WO2018040805A1 - 无线局域网中建立关联的方法、终端和接入点 - Google Patents

无线局域网中建立关联的方法、终端和接入点 Download PDF

Info

Publication number
WO2018040805A1
WO2018040805A1 PCT/CN2017/094374 CN2017094374W WO2018040805A1 WO 2018040805 A1 WO2018040805 A1 WO 2018040805A1 CN 2017094374 W CN2017094374 W CN 2017094374W WO 2018040805 A1 WO2018040805 A1 WO 2018040805A1
Authority
WO
WIPO (PCT)
Prior art keywords
terminal
access point
message
association
information
Prior art date
Application number
PCT/CN2017/094374
Other languages
English (en)
French (fr)
Inventor
方平
杨云松
庞高昆
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Priority claimed from CN201610995436.8A external-priority patent/CN107786972B/zh
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to US16/328,842 priority Critical patent/US10674353B2/en
Priority to EP17845107.6A priority patent/EP3499936B1/en
Publication of WO2018040805A1 publication Critical patent/WO2018040805A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H04L63/1466—Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/02—Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H04W12/069—Authentication using certificates or pre-shared keys
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W8/00—Network data management
    • H04W8/22—Processing or transfer of terminal data, e.g. status or physical capabilities
    • H04W8/24—Transfer of terminal data
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W48/00—Access restriction; Network selection; Access point selection
    • H04W48/08—Access restriction or access information delivery, e.g. discovery data delivery
    • H04W48/14—Access restriction or access information delivery, e.g. discovery data delivery using user query or user detection
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W76/00—Connection management
    • H04W76/10—Connection setup
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W84/00—Network topologies
    • H04W84/02—Hierarchically pre-organised networks, e.g. paging networks, cellular networks, WLAN [Wireless Local Area Network] or WLL [Wireless Local Loop]
    • H04W84/10—Small scale networks; Flat hierarchical networks
    • H04W84/12—WLAN [Wireless Local Area Networks]

Definitions

  • the embodiments of the present invention relate to the field of communications, and in particular, to a method, a terminal, and an access point for establishing association in a wireless local area network in the communication field.
  • WiFi Wireless Fidelity
  • APs WiFi access points
  • WiFi network interface for low-cost or free network access.
  • the terminal Before sending the association request message to the AP, the terminal first sends a probe request message to the AP, where the probe request message carries the device information of the terminal, for example, the capability information of the device, the supported rate information (Support rates), and the extended support. Extended Supported Rates and Vendor Specific.
  • the device information does not change under normal conditions, that is, the device information carried in the probe request message before the terminal is associated with the AP remains unchanged for a long time.
  • One of the pieces of information is not global or globally unique between different devices, but a combination of one or more of the information may become a kind of "fingerprint" information of the device. "Information in a local area or even the entire network may be able to uniquely identify the device to a large extent.
  • the eavesdropper receives the probe request message on the air interface and analyzes the "fingerprint" information carried in the message.
  • the device can be traced to obtain the user's private information. For example, the eavesdropper obtains the location and time that the user often appears, so that the user's living habits, social relationships, and even social relationships can be obtained through a large amount of data analysis.
  • the present application proposes a method, a terminal and an access point for establishing association in a wireless local area network, so as to solve the problem that user privacy is leaked in the process of association between the terminal and the access point.
  • the first aspect provides a method for establishing association in a wireless local area network, where the method includes: the terminal generates the encrypted capability information of the terminal; and the terminal receives the pre-association index information related to the terminal sent by the access point.
  • the pre-association index information is used by the access point to identify the terminal when the terminal has not established association with the access point; and the terminal sends the encrypted terminal capability to the access point.
  • the association request message includes the pre-association index information; the terminal receives an association response message sent by the access point according to the capability information of the terminal and the pre-association index information, thereby The terminal is associated with the access point.
  • the pre-association index information can identify the terminal.
  • the terminal may be in the process of establishing the current association or the association.
  • the method includes: when the STA sends an association request message to the AP, or when the AP receives the association request message sent by the STA.
  • the index information may also be used after the terminal successfully establishes the association with the access point, for example, for the next time before the terminal associates with the access point or during the association process.
  • the capability information of the terminal is sent to the access point in an encrypted manner, and the terminal is identified by associating the pre-index information, so that the eavesdropper can monitor the capability information of the terminal even before the association or during the association process.
  • the capability information of the terminal cannot be obtained, so that the eavesdropper can be prevented from determining the location, time, and other information of the terminal according to the capability information of the terminal, thereby avoiding leakage of user privacy.
  • the terminal sends, to the access point, the encrypted capability information of the terminal and an association request message (which may be referred to as an Association Request message), including:
  • the terminal sends the association request message to the access point, where the association request message includes the encrypted capability information of the terminal.
  • the capability information of the encrypted terminal is carried by the association request message, which can further save signaling overhead and improve utilization of radio resources.
  • the terminal sends the encrypted capability information and the association request message of the terminal to the access point, including: the terminal to the access point Sending a first message, where the first message includes the encrypted capability information of the terminal, the first message is a management message; and the terminal sends the association request message to the access point.
  • the method before the terminal sends the encrypted capability information of the terminal to the access point, the method further includes: the terminal is connected to the terminal Transmitting a public key of the terminal, the public key of the terminal is used by the access point to generate a decryption key for decrypting capability information of the encrypted terminal, where the terminal receives the access point to send The pre-association index information related to the terminal occurs after the terminal sends the public key of the terminal to the access point; the terminal receives the public key of the access point sent by the access point The terminal generates an encryption key of the terminal according to the public key of the access point, and the encryption key of the terminal is used to encrypt capability information of the terminal.
  • the transmitting, by the terminal, the public key of the terminal to the access point includes: the terminal sending a probe request message to the access point (ie, : Probe Request message), the probe request message includes a public key of the terminal; or the terminal sends a second message to the access point, where the second message includes a public key of the terminal,
  • the second message is a management message.
  • the receiving, by the terminal, the public key of the access point that is sent by the access point includes: the terminal receiving the detection sent by the access point a response message (Probe Response message), the probe response message includes a public key of the access point; or the terminal receives a third message sent by the access point, where the third message includes the access The public key of the point, the third message is a management message; or the terminal receives a beacon frame sent by the access point, where the beacon frame includes a public key of the access point.
  • the method further includes: the terminal receiving indication information sent by the access point, where the indication information is used to indicate that the access point supports Transmitting, by the terminal, device capability information of the terminal that is encrypted.
  • the method further includes: receiving, by the terminal, the indication information sent by the access point, where the terminal receives the detection sent by the access point a response message, the probe response message includes the indication information; or the terminal receives a fourth message sent by the access point, the fourth message includes the indication information, and the fourth message is a management message Or the terminal receives a beacon frame (ie, a Beacon frame) sent by the access point, where the beacon frame includes the indication information.
  • a beacon frame ie, a Beacon frame
  • the receiving, by the terminal, the pre-association index information sent by the access point includes: receiving, by the terminal, a fifth message sent by the access point, where the The fifth message includes the pre-association index information, and the fifth message is The management message (eg, an Action Frame); or the terminal receives the probe response message sent by the access point, where the probe response message includes the pre-association index information.
  • the management message eg, an Action Frame
  • the terminal sends the MAC address used by the association request message to the access point, and the terminal sends the association to the access point.
  • the MAC address used before the request message is different.
  • the access point can still identify the terminal.
  • the first message and the second message are the same message, and the message includes content included in the first message and the second message.
  • the first message and the second message are separate messages.
  • independent message herein may be a concept opposite to the same message described above, that is, the first message and the second message may be different separately transmitted messages.
  • the third message, the fourth message, and the fifth message are the same message, and the message includes the third message, the fourth message, and the fifth message. What is included.
  • At least two of the third message, the fourth message, and the fifth message are independent messages.
  • independent message herein may be a concept opposite to the same message described above, that is, at least two of the third message, the fourth message, and the fifth message may be different separately transmitted messages.
  • a second aspect provides a method for establishing association in a wireless local area network, where the method includes: an access point generates pre-association index information related to a terminal, where the pre-association index information is used by the access point at the terminal Identifying the terminal when the connection point has not been associated; the access point sends the pre-association index information to the terminal; and the access point receives the encrypted terminal capability sent by the terminal Information and association request message, the association request message includes the pre-association index information; the access point decrypts the capability information of the encrypted terminal; the access point is based on the capability information of the terminal and the association
  • the pre-index information sends an association response message (which may be referred to as an Association Response message) to the terminal, so that the access point establishes association with the terminal.
  • the access point receives, by the terminal, the encrypted capability information and the association request message of the terminal, where the access point receives the The association request message sent by the terminal, where the association request message includes the encrypted capability information of the terminal.
  • the access point receives, by the terminal, the encrypted capability information and the association request message of the terminal, where the access point receives the The first message sent by the terminal, the first message includes the encrypted capability information of the terminal, the first message is a management message, and the access point receives an association request message sent by the terminal.
  • the method before the access point receives the encrypted capability information of the terminal sent by the terminal, the method further includes: receiving, by the access point a public key of the terminal sent by the terminal, where the sending, by the access point, the pre-association index information to the terminal occurs after the access point receives the public key of the terminal sent by the terminal.
  • the access point generates a decryption key according to the public key of the terminal, the decryption key is used to decrypt the encrypted capability information of the terminal; and the access point sends the connection to the terminal
  • the public key of the ingress, the public key of the access point is used by the terminal to generate an encryption key for encrypting capability information of the terminal.
  • the receiving, by the access point, the public key of the terminal sent by the terminal includes: the access point receiving a probe request message sent by the terminal The probe request message includes a public key of the terminal; or the access point receives a second message sent by the terminal, the second message includes a public key of the terminal, and the second message is Manage messages.
  • the sending, by the access point, the public key of the access point to the terminal includes: the access point sending a probe response message to the terminal The probe response message includes a public key of the access point; or the access point sends a third message to the terminal, where the third message includes a public key of the access point, where the The three messages are management messages; or the access point sends a beacon frame to the terminal, the beacon frame including a public key of the access point.
  • the method further includes: the access point sending the indication information to the terminal, where the indication information is used to indicate that the access point supports and The transmission of the device capability information of the terminal that the terminal performs encryption.
  • the sending, by the access point, the indication information to the terminal that: the access point sends a probe response message to the terminal, the probe response message Including the indication information; or the access point sends a fourth message to the terminal, the fourth message includes the indication information, and the fourth message is a management message; or, the access point is The terminal transmits a beacon frame, and the beacon frame includes the indication information.
  • the sending, by the access point, the pre-association index information to the terminal includes: the access point sending a fifth message to the terminal, where The fifth message includes the pre-association index information, and the fifth message is a management message; or the access point sends a probe response message to the terminal, where the probe response message includes the pre-association index information.
  • the method before the receiving the association request message sent by the terminal, the method further includes: the access point generating an encrypted access point Capability information; the access point transmits capability information of the encrypted access point to the terminal.
  • a third aspect provides a terminal, where the terminal is configured to perform the method provided by the foregoing method embodiments, where the terminal includes: a generating module, configured to generate an encrypted capability information of the terminal; and a receiving module, And a pre-association index information sent by the access point, where the pre-association index information is used by the access point to identify the terminal, and the sending module is configured to send, to the access point, the encrypted capability information of the terminal.
  • the association request message the association request message includes the pre-association index information; the receiving module is further configured to receive an association response message sent by the access point according to the capability information of the terminal, so that the terminal and the The access point establishes an association.
  • a fourth aspect provides an access point, where the access point is used to perform the method provided by the foregoing method embodiments of the second aspect, where the access point includes: a generating module, configured to generate an association related to the terminal Index information, the pre-association index information is used by the access point to identify the terminal when the terminal has not been associated with the access point, and the sending module is configured to send the pre-association index to the terminal.
