service set identifier.

Since the present invention adopts the above technical scheme, it has the following beneficial effects:

The present invention adds the identification mark of the target virtual access point in the message sent by the virtual access point of the sending end, and the physical access point of the receiving end can distinguish the target virtual access point of the message according to the identification mark, thereby realizing The correct communication between virtual access points of the wireless local area network is ensured, and at the same time, the present invention can set different security mechanisms for different virtual APs, thereby improving network security.

Description of drawings

FIG. 1 is a schematic diagram of communication between APs in the prior art;

Fig. 2 is the processing flow chart when carrying out the communication between virtual APs of the present invention;

FIG. 3 is a schematic diagram of message processing at the sending end of communication between virtual APs;

FIG. 4 is a schematic diagram of packet processing at a receiving end of communication between virtual APs.

Detailed ways

The process of the method for realizing the communication between the virtual APs of the wireless local area network of the present invention is as follows:

The virtual AP at the sending end adds the identification of the target virtual AP in the sent message, and the identification is used to identify the target virtual AP of the message sent; after the physical AP at the receiving end obtains the identification from the message, according to the identification Identify the target virtual AP of the message, and then deliver the message to the corresponding target virtual AP.

The identification of the target virtual AP can be located anywhere in the message, but in all messages between the virtual AP at the sending end and the target virtual AP, the identification needs to be placed in a fixed position, that is, in each message. The positions are all the same, so that the receiving end can quickly locate the identification mark, and it is not necessary to process the content of the message to know where the identification mark is stored.

Since each SSID corresponds to a virtual AP, the identification identifier of the target virtual AP is usually selected as the SSID, and the identification identifier can also be other identifiers defined manually, as long as the target virtual AP can be distinguished.

In order to ensure the security of the messages communicated between virtual APs, before adding the target virtual AP identification in the messages, the virtual AP at the sending end usually needs to set up a security mechanism to process the sent messages safely. The security processing is mainly through encryption. and/or authentication. The encryption process is to replace the plaintext in the communication content with ciphertext, so that unauthorized persons cannot obtain the content of the information. There are many encryption methods, such as DES, 3DES, RC5, RC4, AES, etc., which can be arbitrary according to the actual situation. select. The process of authentication is to calculate a digital signature that cannot be imitated without knowing the key according to the communication content, so as to prevent the communication content from being tampered with or forged. There are also many authentication methods, such as MD5, SHA, KPDK, SHA2, etc., according to The actual situation is optional. In order to ensure the security of communication between APs, the security mechanism is set separately for the virtual AP at the sending end and the target virtual AP.

When performing security processing, the message can only be encrypted or authenticated, or it can be encrypted and authenticated. When encrypting and authenticating the message, it should be Encrypt the message first, and then calculate the digital signature required for authentication based on the encrypted message. Encryption and/or authentication can be performed on the entire message, or only on a certain part of the message.

If the virtual AP at the sending end performs security processing on the message to be sent, after the physical AP at the receiving end passes the message to the corresponding target virtual AP according to the identification mark, the target virtual AP needs to use the corresponding security mechanism to process the message. inverse processing. If the virtual AP at the sending end encrypts the message to be sent, the target virtual AP needs to decrypt the message accordingly to obtain the plaintext; if the virtual AP at the sending end authenticates the message to be sent, the target virtual AP The message needs to be verified to ensure that the message has not been tampered with. If the virtual AP at the sending end performs double processing of encryption and authentication on the message to be sent, the target virtual AP first calculates the digital signature based on the content of the received message, and after ensuring that the message has not been tampered with The content of the text is decrypted to obtain the original message.

In order to further improve security and ensure that the identification mark of the target virtual AP is not tampered with, it is also possible to perform security processing on the message added with the identification mark according to the security mechanism set by the physical AP at the sending end. The security processing is mainly implemented through encryption and/or authentication, and may only encrypt the message, or only perform authentication on the message, or perform both encryption and authentication on the message. Encryption and/or authentication can be performed on the entire message, or only on a certain part of the message. The security mechanism process is set separately for each physical AP.

If the physical AP at the sending end performs security processing on the message with the identification tag added, the physical AP at the receiving end needs to use the corresponding security mechanism to perform reverse processing on the message. If the physical AP at the sending end authenticates the message with the identification mark added, the physical AP at the receiving end needs to perform a corresponding verification to ensure that the message has not been tampered with. If the physical AP at the sending end encrypts the message with the identification mark , the physical AP at the receiving end needs to decrypt to obtain the plaintext. If the physical AP at the sending end performs double processing of encryption and authentication on the message with the identification mark added, the physical AP at the receiving end first calculates the digital signature based on the content of the received message, and after ensuring that the message has not been tampered with or forged, then The contents of the message are decrypted to obtain the original message.