  • the access point includes: a generating module, configured to generate an association related to the terminal Index information, the pre-association index information is used by the access point to identify the terminal when the terminal has not been associated with the access point, and the sending module is configured to send the pre-association index to the terminal.
  • a receiving module configured to receive the encrypted capability information of the terminal and the association request message sent by the terminal, where the association request message includes the pre-association index information
  • a decryption module configured to decrypt the encrypted terminal
  • the sending module is further configured to: send an association response message to the terminal according to the capability information of the terminal and the pre-association index information, so that the access point establishes an association with the terminal.
  • a fifth aspect provides a terminal, where the terminal is configured to perform the method provided by the foregoing method embodiments, where the terminal includes: a processor 1101, a memory 1102, a transmitter 1103, and a receiver 1105.
  • the aforementioned various components are coupled together by a coupling, the receiver 1105 receives data through the antenna 1104, and the transmitter 1103 transmits data through the antenna 1104.
  • the processor 1101 is configured to generate the encrypted capability information of the terminal, and the receiver 1105 is configured to receive pre-association index information sent by the access point, where the pre-association index information is used by the access point identifier.
  • a transmitter 1103 configured to send, to the access point, the encrypted capability information of the terminal and an association request message, where the association request message includes the pre-association index information; the receiver 1104 further uses Receiving, by the access point, an association response message sent according to the capability information of the terminal and the pre-association index information, so that the terminal establishes association with the access point.
  • the sixth aspect provides an access point, where the access point is used to perform the method provided by the foregoing method embodiments, where the access point includes: a processor 1201, a memory 1202, a transmitter 1203, and a receiving 1205, each component in the terminal passes through the coupled side Connected together, receiver 1205 receives data via antenna 1204, and transmitter 1203 transmits data via antenna 1204.
  • the processor 1201 is configured to generate pre-association index information related to the terminal, where the pre-association index information is used by the access point to identify the terminal when the terminal has not established association with the access point.
  • the sender 1203 is configured to send the pre-association index information to the terminal, and the receiver 1205 is configured to receive the encrypted capability information of the terminal and the association request message sent by the terminal, where the association request message includes The pre-association index information; the processor 1201 is configured to decrypt the capability information of the encrypted terminal; the transmitter 1203 is further configured to send, according to the capability information of the terminal and the pre-association index information, to the terminal The response message is associated such that the access point and the terminal establish an association.
  • a seventh aspect a computer readable medium for storing a computer program, the computer program comprising instructions for performing the method of the first aspect or any of the possible implementations of the first aspect.
  • a computer readable medium for storing a computer program comprising instructions for performing the method of the second aspect or any of the possible implementations of the second aspect.
  • a ninth aspect a system for communication, comprising the terminal of the third aspect and the access point of the fourth aspect.
  • a tenth aspect a system for communication, comprising the terminal according to the fifth aspect and the access point according to the sixth aspect.
  • the capability information of the terminal is sent to the access point in an encrypted manner, so that the eavesdropper cannot decrypt the capability of acquiring the encrypted terminal even if it is listening to the capability information of the encrypted terminal in the air interface before the association or in the association process.
  • the information can prevent the eavesdropper from determining the location, time, and other information of the terminal according to the capability information of the terminal, thereby avoiding leakage of user privacy.
  • the access point identifies the terminal by assigning pre-association index information to the terminal by using the pre-association index information, so that the terminal uses the MAC address used before sending the association request message to the access point and sending the association request message.
  • the MAC address is different, and the access point can still identify the terminal by associating the pre-index information, and determine the decryption key to decrypt the device capability information of the encrypted terminal, thereby obtaining the device capability information of the terminal.
  • FIG. 1 is an application scenario that may be used in an embodiment of the present invention
  • FIG. 2 is a schematic block diagram of a smartphone according to an embodiment of the present invention.
  • FIG. 3 is a flowchart of a method for establishing association in a wireless local area network according to an embodiment of the present invention
  • FIG. 4 is a flowchart of a method for establishing association in a wireless local area network according to another embodiment of the present invention.
  • FIG. 5 is a flowchart of a method for establishing association in a wireless local area network according to still another embodiment of the present invention.
  • FIG. 6 is a flowchart of a method for establishing association in a wireless local area network according to still another embodiment of the present invention.
  • FIG. 7 is a flowchart of a method for establishing association in a wireless local area network according to still another embodiment of the present invention.
  • FIG. 8 is a flowchart of a method for establishing association in a wireless local area network according to still another embodiment of the present invention.
  • FIG. 9 is a schematic block diagram of a terminal according to an embodiment of the present invention.
  • FIG. 10 is a schematic block diagram of an access point according to an embodiment of the present invention.
  • FIG. 11 is a schematic block diagram of a terminal according to another embodiment of the present invention.
  • FIG. 12 is a schematic block diagram of an access point according to another embodiment of the present invention.
  • FIG. 13 is a schematic block diagram of a terminal according to still another embodiment of the present invention.
  • Figure 14 is a schematic block diagram of an access point in accordance with still another embodiment of the present invention.
  • Embodiments of the present invention can be applied to various wireless communication systems, such as: Wireless Fidelity (WIFI), Bluetooth, and Worldwide Interoperability for Microwave Access (WiMAX), A system such as a Wireless LAN Authentication and Privacy Infrastructure (WAPI) and other communication systems that interconnect terminals wirelessly.
  • WIFI Wireless Fidelity
  • WiMAX Worldwide Interoperability for Microwave Access
  • a system such as a Wireless LAN Authentication and Privacy Infrastructure (WAPI) and other communication systems that interconnect terminals wirelessly.
  • WiFI Wireless Fidelity
  • WiMAX Worldwide Interoperability for Microwave Access
  • a system such as a Wireless LAN Authentication and Privacy Infrastructure (WAPI) and other communication systems that interconnect terminals wirelessly.
  • An Access Point also known as a wireless access point or bridge or hotspot, can access a server or communication network.
  • STA which may be a wireless sensor, a wireless communication terminal or a mobile terminal, such as a mobile phone (or "cellular" phone) that supports WiFi communication function and a computer with wireless communication function, for example, may support WiFi Communication, portable, pocket, handheld, computer built-in or in-vehicle wireless communication devices that exchange language and/or data with a wireless access network.
  • STA may be a wireless sensor, a wireless communication terminal or a mobile terminal, such as a mobile phone (or "cellular" phone) that supports WiFi communication function and a computer with wireless communication function, for example, may support WiFi Communication, portable, pocket, handheld, computer built-in or in-vehicle wireless communication devices that exchange language and/or data with a wireless access network.
  • FIG. 1 is an application scenario that may be used in an embodiment of the present invention.
  • the STA before sending an association request to an AP, the STA first sends a probe request message to the AP, where the probe request message may include device information of the STA, and receive a probe response message sent by the AP according to the content of the probe request message.
  • the terminal receives the beacon frame sent by the access point, and the beacon frame may include device information of the access point.
  • the terminal then sends an association request message to the AP, receives the association response message sent by the AP, and completes association with the AP.
  • the terminal After being associated with the AP, the terminal can establish a secure connection with the AP through the security authentication message, so as to perform subsequent data transmission.
  • the device information of the STA carried in the probe request message and/or the association request message is sent through an air interface, and the personalized information in the device information of the STA easily constitutes the STA.
  • the fingerprint information can be traced to the STA by the eavesdropper by receiving and analyzing the probe request message and/or the association request message message on the air interface, resulting in leakage of the user's private information.
  • the STA with the WiFi function when the STA with the WiFi function is in the unconnected state, the STA will periodically send a probe request message to scan the surrounding access points. Even if the STA is connected to the current AP, the STA will still be in the actual situation. The sending probe request message scans the surrounding access points, so that when the signal of the current access point becomes weak, the STA can quickly complete the switching of the access point.
  • the STA sends a probe request in the associated state and the unassociated state, and the probe request carries device information, such as device capability information, support rate information, and other personalized information, MAC address information, etc., of which all of these devices
  • device information such as device capability information, support rate information, and other personalized information, MAC address information, etc., of which all of these devices
  • the information or part of the information easily constitutes the "fingerprint" information of the STA, and the eavesdropper can obtain the information such as the location and time of the STA by listening to the information, thereby obtaining the user's private information through analysis.
  • the problem of leaking user privacy for the MAC address of the STA can be solved by the method of the temporary MAC address, that is, when the STA sends the probe request, the STA uses the temporary MAC address, and uses the real MAC address in the actual association process with the AP.
  • This method can prevent the eavesdropper from leaking the user's private information by listening to the MAC address to a certain extent, but the "fingerprint" information formed by the device information included in the probe request still reveals the user's private information.
  • FIG. 2 is a block diagram showing a partial structure of a smartphone 100 related to an embodiment of the present invention.
  • the smart phone 100 includes a radio frequency (Radio Frequency, abbreviated as "RF") circuit 110, a memory 120, an input unit 130, a display unit 140, an audio circuit 150, a WiFi module 160, a processor 170, and a power source 180.
  • RF Radio Frequency
  • FIG. 4 does not constitute a limitation to the mobile phone, and may include more or less components than those illustrated, or combine some components, or split some components, or Different parts are arranged.
  • the RF circuit 110 can be used for receiving and transmitting signals during transmission and reception of information or during a call.
  • the processing is performed by the processor 170.
  • data related to the uplink is sent to Base station.
  • the RF circuit 110 includes, but is not limited to, an antenna, at least one amplifier, a transceiver, a coupler, and a low noise amplifier (Low Noise) Amplifier, referred to as "LNA", duplexer, etc.
  • LNA Low Noise amplifier
  • RF circuitry 110 can also communicate with the network and other devices via wireless communication.
  • the wireless communication can use any communication standard or protocol, including but not limited to Global System of Mobile Communication (“GSM”), General Packet Radio Service (“GPRS”). , Code Division Multiple Access (“CDMA”), Wideband Code Division Multiple Access (WCDMA), Long Term Evolution (LTE) , email, short message service (Short Messaging Service, referred to as "SMS").
  • GSM Global System of Mobile Communication
  • GPRS General Packet Radio Service
  • CDMA Code Division Multiple Access
  • WCDMA Wideband Code Division Multiple Access
  • LTE Long Term Evolution
  • SMS short message service
  • the memory 120 can be used to store software programs, and the processor 170 executes various functional applications and data processing of the smartphone 100 by running software programs stored in the memory 120.
  • the memory 120 may mainly include a storage program area and a storage data area, wherein the storage program area may store an operating system, an application required for at least one function (such as a sound playing function, an image playing function, etc.), and the like; the storage data area may be stored. Data (such as audio data, phone book, etc.) created according to the use of the smartphone 100.
  • memory 120 can include high speed random access memory, and can also include non-volatile memory, such as at least one magnetic disk storage device, flash memory device, or other volatile solid state storage device.
  • the input unit 130 can be configured to receive input numeric or character information and to generate key signal inputs related to user settings and function control of the smartphone 100.
  • the input unit 130 may include a touch panel and other input devices.
  • a touch panel also referred to as a touch screen, can collect touch operations on or near the user (such as the user using a finger, a stylus, or the like, any suitable object or accessory on or near the touch panel).
  • the corresponding connecting device is driven according to a preset program.
  • the touch panel may include two parts: a touch detection device and a touch controller.
  • the touch detection device detects the touch orientation of the user, and detects a signal brought by the touch operation, and transmits the signal to the touch controller; the touch controller receives the touch information from the touch detection device, converts the touch information into contact coordinates, and sends the touch information.
  • touch panels can be implemented in various types such as resistive, capacitive, infrared, and surface acoustic waves.
  • the input unit may also include other input devices. Specifically, other input devices may include, but are not limited to, one or more of a physical keyboard, function keys (such as volume control buttons, switch buttons, etc.), trackballs, mice, joysticks, and the like.
  • the display unit 140 can be used to display information input by the user or information provided to the user as well as various menus of the device.
  • the display unit 140 may include a display panel.
  • the display panel may be configured in the form of a Liquid Crystal Display (“LCD”) or an Organic Light-Emitting Diode (OLED).
  • the touch panel may cover the display panel, and when the touch panel detects a touch operation on or near the touch panel, the touch panel transmits to the processor to determine the type of the touch event, and then the processor 170 displays the panel according to the type of the touch event. Provide corresponding visual output on it.
  • the touch panel and the display panel are two independent components to implement the input and output functions of the smart phone 100, in some embodiments, the touch panel and the display panel may be integrated to realize the smart function. The input and output functions of the mobile phone 100.
  • the audio circuit 150, the speaker, and the microphone can provide an audio interface between the user and the smartphone 100.
  • the audio circuit 150 can transmit the converted electrical data of the received audio data to the speaker, and convert it into a sound signal output by the speaker; on the other hand, the microphone converts the collected sound signal into an electrical signal, which is received by the audio circuit 150 and then converted.
  • the audio data is output to memory 170 for further processing.
  • the WiFi module 160 is a chip basic circuit set integrating the WiFi function, and the WiFi module 160 can perform wireless transmission according to the protocol.
  • the processor 170 is a control center of the smartphone 100 that connects various portions of the entire smartphone 100 using various interfaces and lines, by running or executing software programs and/or modules stored in the memory, and recalling stored in the memory 120. Number According to the various functions and processing data of the smartphone 100, the smartphone 100 is monitored as a whole.
  • the processor 170 may include one or more processing units; optionally, the processor 170 may integrate an application processor and a modem processor, where the application processor mainly processes an operating system, a user interface, and an application. Etc.
  • the modem processor primarily handles wireless communications. It can be understood that the above modem processor may not be integrated into the processor 170.
  • the foregoing mobile phone including the WiFi module can serve as both an access point and a terminal associated with the access point, regardless of whether it is an access point or a terminal as an associated access point, since the mobile phone contains a large amount of personal privacy information of the user. Therefore, the mobile phone has a privacy protection requirement when it is used as a terminal associated with the access point or as an access point.
  • the mobile phone as the terminal associated with the access point may be an application scenario of the embodiment of the present invention, that is, the terminal in the embodiment of the present invention may be the mobile phone described herein, and the structure of the terminal may be referred to.
  • a partial structural block diagram of the handset e.g., the transmitter and receiver of the terminal may correspond to the RF circuitry of the handset, which may perform similar or identical functions) and may have more or fewer components.
  • FIG. 3 is a schematic diagram of a method for establishing an association in a wireless local area network according to an embodiment of the present invention.
  • the method may be used in an application scenario where a wearable device is used as an AP and a mobile phone as an AP.
  • a STA may also be called a terminal, and the method includes:
  • the terminal generates capability information of the encrypted terminal.
  • the terminal may encrypt the personalized capability information of the terminal to generate capability information of the encrypted terminal.
  • the personalized capability information of the terminal may be capability information unique to the terminal, that is, the eavesdropper may track the device according to the “fingerprint” information composed of the personalized information of the terminal.
  • the capability information of the terminal may also include the general capability information of the terminal, and the capability information of the terminal may be all the information or the partial information in the device information of the terminal, which is not limited in this embodiment of the present invention.
  • the AP may also generate capability information of the encrypted AP. It should be understood that the capability information of the AP may be all information or partial information in the device information of the AP.
  • the AP can determine the capability information of the AP that performs the encrypted transmission according to the requirements of the secure transmission.
  • the AP is associated with the AP, and the AP may also have the requirement of protecting the privacy.
  • the AP may also generate the capability information of the encrypted AP, where the AP capability information may be all in the AP device information. Or part of the information.
  • the access point generates pre-association index information related to the terminal, where the pre-association index information is used to identify the terminal when the terminal has not established association with the access point.
  • the access point generates the pre-association index information, and the pre-association index information may not change in a period of time.
  • the AP may also set the pre-association index to be long enough, and the pre-association index information is in a long time. Can be kept unique. In this way, after the AP generates the pre-association index, the AP can identify a specific terminal for a long time, and then determine the capability information of the terminal corresponding to the pre-association index according to the pre-association index information, and can determine the use in the subsequent association process. Establish an association with the capabilities corresponding to the terminal.
  • the pre-association index information may also correspond to a terminal, and the pre-association index information generated by the AP remains unique within the valid time of the index information, that is, each terminal corresponds to different pre-association index information, that is, before the association.
  • the index information is in a one-to-one relationship with the terminal.
  • the pre-association index information herein may be an identity (ID) identifier, or a string of numbers, or a certain character, or a combination of numbers and characters, etc., for which the embodiment of the present invention does not Make a limit.
  • the pre-association index information may be generated before the association, and the validity period may be different.
  • the STA may be invalid after the STA completes the association with the AP; or may be for a long time, so that the STA completes the association with the AP.
  • the pre-association index information is still valid when the STA is associated with the AP next time.
  • the AP generates pre-association index information, where the pre-association index information may also identify the terminal. Capability information. For example, when the terminal has the capability information 1, the AP generates pre-association index information 1 corresponding to the capability information 1. When the terminal has the capability information 2, the AP generates pre-association index information 2 corresponding to the capability information 2. During the actual association between the AP and the terminal, the AP may determine the capability information of the terminal according to the pre-association index information, and then use the corresponding capability to perform data transmission with the terminal.
  • the pre-association index information generated by the AP corresponds to different device capability information
  • the same pre-association index information may correspond to multiple terminals, which is a one-to-many relationship.
  • the terminal having the capability information 1 may correspond to Associated information 1.
  • the pre-association index information is used to identify the capability information of the terminal, there may be only a limited number of pre-association index information, so that the personalized device capability information of the terminal is prevented from forming a "fingerprint", which causes leakage of private information and improves terminal privacy. Protection ability.
  • the AP may also generate encrypted pre-association index information.
  • the eavesdropper can prevent the eavesdropper from obtaining the pre-association index information through the air interface, thereby better protecting the privacy of the user.
  • the order relationship between the capability information of the S110 generating the encrypted terminal and the pre-association index information generated by S320 is not limited. It can be the capability information of the terminal Mr. Encryption, or it can be the index information of Mr. AP before the association.
  • the access point sends the pre-association index information to the terminal.
  • the access point may also send the encrypted pre-association index information to the terminal, which is not limited in this embodiment of the present invention.
  • the access point may send a fifth message to the terminal, where the fifth message includes the pre-association index information.
  • the fifth message may be a newly defined frame.
  • the fifth message may be a management frame, such as an Action frame or a Public Action frame, in the Action frame. Carry the above pre-association index information.
  • the access point may further receive an associated frame sent by the terminal, where the associated frame may include general capability information of the terminal, where the associated frame may also be A newly defined management frame, for example, an Action frame. That is, when the terminal sends the general capability information of the terminal to the access point through the newly defined management frame, the access point may send the pre-association index information to the terminal through the newly defined fifth message.
  • the access point may also send the encrypted pre-association index information through the fifth message.
  • the access point may send a probe response message to the terminal, where the probe response message includes pre-association index information.
  • the method further includes: the terminal sending the probe request message to the access point.
  • the terminal sends a probe request message to the AP, where the probe request message may include general capability information of the terminal, and it should be understood that the terminal may also determine the probe according to the demand for privacy protection.
  • the general capability information included in the request information for example, when the terminal has a high demand for privacy protection, all device capability information that can be used by the eavesdropper to generate a "fingerprint" will not be transmitted.
  • the access point may also encrypt the pre-association index information, that is, the access point may send the encrypted pre-association index information to the terminal by detecting the response message. After the access point receives the probe request message of the terminal, the access point sends a probe response message of the probe request message to the terminal, where the probe response message may include pre-association index information generated by the AP.
  • the access point when the terminal sends the newly defined management frame to transmit the general capability information, the access point sends the newly defined associated frame to the terminal, which is used to transmit the pre-association index information.
  • the terminal may carry the general capability information of the terminal by using the probe request message, and the access point may send the pre-association index information to the terminal by using the newly defined frame.
  • the terminal may send the pre-association index information of the terminal to the access point by using the newly defined frame, and the access point may send the pre-association index information to the terminal in the probe response message.
  • the newly defined frame here can be a management frame, such as an Action frame.
  • the S330 step does not define a sequential relationship with the S310 step.
  • the AP transmits the pre-association index information as long as the terminal initiates the association request.
  • the pre-association index information is used by the terminal to be carried in the association request, so that the AP identifies the terminal corresponding to the association request.
  • the terminal sends the capability information and the association request message of the encrypted terminal to the access point, where the pre-association request message includes the pre-association index information.
  • the capability information and the association request message of the encrypted terminal may be sent simultaneously, or may be sent in different messages.
  • the capability information of the encrypted terminal is sent first, and then the association request message is sent.
  • the capability information for the terminal to send the encrypted terminal to the access point can be implemented in various ways, which will be described below for a specific implementation.
  • the terminal sends the capability information and the association request message of the encrypted terminal to the access point, including:
  • the terminal sends an association request message to the access point, where the association request message includes the encrypted capability information of the terminal.
  • the terminal may include an IE in the association request message sent to the AP, where the IE carries the encrypted capability information of the terminal, that is, by creating a new information element in the pre-association request message. (Information Element, IE) to carry the encrypted capability information of the terminal.
  • the AP may determine the terminal according to the pre-association index information, and determine a key previously negotiated with the terminal, so that the AP determines to use the corresponding key to decrypt the received encrypted terminal. Capability information.
  • the terminal sends the encrypted capability information and the association request message of the terminal to the access point, including:
  • the terminal sends a first message to the access point, where the first message includes the encrypted capability information of the terminal, where the first message is a management message;
  • the terminal sends the association request message to the access point.
  • the first message may be a newly defined frame.
  • the first message may be a management frame, such as an Action frame or a Public Action frame, and the terminal may carry the encrypted terminal by using the Action frame. Capability information, of course, the first message can also be other types of frames.
  • the terminal sends an association request message to the access point, where the association request message carries the pre-association index information.
  • an IE may be created in the association request message, and the pre-association index information is carried in the IE.
  • the pre-association index information is generated by the AP and sent to the terminal, and the terminal may carry the pre-association index information in the association request information, so that the AP can determine the terminal according to the pre-association index information. In this way, even if the associated message and the message previously sent by the terminal to the AP use different MAC addresses, the AP can still determine the correspondence between the terminals according to the pre-association index information.
  • the terminal may send the first message to the access point before the terminal sends the association request message, that is, before the terminal sends the association request message to the AP, the AP may already acquire the capability information of the terminal; the AP sends the association to the terminal.
  • the pre-index information may be used before the terminal sends the first message, or after the terminal sends the first message, which is not limited in this embodiment of the present invention; however, the AP sends the pre-association index information before the terminal sends the association request message; The in-point sends the pre-association index information to the terminal.
  • the terminal After the terminal sends the first message, the terminal sends the encrypted capability information of the terminal by using the first message, and the AP sends the pre-association index to the terminal after receiving the capability information of the terminal.
  • the information is sent to the terminal, and when the terminal sends the association request message to the access point, the pre-association index information allocated by the previous AP for the terminal is carried, so that the terminal sends the association request message.
  • the AP can also determine the capability information of the terminal according to the pre-association index information carried in the association request message.
  • the AP allocates pre-association index information to the terminal.
  • the pre-association index information allocated by the access point for the terminal may be used to identify the capability information of the terminal, for example, After the access point obtains the encrypted capability information of the terminal, the access point identifies the capability information 1 of the terminal by using the pre-association index information 1 and sends the pre-association index information 1 to the terminal.
  • the pre-association index information 1 can be used by the access point to determine the capability information of the terminal by using the pre-association index information 1.
  • the capability information of the terminal may be sent before the association request message by using the first message, and therefore, the capability information of the terminal may not be included in the association request message, or the association request message may be Only the general capability information of the terminal is included, and the access point can determine the corresponding terminal by associating the pre-request message.