As shown in Figure 2, the preferred processing procedure of the method for realizing the communication between virtual APs of the wireless local area network of the present invention is as follows:

S1. The virtual AP at the sending end sets up a security mechanism to safely process the sent message;

S2. The virtual AP at the sending end adds the identification mark of the target virtual AP in the sent message;

S3. The physical AP at the sending end sets up a security mechanism to safely process the message with the identification mark added;

S4. The physical AP at the receiving end uses the security mechanism corresponding to step S3 to reversely process the message;

S5. The physical AP at the receiving end delivers the message to the corresponding target virtual AP according to the identification in step S2;

S6. The target virtual AP uses the security mechanism corresponding to step S1 to reversely process the message.

In the above process, steps S1, S2, and S3 are performed at the sending end, and steps S4, S5, and S6 are performed at the receiving end.

The present invention is effective for all communication protocols (such as IP). If the communication module recognizes that the source address and the target address in the communication protocol are consistent, it indicates that the target virtual AP and the virtual AP of the sending end are on the same physical AP, that is, the The invention is applied to the internal communication mechanism.

The whole process of communication between virtual APs of the present invention is described below with a specific embodiment:

As shown in Figure 3 and Figure 4, in the IAPP protocol of WLAN, in order to realize the switching between STAs between APs, APs need to communicate in order to exchange relevant information about this STA. The virtual AP sets the security mechanism independently, encrypts the original IAPP message with DES, then expands the message, adds SSID as the identification mark, and sends the message with the identification mark to the receiving end AP after MD5 authentication; the receiving end AP receives After receiving the message, first check the MD5 authentication word to ensure that the message has not been counterfeited or tampered with, and then perform DES decryption on the message according to the security mechanism independently set by the virtual AP to obtain the original IAPP message, which can solve the virtual The security and efficiency issues of the IAPP protocol work under the AP.

The present invention is described above only with preferred embodiments, and those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalent technologies, the present invention also intends to include these modifications and variations.

Claims (9)

1, a kind of method that realizes wireless local network virtual insertion point to-point communication is characterized in that comprising step:

The virtual access point of A, transmitting terminal adds the sign of distinguishing of target virtual access point in the message that sends;

The physical access point of B, receiving terminal is delivered to corresponding target virtual access point according to the described sign of distinguishing with described message.

2, the method for realization wireless local network virtual insertion point to-point communication according to claim 1, it is characterized in that: the security mechanism of the virtual access point utilization setting of transmitting terminal is carried out safe handling to the message that sends before steps A, and the security mechanism of target virtual access point utilization correspondence is carried out contrary the processing to message after step B.

3, the method for realization wireless local network virtual insertion point to-point communication according to claim 2 is characterized in that: the safe handling that message is carried out is to encrypt and/or authentication, and contrary processing that message is carried out is deciphering and/or verification.

4, the method for realization wireless local network virtual insertion point to-point communication according to claim 2 is characterized in that: the virtual access point of transmitting terminal can carry out safe handling to whole message or part message.

5, the method for realization wireless local network virtual insertion point to-point communication according to claim 1 and 2 is characterized in that: also comprise step between described steps A and step B:

The security mechanism of the physical access point utilization setting of A1, transmitting terminal distinguishes that to interpolation the message of sign carries out safe handling;

The physical access point utilization of A2, receiving terminal and steps A 1 corresponding security mechanism distinguishes that to interpolation the message of sign carries out contrary the processing.

6, the method for realization wireless local network virtual insertion point to-point communication according to claim 5 is characterized in that: the safe handling in the described steps A 1 is for encrypting and/or authentication, and contrary being treated in the described steps A 2 deciphered and/or verification.

7, the method for realization wireless local network virtual insertion point to-point communication according to claim 5 is characterized in that: can add whole or part in described steps A 1 and distinguish that the message of sign carries out safe handling.

8, the method for realization wireless local network virtual insertion point to-point communication according to claim 1 is characterized in that: the described sign of distinguishing can be positioned at the optional position of message.

9, the method for realization wireless local network virtual insertion point to-point communication according to claim 1 is characterized in that: described distinguishing is designated service set.

Images