  • the terminal sending the encrypted capability information of the terminal to the access point includes:
  • the terminal sends a probe request message to the access point, where the probe request message includes the encrypted capability information of the terminal.
  • the terminal sends a probe request message to the access point, and may create an IE in the probe request message, and carry the capability information of the encrypted terminal in the IE, and of course, may also be existing in the probe request message.
  • the IE carries the capability information of the encrypted terminal.
  • the MAC address used by the terminal to send the association request message to the access point is different from the MAC address used by the message before the terminal sends the association request message to the access point.
  • the terminal in the process of associating with the AP, the terminal is in the scanning phase, that is, the MAC address and the terminal and the AP used by the terminal to perform signaling interaction with the AP before the terminal sends the association request to the AP.
  • the MAC address used for the association may be different. Therefore, in the embodiment of the present invention, the AP may identify the capability of the terminal and/or the terminal when the terminal is actually associated with the AP by using the generated pre-association index information.
  • the MAC address of the AP is changed when the terminal sends the association request to the AP.
  • the AP can also determine which terminal the previous request corresponds to by the pre-association index information, and determine the corresponding capability information.
  • the access point decrypts the capability information of the encrypted terminal.
  • the access point After receiving the encrypted capability information of the terminal sent by the terminal, the access point decrypts the capability information of the encrypted terminal, thereby acquiring the capability information of the terminal.
  • the capability information of the access point in the S350 for decrypting the encrypted terminal may be before the terminal sends the association request message in S340, but in the first After a message.
  • the pre-association index information generated by the access point may also be after S350, that is, the access point may generate pre-association index information according to the capability information of the terminal after acquiring the encrypted capability information of the terminal.
  • the access point generating association index information may also be before S350, which is not limited in this embodiment of the present invention.
  • the access point sends an association response message to the terminal according to the capability information of the terminal and the pre-association index information, so as to complete association with the terminal.
  • step S360 may send an association response message to the terminal according to the pre-association index information, and complete association with the terminal.
  • the access point and the terminal establish a secure connection.
  • the terminal when the terminal receives the association response message that is sent by the AP and carries the indication information indicating that the association is successful, that is, the terminal completes the association with the AP, and then the two may further establish a connection to transmit data; and the terminal sends an association request message. It may also include the security authentication between the terminal and the AP before, or the terminal completes the connection after receiving the association response message. Before the establishment of the two to carry out security certification.
  • the size of the sequence number of the foregoing processes does not mean that the sequence of the execution sequence is performed.
  • the information about the pre-association index sent by the access point to the terminal in S330 is not necessarily after S310, and S330 may also be used.
  • Executed before S310 The order of execution of the various processes should be determined by their function and intrinsic logic, and should not be construed as limiting the implementation of the embodiments of the present invention.
  • the capability information of the terminal is sent to the access point in an encrypted manner, so that the eavesdropper can not acquire the capability information of the terminal even if it is listening to the capability information in the air interface before the association or in the association process, thereby preventing the eavesdropper from acquiring the capability information of the terminal.
  • the eavesdropper determines information such as the location and time of the terminal according to the capability information of the terminal, thereby avoiding leakage of user privacy.
  • the access point identifies the terminal by assigning the pre-association index information to the terminal by using the pre-association index information, such that the terminal uses the MAC address used before sending the association request message to the access point and the association request message is sent.
  • the MAC address is different, and the access point can still identify the terminal by associating the pre-index information, and determine the decryption key of the encrypted device capability information of the terminal to decrypt the device capability information of the terminal, thereby obtaining the device capability information of the terminal.
  • the method before the terminal sends the capability information of the encrypted terminal to the access point, the method further includes:
  • the terminal sends a probe request message to the access point
  • the terminal receives a probe response message sent by the access point according to the probe request message.
  • the terminal when the terminal transmits the capability information of the encrypted terminal by using a newly defined frame, for example, a management frame, and the access point sends the association request message to the terminal by using the newly defined frame,
  • the terminal may only carry the general capability information of the terminal in the probe request message, and the universal capability information may be used by the AP to determine whether to further perform subsequent association with the terminal.
  • the AP may also carry the general capability information of the AP in the probe response message. If the AP does not need to be kept secret, the AP may also carry the AP in the probe response message. Personalized ability information.
  • the method before the terminal sends the capability information of the encrypted terminal to the access point, the method further includes:
  • the terminal generates an encryption key of the terminal according to the public key of the access point, and the encryption key of the terminal is used to encrypt the capability information of the terminal.
  • the terminal and the AP send each other's public key to implement public key exchange
  • the public key of the terminal corresponds to the private key of the terminal, and the public key of the access point and the private point of the access point.
  • the key corresponds.
  • the two actions of the terminal sending the public key to the access point and the access point sending the public key to the terminal may not distinguish the order, as long as the exchange of the public keys with each other is realized through signaling interaction.
  • the public key of the terminal may also be referred to as the public key information of the terminal
  • the public key of the AP may also be referred to as the public key information of the AP.
  • the key exchange between the terminal and the access point through signaling may be implemented in various ways.
  • the following describes the key exchange between the terminal and the access point. It should be understood that the following description is only the present. Several alternative manners of the embodiments of the invention, but the embodiments of the invention are not limited thereto.
  • the terminal may generate an encryption key according to the private key information of the terminal and the public key of the access point, and the encryption key is used to encrypt the device of the terminal. Capability information to generate encrypted device capability information.
  • Capability information to generate encrypted device capability information.
  • other information may be used, for example, the location information of the access point, or one. Random values Nonce.
  • the generated encrypted terminal capability information may be simultaneously carried in the message that sends the public key to the access point.
  • the access point may generate a decryption key according to the public key information of the terminal and the private key information of the access point, thereby decrypting the capability information of the encrypted terminal of the device. , thereby obtaining capability information of the device of the terminal.
  • the terminal sends the public key of the terminal to the access point, including:
  • the terminal sends a probe request message to the access point, where the probe request message includes a public key of the terminal;
  • the terminal sends a second message to the access point, where the second message includes the public key of the terminal, and the second message is a management message.
  • the terminal sends a probe request message to the access point, where the probe request message includes a public key of the terminal, and the probe request message sent by the terminal to the access point may include a newly defined IE in the IE.
  • the public key of the terminal is carried in the public key of the terminal, and the public key of the terminal may be carried by the existing IE in the probe request message.
  • the terminal herein may carry the public key of the terminal through a unicast and/or multicast probe request message and/or a second message, where the multicast may include a broadcast.
  • the terminal sends a second message to the access point, where the second message includes the public key of the terminal, and the second message is a management message.
  • the second message may be a newly defined frame, for example, an Action frame or a Public Action frame, in which the key of the terminal is carried.
  • the terminal receives the public key of the access point sent by the access point, including:
  • the access point after receiving the probe request message sent by the terminal, the access point sends a probe response message to the terminal according to the probe request message, and may newly define an IE to bear in the probe response message.
  • the public key of the access point may, of course, also carry the public key of the access point through an existing IE in the probe response message.
  • the terminal receives the public key of the access point sent by the access point, including:
  • the terminal receives the third message sent by the access point, where the third message includes the public key of the access point, and the third message is a management message.
  • the third message may be a newly defined frame, such as an Action frame or a Public action frame, in which the public key of the access point is carried.
  • the access point may carry the access point's public key for the unicast and/or multicast probe response message and/or the third message, where the multicast may include a broadcast.
  • the terminal receives the public key of the access point sent by the access point, including:
  • the terminal receives a beacon frame sent by the access point, and the beacon frame includes a public key of the access point.
  • the access point may define an IE in the beacon frame sent by the terminal, and the newly defined IE may be used to carry the public key of the access point, and may also pass the beacon.
  • the existing IE in the frame carries the public key of the access point.
  • the AP may send the public key of the AP to the terminal, and the AP may indicate to the terminal that the security association mode is synchronized.
  • the AP may carry the public key of the AP and indicate the access point in the probe response message.
  • the indication information of the security association mode is supported.
  • the AP may also implicitly indicate that the AP supports the security association mode by sending the public key to the terminal.
  • the process of exchanging keys between the AP and the terminal may be preceded by the terminal to discover the AP capability process, or after the terminal discovers the AP capability, and the embodiment of the present invention is not limited.
  • the AP supports the security association mode.
  • the terminal and the AP may calculate and generate respective encryption keys using a Diffie-Hellman (DH) key exchange algorithm.
  • DH Diffie-Hellman
  • the terminal can calculate the terminal's encryption key STA-dhk through the DH algorithm and its own private key STA-pk.
  • the DH algorithm and its own private key AP-pk may also be used.
  • the terminal can also decrypt the capability information of the AP through AP-dhk encryption through STA-dhk.
  • the terminal and the AP may also generate respective encryption keys based on other key exchange algorithms.
  • the terminal and the AP may also pass Elliptic Curve Cryptosystems Diffie Hellman (ECDH).
  • ECDH Elliptic Curve Cryptosystems Diffie Hellman
  • a key exchange algorithm to generate respective encryption keys.
  • a field value and/or a random number may be simultaneously sent to the access point.
  • the terminal may carry a field value and/or a nonce in the second message carrying the public key of the terminal, so that the AP-dhk generated by the access point may have a change effect. Therefore, the encryption key generated by the terminal and/or the access point can better protect the capability information of the terminal and/or the access point, and improve the privacy protection capability of the user.
  • the field value and/or random number may be sent to the terminal at the same time.
  • the access point may carry a field value and/or a nonce in the third message carrying the public key of the access point, so that the AP-dhk generated by the terminal may have a change effect. Therefore, the encryption key generated by the terminal and/or the access point can better protect the capability information of the terminal and/or the access point, and improve the privacy protection capability of the user.
  • the access point and/or terminal may periodically change their respective public and private key pairs.
  • the encryption key generated by the access point and the terminal after the public key exchange will also be periodically changed, so that the encryption key generated by the terminal and/or the access point can better protect the terminal and/or the connection.
  • the method further includes: receiving, by the terminal, indication information sent by the access point, where the indication information is used to indicate that the access point supports capability information transmission of the terminal that is encrypted with the terminal.
  • the transmission of the capability information of the terminal that supports the terminal to perform encryption may also be referred to as an access point supporting a security association mode, or an anti-tracking working mode, and may also be referred to as another mode, which is implemented by the present invention.
  • the example is not limited.
  • the terminal needs to determine the feature of the AP supporting the transmission of the capability information of the terminal encrypted by the terminal.
  • the AP may also support the transmission of the capability information of the terminal encrypted by the terminal by default.
  • the AP may not need to separately send the indication information to the terminal to indicate that the AP supports the transmission of the capability information of the terminal encrypted by the terminal, and the terminal defaults to the AP to support the transmission of the capability information of the terminal encrypted by the terminal.
  • the sending of the indication information to the terminal by the access point may also be referred to as a capability discovery process, that is, the terminal receives the indication information sent by the access point to discover that the access point supports the security association mode. .
  • the terminal receives the indication information sent by the access point, where the terminal receives the probe response message sent by the access point, where the probe response message includes the indication information.
  • the access point may carry the indication information in the probe response message sent to the terminal.
  • an IE may be newly defined in the probe response message sent to the terminal, where the IE may be used to carry the foregoing indication information, which is used to indicate that the AP supports the security association mode, and of course, the access point may also detect the response message.
  • Some IEs carry the above indication information.
  • the terminal may also carry the indication information indicating that the terminal supports the security association mode in the probe request message.
  • the AP may also implicitly indicate the response information only by replying to the terminal.
  • the AP supports the security association mode. That is, the AP does not need to include the indication information indicating that the AP supports the security association mode in the probe response message.
  • the terminal receives the indication information sent by the access point, including:
  • the terminal receives the fourth message sent by the access point, where the fourth message includes indication information, and the fourth message is a management message.
  • the fourth message may be a newly defined frame, for example, an action frame, where the action frame may carry capability information of the terminal that indicates that the access point supports the terminal for encryption.
  • the indication information of the transmission that is, the access point may carry the indication information through a newly defined frame to indicate that the access point supports the security association mode.
  • the AP carries the AP to support the security association mode by using the newly defined Action frame.
  • the AP first receives the newly defined Action frame sent by the terminal, and may be in the Action frame of the terminal.
  • the portable terminal also supports the security association mode.
  • the terminal does not carry the indication information that the terminal supports the security association mode in the action frame sent to the AP, and the default terminal supports the security association mode.
  • the AP may implicitly indicate that the AP supports the security by not including the indication information of the AP supporting the security association mode in the action frame sent to the terminal. Association mode.
  • the terminal receives the indication information sent by the access point, where the terminal receives a beacon frame sent by the access point, where the beacon frame includes the indication information.
  • an IE may be newly defined in the beacon frame, where the IE is used to carry the foregoing indication information, and is used to indicate that the AP indicates a security association mode, and may also be used in the beacon frame.
  • the IE is to carry the above indication information.
  • the indication information indicating that the AP supports the security association mode may also be in other manners.
  • the AP may send a broadcast message and/or other synchronization message to the terminal in a broadcast manner, in the broadcast message and/or other synchronization messages.
  • the indication information may be carried, and after the terminal hears the broadcast message, the terminal may learn that the AP supports the security association mode.
  • the AP may also send indication information to other devices.
  • the terminal that needs to be associated with the AP hears the indication information, the AP may learn that the AP supports the security association mode.
  • those skilled in the art may obtain other indication information indicating that the access point supports the security association mode according to the actual application scenario, which is not limited in this embodiment of the present invention.
  • the technical solution of the embodiment of the present invention can also be used as a proprietary technical solution by the manufacturer, that is, the device of the same manufacturer can adopt the technical solution of the embodiment of the present invention, which can extend the manufacturer in the existing message.
  • Specific information element (Vender Specific IE) is implemented.
  • a method for establishing association in a wireless local area network will be described in detail below by taking a STA (or terminal) as a wearable device and an AP as a smart phone as an example.
  • a STA or terminal
  • AP or terminal
  • AP or smart phone
  • the use of the AP as the smart phone and the STA as the wearable device is merely for convenience of description, and should not be limited to the scope of protection of the embodiments of the present invention.
  • the smartphone when used as an AP, it can also have the same privacy protection requirements as the STA.
  • the STA may also become a terminal.
  • FIG. 4 is a flow chart showing a method for establishing association in a wireless local area network according to an embodiment of the present invention. The method includes:
  • the terminal receives a beacon frame sent by the AP.
  • the beacon frame may carry indication information indicating that the AP supports the terminal security association mode.
  • the beacon frame may include a newly defined IE, and the indication information may be carried in the newly defined IE.
  • the security association mode may be that the AP supports and the terminal performs device capability information encryption transmission. That is, the AP supports the technical solution of the embodiment of the present invention.
  • the beacon frame may carry the public key of the AP.
  • a newly defined IE may be included in the beacon frame, and the public key of the AP may be carried in the IE.
  • the public key of the AP corresponds to the private key of the AP, and the public key may enable the STA to generate an encryption key of the STA.
  • the process of generating an encryption key by the terminal includes the terminal according to at least the public key of the AP and the private key of the terminal itself. Of course, the terminal may also be combined. Other information is used to generate an encryption key, for example, location information of the terminal, etc., to generate an encryption key of the STA, thereby causing a change effect of the generated encryption key.
  • the beacon frame may also carry general capability information of the AP.
  • the access point sends a beacon frame to the terminal, where the beacon frame can carry the general capability information of the terminal, and is used by the terminal to determine, according to the general capability information of the access point, whether further association is needed.
  • the beacon frame may also carry personalized capability information of the AP.
  • the terminal sends a probe request message to the AP.
  • the probe request message may carry general capability information of the terminal. That is to say, the probe request message may no longer contain the capability information of the terminal that we wish to hide or protect, or the capability information of only the terminal that does not have a distinct personalized feature. In this way, even if the attacker only listens to the Probe Request message, the "fingerprint" information that can identify the terminal cannot be obtained, so that the terminal cannot be tracked.
  • the terminal may use one or more types of general capability information to indicate its capabilities to the AP, so that the AP determines whether it satisfies the conditions of the STA's query (it may also be understood as letting the AP determine whether it can meet the requirements of the terminal.
  • the AP determines whether the STA satisfies the communication condition of the AP, so that the AP can determine whether to reply the probe response message. It should be understood that, since the terminal sends one or more of the general device capability information, since many other terminals can use these or a plurality of capability information at the same time, even if the eavesdropper obtains the universal capability information, it cannot be recognized. The terminal, thereby reducing the possibility that the terminal is being tracked.
  • the probe request message may carry indication information indicating that the terminal supports the security association mode.
  • the probe request message may carry a public key of the terminal, where the public key is used by the AP to generate a decryption key for decrypting the capability information of the encrypted terminal.
  • the terminal and the AP may calculate and generate respective encryption keys by using a Diffie Hellman (DH) key exchange algorithm.
  • DH Diffie Hellman
  • the terminal can calculate the terminal's encryption key STA-dhk through the DH algorithm and its own private key STA-pk.
  • the AP obtains the terminal's public key STA-PK.
  • the AP's encryption key AP-dhk can also be calculated according to the DH algorithm and its own private key AP-pk, where STA-dhk and AP-dhk are the same symmetric encryption key, that is, the AP can utilize the AP.
  • -dhk to decrypt the capability information of the terminal through STA-dhk encryption
  • the terminal can also decrypt the capability information of the AP through AP-dhk encryption through STA-dhk.
  • the AP and the terminal use the DH key exchange algorithm to generate the respective encryption keys, which is only one implementation manner. Those skilled in the art may also generate respective encryption keys through other key exchange algorithms. The embodiment is not limited.
  • the access point sends a probe response message to the terminal.
  • the probe response message may carry general capability information of the AP.
  • the probe response message may further include personalization capability information of the AP.
  • the embodiment of the invention is not limited thereto.
  • the probe response message may carry an AP's public key.
  • the probe response message may carry indication information indicating that the access point supports the security association mode.
  • the terminal sends a first request frame to the access point, where the first request frame is a newly defined management frame.
  • the first request frame may be an Action frame, but the present invention is not limited thereto.
  • the first request frame may also be other types of frames.
  • the first request frame may carry a public key of the terminal.
  • the access point may calculate the decryption key AP-dhk of the access multipoint according to the DH algorithm, and the AP-dhk is used to decrypt the terminal.
  • Information can also be used to encrypt the capability information of the access point.
  • the first request frame may carry general capability information of the terminal.
  • the terminal may indicate the capability information of the access point by using one or more types of general capability information (which may be understood as one or more of the general device capability information) in the first request frame. Therefore, the access point determines whether it satisfies the query condition of the terminal, or whether the terminal satisfies the communication capability condition of the AP, and facilitates the access point to determine whether to reply the response frame.
  • general capability information which may be understood as one or more of the general device capability information
  • the first request frame may carry indication information indicating that the terminal supports a security association mode.
  • the access point sends a first response frame to the terminal, where the first response frame is a newly defined management frame.
  • the first response frame may be an Action frame, but the embodiment of the present invention is not limited thereto.
  • the first response frame may also be other types of frames.
  • the first response frame may carry general capability information of the access point.
  • the first response frame may further carry an access point public key.
  • the terminal may calculate the encryption key secret STA-dhk of the terminal according to the DH algorithm, and the STA-dhk is used to decrypt the capability information of the terminal, and Can be used to encrypt the capability information of the access point.
  • the AP may carry the personalized capability information of the access point in the first response frame; if the access point also needs privacy protection, when the access point has obtained the publicity of the terminal
  • the AP-dhk can be generated according to the public key of the terminal, the private key of the access point, etc., and the personalized capability information of the access point is encrypted, and the access point is sent to the terminal at the access point.
  • the capability information of the encrypted access point may be sent in the same message.
  • the terminal may calculate STA-dhk to decrypt the access point.
  • the general capability information of the access point can be used by the terminal to determine whether it satisfies its own Seeking to determine whether to perform transmission or further information associated with the ability of the present invention is not limited to this embodiment.
  • the first response frame may carry indication information indicating that the access point supports a security association mode.
  • the access point when the terminal sends the first request frame to the access point to carry the indication information of the terminal supporting the security association mode, the access point may also implicitly indicate the The access point supports the security association mode, that is, the access point does not carry the display information indicating that the access point supports the security association mode in the first response frame.
  • the first response frame herein may correspond to the third message and/or the fourth message in the claims.
  • the first response frame may correspond to the third message in the claim; when the first response frame carries the access point to support the encryption with the terminal
  • the first response frame may correspond to the fourth message in the claims.
  • the first response frame may also be the third message and the fourth message at the same time, that is, the third message and the fourth message may be the same message, and the same message may be the first response frame here.
  • the terminal generates capability information of the encrypted terminal.
  • the terminal may generate an encryption key for encrypting the terminal capability information by using the DH algorithm and its own private key, and then encrypt the terminal by using the encryption key.
  • Ability information for encrypting the terminal capability information by using the DH algorithm and its own private key, and then encrypt the terminal by using the encryption key.
  • the label S406 does not limit the execution order of the step, and the terminal once acquires the access point.
  • the capability information of the encrypted terminal is generated according to the generated encryption key, which is not limited in this embodiment of the present invention.
  • the access point and the terminal may join the location information and/or the Nonce when calculating the respective encryption key according to the DH algorithm.
  • the encrypted content can be made to have a varying effect.
  • the STA or the AP changes its own public key private key pair at intervals.
  • the terminal sends a second request frame to the access point, where the second request frame carries capability information of the encrypted terminal, where the second request frame is a newly defined management frame.
  • the capability information of the encrypted terminal is sent to the access point through the newly defined management frame, thereby preventing the capability information of the terminal from being directly sent on the air interface, thereby preventing the attacker from obtaining the capability information of the terminal by listening to the air interface message, thereby according to the capability information.
  • the information generates "fingerprint" feature information of the terminal, thereby tracking the terminal.
  • the second request frame may be a Public Action frame.
  • the second request frame may also be other types of frames, which is not limited in this embodiment of the present invention.
  • the access point generates pre-association index information according to the capability information of the terminal, where the pre-association index information is used to identify the terminal.
  • the AP may generate a decryption key for decrypting the capability information of the encrypted terminal according to the private key and the DH algorithm.
  • the access point After receiving the capability information of the terminal sent by the terminal, the access point decrypts the capability information of the encrypted terminal by using the decryption key generated by the terminal, thereby obtaining the capability information of the terminal.
  • the access point After obtaining the capability information of the terminal, the access point may determine whether it meets the requirements of the AP that the terminal is looking for, or determine whether the terminal meets the requirements associated with the terminal to determine whether to continue the subsequent communication with the terminal.
  • the pre-association index information may be unique for a period of time, that is, different terminals may be distinguished. Certainly, the pre-association index information may also be set to be long enough to be unique for a long time, so that the access point may determine the capability information corresponding to the terminal when subsequently receiving the association request of the terminal, and use in the subsequent association process. Corresponding capabilities to establish associations.
  • the pre-association index information may correspond to one device capability information.
  • the terminal having the capability information 1 corresponds to the pre-association index 1
  • the terminal having the capability information 2 corresponds to the pre-association index 2.
  • the terminal having the capability information 1 corresponds to the pre-association index 1
  • the terminal having the capability information 2 corresponds to the pre-association index 2.
  • the access point sends a second response frame to the terminal, where the second response frame carries pre-association index information generated by the access point, where the second request frame is a newly defined management frame.
  • the pre-association index information carried in the second response frame may be encrypted pre-association index information.
  • the access point may encrypt the pre-association index information by using an encryption key generated after the public key exchange with the terminal.
  • the terminal can decrypt the encrypted pre-association index information by using a decryption key generated after exchange with the access point public key.
  • the pre-association index information is used when the terminal initiates association with the access point, so that the access point knows what kind of capability is used to communicate with the terminal, that is, the access point passes the pre-association index information.
  • the terminal corresponding to the associated index information can be determined by the associated index information in the communication, so that the access point can determine the terminal even if the MAC address used by the terminal when sending the association request is different.
  • the association request of the new MAC address corresponds to which terminal before, or the capability information of the terminal.
  • the second response frame may be a newly defined management frame, such as a Publ ic Act ion frame.
  • the second response frame may also be other types of frames, which is not limited in this embodiment of the present invention.
  • S410 The terminal sends an association request message to the access point, where the association request message carries the pre-association index information.
  • the terminal sends an association request message to the access point, where the association request message may not carry the personalized capability information of the terminal. It is conceivable that in the embodiment of the present invention, device capability information of all terminals that may leak the terminal privacy information may be sent to the access point in an encrypted manner before the terminal sends an association request to the access point.
  • the terminal further carries the device capability information of the encrypted terminal in the association request message, and the access point may decrypt the encrypted capability information of the terminal according to the AP-dhk generated by the information exchanged in the previous step;
  • the decryption key can be determined by the pre-association index.
  • the pre-association index information is used to identify the corresponding terminal, or is further corresponding to the encryption key used by the terminal; the index information is used by the AP to determine the decryption terminal.
  • the decryption key used by the encrypted capability information is used to identify the corresponding terminal, or is further corresponding to the encryption key used by the terminal.
  • the terminal sends an association request to the access point, where the association request may carry the encrypted pre-association index information.
  • the terminal may encrypt the pre-association index information by using an encryption key generated after exchanging the public key with the access point, and use the MAC address used before the terminal sends the association request message to the access point to send an association request message to the terminal.
  • the access point may determine the corresponding decryption key by using the MAC address of the association request message to decrypt the pre-association index information, thereby The pre-association index information determines the device capability information of the terminal.
  • the access point sends an association response message to the terminal, so as to establish association with the terminal.
  • the access point After receiving the association request sent by the terminal, the access point determines the capability information of the terminal according to the pre-association index information in the association request, or when the association request message directly carries the capability information of the encrypted device, After the decryption key determined by the pre-association index information is used and the encryption capability information of the device is decrypted, an association response message is sent to the terminal, thereby establishing an association with the terminal.
  • the access point and the terminal establish a secure connection.
  • the size of the sequence numbers of the foregoing processes in the embodiment of the present invention does not mean the order of execution sequence.
  • the foregoing process does not have to be performed.
  • the terminal in the process of exchanging the public key between the terminal and the access point, the terminal may carry the terminal through the probe request message.
  • the public key the access point may carry the public key of the access point by using the probe response message, and step S401 may be used as an optional step.
  • Steps S402 and S403 may be replaced by steps S404 and S405, that is, steps S402-S405 may be selected to execute only S402 and S403, or only S404 and S405.
  • the first request frame, the second request frame, the first response frame, and the second response frame may be a newly defined frame, which may also be referred to as a message frame or a message, and the specific sequence number. It is called first or second, etc., depending on the actual situation.
  • the serial numbers are first and second, for convenience of description, and can be used to distinguish different objects.
  • the first request frame and the second request frame here may also be the same message (ie, the same object), and the first response frame.
  • the second response frame may also be the same message, that is, the same message may carry a variety of information, for example, the public key of the terminal and the capability information of the encrypted terminal in the embodiment of the present invention may be carried in the first request frame.
  • the public key of the terminal and the capability information of the encrypted terminal in the embodiment of the present invention may be carried in the first request frame.
  • the process may also be referred to as an AP capability discovery process; if the AP and the terminal perform key exchange in S401-S405, the process may also be called The process of generating the encryption key.
  • S406-S409 may also be referred to as an encrypted terminal capability information transmission process.
  • S410-S411 may also be referred to as an AP association process with a terminal. The process division herein should not be construed as limiting the embodiments of the present invention.
  • the core idea of the association method in the WLAN shown in FIG. 4 is that the capability information of the encrypted terminal can be transmitted through a newly defined frame, such as a public action frame, thereby protecting the personalized information of the terminal. Attacked by an eavesdropper to protect the user's private information.
  • FIG. 5 is a flow chart showing a method of establishing a secure connection in a wireless local area network according to another embodiment of the present invention. The method includes:
  • the terminal receives a beacon frame sent by the access point.
  • the beacon frame may carry an indication that the AP supports the terminal security association mode.
  • the security association mode may be that the AP supports and the terminal performs device capability information encryption transmission. That is, the AP supports the technical solution of the embodiment of the present invention.
  • the beacon frame may carry the public key of the AP.
  • the public key of the AP may be different each time, or modified over a period of time, or remain unchanged, that is, the AP may change its own public and private key pairs according to its own performance or parameters, thereby When the terminal generates an encryption key according to the public key of the access point, a change effect can be generated.
  • the public key of the AP corresponds to the private key of the AP
  • the access point sends the public key of the access point to the terminal for the STA to generate the encryption key of the STA.
  • the beacon frame may also carry general capability information of the AP.
  • the beacon frame may also carry personalized information of the AP when the AP does not need to protect privacy.
  • the terminal sends a probe request message to the access point.
  • the probe request message may carry general capability information of the terminal. That is to say, the probe request message no longer contains the capability information of the terminal that we wish to hide or protect, or the capability information of only the terminal that does not have a distinct personalized feature. That is, the attacker cannot obtain the "fingerprint" information that can distinguish the terminal by listening to the Probe Request message, and is used for subsequent terminal tracking.
  • the terminal may use one or more types of general capability information to indicate its capabilities to the AP, so that the AP determines whether the STA's query condition is met, or whether the STA satisfies the AP's communication condition, so that the AP can determine whether to respond to the probe. Response message. It should be understood that since the terminal transmits one or more of the general device capability information, since many terminals use these types at the same time, the possibility of being tracked is reduced. Of course, in the probe request message, the capability information of the terminal may not be carried.
  • the probe request message may carry indication information indicating that the terminal supports the security association mode.
  • the probe request message may carry a public key of the terminal, where the public key is used by the AP to generate a decryption key for decrypting the capability information of the encrypted terminal.
  • the terminal when the beacon frame in S501 includes the public key information of the access point, the terminal may already use the public key information of the access point and the terminal before sending the S502 probe request message.
  • the private key information generates the encryption key information, thereby generating the capability information of the encrypted terminal (corresponding to step S503); thus, in the probe request message of step S502, the terminal may carry the capability information of the encrypted terminal.
  • the terminal and the AP may calculate and generate respective encryption keys by using a Diffie Hellman (DH) key exchange algorithm.
  • DH Diffie Hellman
  • the terminal can pass The DH algorithm and its own private key STA-pk calculate the encryption key STA-dhk of the terminal.
  • the AP can also calculate the AP according to the DH algorithm and its own private key AP-pk.
  • the encryption key AP-dhk where STA-dhk and AP-dhk are the same symmetric encryption key, that is, the AP can use AP-dhk to decrypt the capability information of the terminal through STA-dhk encryption, and the terminal can also The STA-dhk is used to decrypt the capability information of the AP through AP-dhk encryption.
  • the AP and the terminal use the DH key exchange algorithm to generate the respective encryption keys, which is only one implementation manner. Those skilled in the art may also generate respective encryption keys through other key exchange algorithms. The embodiment is not limited.
  • the access point generates pre-association index information, where the pre-association index information is used to identify the terminal.
  • the access point may generate a decryption key for decrypting the capability information of the encrypted terminal according to the private key and the DH algorithm.
  • the encryption key STA-dhk of the terminal and the AP generated by the DH key exchange algorithm and the decryption key AP-dhk of the access point may be the same, that is, the encryption of the terminal.
  • the key STA-dhk can also decrypt the device capability information of the access point encrypted by the access point using the decryption key AP-dhk.
  • the access point generates an association pre-index message, and the pre-association index information is used by the terminal when the association is subsequently initiated, that is, in the subsequent association, the access point may determine according to the pre-association index information.
  • the terminal further determines an encryption key corresponding to the terminal.
  • the pre-association index information may be unique for a period of time, that is, different terminals may be distinguished. Certainly, the pre-association index information may also be set to be long enough to be unique for a long time, so that the access point may determine the capability information corresponding to the terminal when subsequently receiving the association request of the terminal, and use in the subsequent association process. Corresponding capabilities to establish associations.
  • the AP when the probe request message sent in the step S502 includes the capability information of the encrypted terminal, after the step S502, that is, when the AP receives the probe request message, the AP already includes the capability information of the encrypted terminal and the public key information of the terminal. At this time, the AP can combine its own private key and the public key information of the terminal, and other information (if other information is needed here, the AP and the terminal need to confirm during the interaction, or are previously indicated by the message) to generate and decrypt. The key decrypts the capability information of the encrypted device to obtain the capability information of the terminal.
  • the access point sends a probe response message to the terminal, where the probe response message carries the pre-association index information.
  • the pre-association index information carried in the probe request message may be encrypted, that is, the access point may encrypt the association by using an encryption key generated after the terminal exchanges the public key. Index information.
  • the pre-association index information carried in the probe request message may also be unencrypted.
  • the probe response message may carry general capability information of the AP.
  • the capability information of the encrypted access point may also be carried in the probe response message.
  • the probe response message may further include personalization capability information of the AP.
  • the embodiment of the invention is not limited thereto.
  • the probe response message may carry an AP's public key.
  • the probe response message may carry indication information indicating that the terminal supports a security association mode.
  • the terminal generates capability information of the encrypted terminal.
  • the terminal may generate an encryption key for encrypting the terminal capability information by using the DH algorithm and its own private key, and then encrypt the terminal by using the encryption key.
  • Ability information for encrypting the terminal capability information by using the DH algorithm and its own private key, and then encrypt the terminal by using the encryption key.
  • the label S505 does not limit the execution order of the step, and the terminal can generate the capability information of the encrypted terminal after acquiring the public key of the access point, which is not performed in this embodiment of the present invention. limited.
  • the access point and the terminal may join the location information and/or the Nonce when calculating the respective encryption key according to the DH algorithm. It should be understood that if the field value or other information is used here, it needs to be carried in the message that the terminal sends the public key to the AP, or is carried in the public key message sent by the AP to the terminal, or carried in other messages.
  • the encrypted content can be made to have a varying effect.
  • the STA or the AP changes its own public key private key pair at intervals.
  • the terminal sends an association request message to the access point, where the association request message includes the capability information of the encrypted terminal and the pre-association index information.
  • the capability information of the encrypted terminal is transmitted through the existing signaling, which saves signaling overhead.
  • the terminal capability information and the pre-association index information are sent to the access point in an encrypted manner, thereby avoiding the capability information of the terminal and directly transmitting on the air interface, thereby preventing the attacker from obtaining the capability information of the terminal by listening to the air interface message, thereby according to the capability information.
  • the information generates the "fingerprint" feature information of the terminal, thereby tracking the terminal.
  • the encrypted terminal capability information is sent to the access point by using the association request message.
  • the access point may determine the pre-association index information carried in the association request message. The terminal, so that even if the MAC address of the terminal transmitting the association request is changed, the access point can still determine the terminal that changes the MAC address by associating the pre-index information, thereby decrypting the capability information of the encrypted terminal by using the decryption key corresponding to the terminal. .
  • the access point sends an association response message to the terminal, so as to establish association with the terminal.
  • the access point After receiving the capability information of the encrypted terminal and the pre-association index information sent by the terminal through the association request message, the access point determines, according to the pre-association index information, a decryption key for decrypting the capability information of the terminal encryption, according to the decryption. Decrypting the capability information of the encrypted terminal to obtain the capability information of the terminal, and the access point determines whether to send the association response message to the terminal according to the capability information of the terminal, and establishes an association after sending the association response message to the terminal. .
  • the access point and the terminal establish a secure connection.
  • the size of the sequence numbers of the foregoing processes in the embodiment of the present invention does not mean the order of execution sequence.
  • the foregoing process does not have to be performed.
  • the terminal may carry the terminal in the probe request message.
  • the key the access point may carry the public key of the access point by using the probe response message.
  • steps S504 and S505 may be used as an optional step only as a public key exchange step. It should be understood that the order of execution and the necessity of execution of the various processes should be determined by their function and the intrinsic logic, and should not be construed as limiting the implementation of the embodiments of the present invention.
  • the core idea is to implement the technical solution of the embodiment of the present invention by adding an information element or an existing information element by using a message in the prior art, without adding a newly defined message.
  • the embodiment of the present invention is not limited to this.
  • the capability information of the encrypted terminal may also be carried by the probe request message. .
  • FIG. 6 is a schematic diagram of a method for establishing association in a wireless local area network according to an embodiment of the present invention. The method includes:
  • the terminal sends a probe request message (Probe Request) to the access point, the probe request message includes indication information indicating that the terminal supports the security association mode, and the public key STA-PK of the terminal;
  • Probe Request a probe request message
  • the probe request message includes indication information indicating that the terminal supports the security association mode, and the public key STA-PK of the terminal;
  • the access point sends a probe response message (Probe Response) to the terminal, the probe response message includes indication information indicating that the access point supports the security association mode, and the public key AP-PK of the access point;
  • Probe Response a probe response message
  • the terminal generates an encryption key STA-dhk according to the private key STA-pk of the user and the public key AP-PK of the received access point.
  • the encryption key is used to encrypt capability information of the terminal;
  • the access point generates a decryption key AP-dhk according to the private key AP-pk of the terminal and the public key STA-PK of the received terminal, where the decryption key is used to decrypt the encrypted capability information of the terminal.
  • the terminal encrypts capability information of the terminal according to the generated encryption key.
  • the access point generates pre-association index information, where the pre-association index information is used by the access point to identify the terminal when the terminal has not established association with the access point;
  • the terminal sends an action frame to the access point, where the action frame may be a newly defined management frame, where the action frame may carry the capability information of the encrypted terminal generated by the terminal;
  • the access point receives the capability information of the encrypted terminal sent by the terminal, and decrypts with the decryption key to obtain capability information of the terminal.
  • the access point sends an action frame to the terminal, where the action frame can be a newly defined management frame, and the action frame can carry the pre-association index information generated by the access point;
  • the terminal sends an association request message (Association Request) to the access point, where the association request message includes the pre-association index information;
  • the access point sends an association response message (Association Response) to the terminal according to the pre-association index information sent by the terminal, so that the access point and the terminal complete the establishment of the association.
  • Association Response an association response message
  • the access point and the terminal establish a secure connection.
  • S603 and S604 may not define a sequence relationship, and S604 and S606 may not limit the relationship, and S604 and S607 may not limit the relationship.
  • FIG. 7 is a schematic diagram of a method for establishing association in a wireless local area network according to an embodiment of the present invention. The method includes:
  • the terminal sends a probe request message (Probe Request) to the access point, where the probe request message includes the public key STA-PK of the terminal and the indication information of the terminal supporting the security association mode.
  • Probe Request a probe request message
  • the probe request message includes the public key STA-PK of the terminal and the indication information of the terminal supporting the security association mode.
  • the access point generates a decryption key AP-dhk according to the public key STA-PK of the terminal and the private key AP-pk of the terminal, where the decryption key is used to decrypt the capability information of the encrypted terminal.
  • the access point generates pre-association index information, where the pre-association index information is used by the access point to identify the terminal when the terminal has not established association with the access point;
  • the access point sends a probe response message (Probe Response) to the terminal, where the probe response message includes indication information that the access point supports the security association mode, the public key AP-PK of the access point, and pre-association index information.
  • Probe Response a probe response message
  • the probe response message includes indication information that the access point supports the security association mode, the public key AP-PK of the access point, and pre-association index information.
  • the terminal generates an encryption key STA-dhk according to the public key AP-PK of the access point and the private key STA-pk of the access point, where the encryption key is used to encrypt the capability information of the terminal.
  • the terminal encrypts capability information of the terminal according to the generated encryption key.
  • the terminal sends an association request message (Association Request) to the access point, where the association request message includes pre-association index information and capability information of the encrypted terminal.
  • Association Request an association request message
  • the association request message includes pre-association index information and capability information of the encrypted terminal.
  • the access point After receiving the association request message sent by the terminal, the access point acquires the pre-association index information in the association request message, determines the decryption key of the terminal according to the pre-association index information, and decrypts the encrypted terminal.
  • Ability information After receiving the association request message sent by the terminal, the access point acquires the pre-association index information in the association request message, determines the decryption key of the terminal according to the pre-association index information, and decrypts the encrypted terminal.
  • the access point After receiving the association request message sent by the terminal, the access point acquires the pre-association index information in the association request message, determines the decryption key of the terminal according to the pre-association index information, and decrypts the encrypted terminal.
  • Ability information After receiving the association request message sent by the terminal, the access point acquires the pre-association index information in the association request message, determines the decryption key of the terminal according to the pre-association index information, and decrypts the encrypted terminal.
  • the access point receives the pre-association index information sent by the terminal and the capability information of the encrypted terminal, and decrypts with the decryption key to obtain capability information of the terminal.
  • the access point sends an association response message (Association Response) to the terminal according to the pre-association index information sent by the terminal, so that the access point and the terminal complete the establishment of the association.
  • Association Response an association response message
  • the terminal establishes a secure connection with the access point.
  • sequence relationship between S702 and S704 is not limited, and S702 and S707 may not limit the relationship.
  • FIG. 8 is a schematic diagram of a method for establishing association in a wireless local area network according to an embodiment of the present invention. The method includes:
  • the terminal sends a probe request message (Probe Request) to the access point, where the probe request message includes indication information indicating that the terminal supports the security association mode.
  • Probe Request a probe request message
  • the access point sends a probe response message (Probe Response) to the terminal, where the probe response message includes indication information indicating that the access point supports the security association mode.
  • Probe Response a probe response message
  • the terminal sends a Public Action frame to the access point
  • the Public Action frame may be a new management frame
  • the Public Action frame may include the public key STA-PK of the terminal
  • the access point generates a decryption key AP-dhk according to the public key STA-PK of the terminal and the private key AP-PK of the terminal, where the decryption key is used to decrypt the capability information of the encrypted terminal.
  • the access point generates pre-association index information, where the pre-association index information is used by the access point to identify the terminal when the terminal has not established association with the access point;
  • the access point sends a Public Action frame to the terminal, where the Public Action frame can be a new management frame, where the Public Action frame can include the public key AP-PK of the access point and the pre-association index information;
  • the terminal generates an encryption key STA-dhk according to the public key AP-PK of the access point and the private key STA-pk of the access point, where the encryption key is used to encrypt capability information of the terminal;
  • the terminal encrypts capability information of the terminal according to the generated encryption key.
  • the terminal sends an association request message (Association Request) to the access point, where the association request message includes pre-association index information and capability information of the encrypted terminal.
  • Association Request an association request message
  • the association request message includes pre-association index information and capability information of the encrypted terminal.
  • the access point After receiving the association request message sent by the terminal, the access point acquires the pre-association index information in the association request message, determines the decryption key of the terminal according to the pre-association index information, and decrypts the encrypted terminal.
  • Ability information After receiving the association request message sent by the terminal, the access point acquires the pre-association index information in the association request message, determines the decryption key of the terminal according to the pre-association index information, and decrypts the encrypted terminal.
  • the access point After receiving the association request message sent by the terminal, the access point acquires the pre-association index information in the association request message, determines the decryption key of the terminal according to the pre-association index information, and decrypts the encrypted terminal.
  • Ability information After receiving the association request message sent by the terminal, the access point acquires the pre-association index information in the association request message, determines the decryption key of the terminal according to the pre-association index information, and decrypts the encrypted terminal.
  • the access point receives the pre-association index information sent by the terminal and the capability information of the encrypted terminal, and decrypts with the decryption key to obtain capability information of the terminal.
  • the access point sends an association response message (Association Response) to the terminal according to the pre-association index information sent by the terminal, so that the access point and the terminal complete the establishment of the association.
  • Association Response an association response message
  • the terminal establishes a secure connection with the access point.
  • S804 and S806 may not define a sequence relationship; S804 and S809 may also not define a sequence relationship.
  • FIG. 9 is a schematic block diagram of a terminal according to an embodiment of the present invention.
  • the terminal may be the smart phone shown in FIG. 2, and the terminal 900 includes:
  • the generating module 910 is configured to generate the encrypted capability information of the terminal.
  • the receiving module 920 is configured to receive pre-association index information related to the terminal that is sent by the access point, where the pre-association index information is used by the access point when the terminal and the access point have not been associated with each other. Identifying the terminal;
  • the sending module 930 is configured to send, to the access point, the encrypted capability information of the terminal and an association request message, where the association request message includes the pre-association index information;
  • the receiving module 920 is further configured to receive an association response message sent by the access point according to the capability information of the terminal and the pre-association index information, so that the terminal establishes association with the access point.
  • the terminal of the embodiment of the present invention sends the capability information of the terminal to the access point in an encrypted manner, and identifies the terminal by using the pre-association index information, so that the eavesdropper is in the air interface before the association or in the association process. Even if the capability information is monitored, the capability information of the terminal cannot be obtained, thereby preventing the eavesdropper from determining the location, time, and the like of the terminal according to the capability information of the terminal, thereby avoiding leakage of user privacy.
  • the sending module is specifically configured to: send an association request message to the access point, where the association request message includes the encrypted capability information of the terminal.
  • the sending module is specifically configured to: send, to the access point, a first message, where the first message includes the encrypted capability information of the terminal, where the first The message is a management message;
  • the sending module is further configured to: before the sending module sends the encrypted capability information of the terminal, send the public key of the terminal to the access point, where The public key of the terminal is used by the access point to generate a decryption key for decrypting capability information of the terminal;
  • the receiving module is further configured to receive a public key of the access point sent by the access point;
  • the generating module is further configured to generate an encryption key of the terminal according to a public key of the access point, where an encryption key of the terminal is used to encrypt capability information of the terminal.
  • the sending module is specifically configured to: send a probe request message to the access point, where the probe request message includes a public key of the terminal;
  • the receiving module is specifically configured to: receive a probe response message sent by the access point, where the probe response message includes a public key of the access point;
  • the third message includes a public key of the access point, and the third message is a management message
  • beacon frame sent by the access point, where the beacon frame includes a public key of the access point.
  • the receiving module is further configured to: receive indication information sent by the access point, where the indication information is used to indicate that the access point supports an encryption with the terminal.
  • the device capability information transmission of the terminal is further configured to: receive indication information sent by the access point, where the indication information is used to indicate that the access point supports an encryption with the terminal.
  • the receiving module is specifically configured to: receive a probe response message sent by the access point, where the probe response message includes the indication information;
  • beacon frame sent by the access point, where the beacon frame includes the indication information.
  • the receiving module is specifically configured to: receive a fifth message sent by the access point, where the fifth message includes the pre-association index information, and the fifth message is a management message;
  • the MAC address used by the terminal to send the association request message to the access point is used before the terminal sends the association request message to the access point.
  • the MAC address is different.
  • the terminals herein are embodied in the form of functional modules.
  • the function modules herein may correspond to the physical modules of the smart phone shown in FIG. 2 .
  • the generating module herein may correspond to the processor of the smart phone in FIG. 2
  • the sending module and the receiving module may correspond to the radio frequency of the smart phone. Circuits, etc.
  • the term "module” as used herein may refer to a processor (e.g., shared processor, proprietary processor, or group processing) for use with a particular integrated circuit, electronic circuitry, or program for executing one or more software or firmware. And memory, merge level circuits, and/or exotic components that support the functions described.
  • the terminal may be used to perform various processes and/or steps corresponding to the terminal in the foregoing method embodiments. To avoid repetition, details are not described herein again.
  • FIG. 10 is a schematic block diagram of an access point according to an embodiment of the present invention.
  • the access point may also correspond to the smart phone in FIG. 2, and the smart phone as an access point may also have the need to protect privacy.
  • the access point 1000 includes:
  • the generating module 1010 is configured to generate pre-association index information related to the terminal, where the pre-association index information is used by the access point to identify the terminal when the terminal has not established association with the access point;
  • the sending module 1020 is configured to send the pre-association index information to the terminal;
  • the receiving module 1030 is configured to receive the encrypted capability information of the terminal and the association request message sent by the terminal, where the association request message includes the pre-association index information;
  • the decryption module 1040 is configured to decrypt capability information of the encrypted terminal.
  • the sending module 1020 is further configured to send an association response message to the terminal according to the capability information of the terminal and the pre-association index information, so that the access point establishes an association with the terminal.
  • the access point of the embodiment of the present invention supports the capability information transmission of the terminal encrypted by the terminal, and identifies the terminal by associating the pre-index information, so that the eavesdropper is in the air interface even before the association or in the association process. After the capability information is monitored, the capability information of the terminal cannot be obtained, so that the eavesdropper can be prevented from determining the location, time, and the like of the terminal according to the capability information of the terminal, thereby avoiding leakage of user privacy.
  • the receiving module is specifically configured to:
  • the receiving module is further configured to: receive a first message sent by the terminal, where the first message includes the encrypted capability information of the terminal, the first message For managing a message; receiving an association request message sent by the terminal.
  • the receiver is further configured to: receive, by the receiving module, a public key of the terminal sent by the terminal;
  • the generating module is further configured to: generate a decryption key according to the public key of the terminal, where the decryption key is used to decrypt the encrypted capability information of the terminal;
  • the sending module is further configured to: send a public key of the access point to the terminal, where a public key of the access point is used by the terminal to generate an encryption key for encrypting capability information of the terminal.
  • the receiving module is specifically configured to: receive a probe request message sent by the terminal, where the probe request message includes a public key of the terminal;
  • the sending module is specifically configured to: send a probe response message to the terminal, where the probe response message includes a public key of the access point;
  • the beacon frame including a public key of the access point.
  • the sending module is further configured to: send, to the terminal, indication information, where the indication information is used to indicate that the access point supports a device of the terminal that is encrypted with the terminal.
  • Ability information transmission is further configured to: send, to the terminal, indication information, where the indication information is used to indicate that the access point supports a device of the terminal that is encrypted with the terminal.
  • the sending module is specifically configured to: send a probe response message to the terminal, where the probe response message includes the indication information;
  • the beacon frame including the indication information.
  • the sending module is specifically configured to: send a fifth message to the terminal, where the fifth message includes the pre-association index information, and the fifth message is a management message;
  • the generating module is further configured to: generate, by the access point, capability information of the encrypted access point;
  • the sending module is further configured to send capability information of the encrypted access point to the terminal.
  • module may refer to a dedicated integrated circuit, an electronic circuit, a processor (eg, a shared processor, a proprietary processor, or a group processor) and a memory for executing one or more software or firmware programs. Combine the level circuit and/or other suitable components that support the described functionality.
  • the access point may be used to perform the various processes and/or steps corresponding to the access point in the foregoing method embodiment. To avoid repetition, details are not described herein.
  • FIG. 11 is a schematic block diagram of a terminal according to another embodiment of the present invention.
  • the terminal includes a processor 1101, a memory 1102, a transmitter 1103, and a receiver 1105.
  • the components in the terminal are coupled together by a coupling, the receiver 1105 receives data through the antenna 1104, and the transmitter 1103 transmits data through the antenna 1104.
  • the receiver and the transmitter may share an antenna having the capability of receiving and transmitting signals, and may also use different antennas, which is not limited by the embodiment of the present invention. Only the former case is an example.
  • the method for establishing association in the wireless local area network disclosed in the foregoing embodiment of the present invention may be applied to the processor 1101 or implemented by the processor 1101.
  • the processor 1101 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the foregoing method may be completed by an integrated logic circuit of hardware in the processor 1101 or an instruction in a form of software.
  • the processor 1101 described above may be a general-purpose processor, or a system-on-a-chip (SOC chip), a baseband processor, a digital signal processor (DSP), and an application specific integrated circuit (Application). Specific Integrated Circuit (ASIC), Field Programmable Gate Array (FPGA) or other programmable logic device, discrete gate or transistor logic device, discrete hardware component.
  • the methods, steps, and logical block diagrams disclosed in the embodiments of the present invention may be implemented or carried out.
  • the general purpose processor may be a microprocessor or the processor may also be Any conventional processor, etc.
  • the steps of the method disclosed in the embodiments of the present invention may be directly implemented by the hardware decoding processor, or may be performed by a combination of hardware and software modules in the decoding processor.
  • the software module can be located in a random access memory (RAM), a flash memory, a read-only memory (ROM), a programmable read only memory or an electrically erasable programmable memory, a register, etc.
  • RAM random access memory
  • ROM read-only memory
  • programmable read only memory or an electrically erasable programmable memory
  • register etc.
  • the storage medium is located in the memory 1102, and the processor 1101 reads the instructions in the memory 1102 and completes the steps of the above method in combination with its hardware.
  • the processor 1101 is configured to generate encrypted capability information of the terminal.
  • the receiver 1104 is configured to receive pre-association index information related to the terminal that is sent by the access point, where the pre-association index information is used by the access point when the terminal and the access point have not been associated with each other. Identifying the terminal;
  • the sender 1103 is configured to send, to the access point, the encrypted capability information of the terminal and an association request message, where the association request message includes the pre-association index information;
  • the receiver 1104 is further configured to receive an association response message that is sent by the access point according to the capability information of the terminal and the pre-association index information, so that the terminal establishes association with the access point.
  • the terminal of the embodiment of the present invention sends the capability information of the terminal to the access point in an encrypted manner, and identifies the terminal by using the pre-association index information, so that the eavesdropper is in the air interface before the association or in the association process. Even if the capability information is monitored, the capability information of the terminal cannot be obtained, thereby preventing the eavesdropper from determining the location, time, and the like of the terminal according to the capability information of the terminal, thereby avoiding leakage of user privacy.
  • the sender is further configured to: send an association request message to the access point, where the association request message includes the encrypted capability information of the terminal.
  • the sender is further configured to: send a first message to the access point, where the first message includes the encrypted capability information of the terminal, the first The message is a management message;
  • the sender is further configured to: before the sending module sends the encrypted capability information of the terminal, send the public key of the terminal to the access point, where The public key of the terminal is used by the access point to generate a decryption key for decrypting capability information of the terminal;
  • the receiving module is further configured to receive a public key of the access point sent by the access point;
  • the generating module is further configured to generate an encryption key of the terminal according to a public key of the access point, where an encryption key of the terminal is used to encrypt capability information of the terminal.
  • the sender is specifically configured to: send a probe request message to the access point, where the probe request message includes a public key of the terminal;
  • the receiver is specifically configured to: receive a probe response message sent by the access point, where the probe response message includes a public key of the access point;
  • the third message includes a public key of the access point, and the third message is a management message
  • beacon frame sent by the access point, where the beacon frame includes a public key of the access point.
  • the receiver is specifically configured to: receive indication information sent by the access point, where the indication information is used to indicate that the access point supports an encryption with the terminal.
  • the device capability information transmission of the terminal is specifically configured to: receive indication information sent by the access point, where the indication information is used to indicate that the access point supports an encryption with the terminal.
  • the receiver is further configured to: receive a probe response message sent by the access point, where The probe response message includes the indication information;
  • beacon frame sent by the access point, where the beacon frame includes the indication information.
  • the receiver is specifically configured to: receive a fifth message sent by the access point, where the fifth message includes the pre-association index information, and the fifth message is a management message;
  • the MAC address used by the terminal to send the association request message to the access point is used before the terminal sends the association request message to the access point.
  • the MAC address is different.
  • terminal may be used to perform various processes and/or steps corresponding to the terminal in the foregoing method embodiments. To avoid repetition, details are not described herein again.
  • FIG. 12 is a schematic block diagram of an access point according to another embodiment of the present invention.
  • the access point includes: a processor 1201, a memory 1202, a transmitter 1203, and a receiver 1205.
  • the components in the terminal are coupled together by a coupling manner, the receiver 1205 receives data through the antenna 1204, and the transmitter 1203 transmits through the antenna 1204. data.
  • the receiver and the transmitter may share an antenna having the capability of receiving and transmitting signals, and may also use different antennas, which is not limited by the embodiment of the present invention. Only the former case is an example.
  • the method for establishing association in the wireless local area network disclosed in the foregoing embodiment of the present invention may be applied to the processor 1201 or implemented by the processor 1201.
  • the processor 1201 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the foregoing method may be completed by an integrated logic circuit of hardware in the processor 1201 or an instruction in a form of software.
  • the processor 1201 may be a general-purpose processor, or a system-on-a-chip (SOC chip), a baseband processor, a digital signal processor (DSP), and an application specific integrated circuit (Application). Specific Integrated Circuit (ASIC), Field Programmable Gate Array (FPGA) or other programmable logic device, discrete gate or transistor logic device, discrete hardware component.
  • the general purpose processor may be a microprocessor or the processor or any conventional processor or the like.
  • the steps of the method disclosed in the embodiments of the present invention may be directly implemented by the hardware decoding processor, or may be performed by a combination of hardware and software modules in the decoding processor.
  • the software module can be located in a random access memory (RAM), a flash memory, a read-only memory (ROM), a programmable read only memory or an electrically erasable programmable memory, a register, etc.
  • RAM random access memory
  • ROM read-only memory
  • programmable read only memory or an electrically erasable programmable memory
  • register etc.
  • the storage medium is located in the memory 1202, and the processor 1201 reads the instructions in the memory 1202 and completes the steps of the above method in combination with its hardware.
  • the processor 1201 is configured to generate pre-association index information related to the terminal, where the pre-association index information is used by the access point to identify the terminal when the terminal has not established association with the access point;
  • the sender 1203 is configured to send the pre-association index information to the terminal;
  • the receiver 1205 is configured to receive the encrypted capability information of the terminal and the association request message sent by the terminal, where the association request message includes the pre-association index information;
  • the processor 1201 is configured to decrypt capability information of the encrypted terminal.
  • the sending module 1203 is further configured to send an association response message to the terminal according to the capability information of the terminal and the pre-association index information, so that the access point establishes an association with the terminal.
  • the access point of the embodiment of the present invention supports the capability information transmission of the terminal encrypted by the terminal, and identifies the terminal by associating the pre-index information, so that the eavesdropper is in the air interface even before the association or in the association process. Listen to this ability The information of the terminal cannot be obtained, so that the eavesdropper can be prevented from determining the location, time, and other information of the terminal according to the capability information of the terminal, thereby avoiding leakage of user privacy.
  • the receiver is specifically configured to: receive an association request message sent by the terminal, where the association request message includes the encrypted capability information of the terminal.
  • the receiver is further configured to: receive a first message sent by the terminal, where the first message includes the encrypted capability information of the terminal, the first message For managing a message; receiving an association request message sent by the terminal
  • the receiver is further configured to: receive a public key of the terminal sent by the terminal;
  • the processor is further configured to: generate a decryption key according to the public key of the terminal, where the decryption key is used to decrypt the encrypted capability information of the terminal;
  • the transmitter is further configured to: send a public key of the access point to the terminal, where a public key of the access point is used by the terminal to generate an encryption key for encrypting capability information of the terminal.
  • the receiver is specifically configured to: receive a probe request message sent by the terminal, where the probe request message includes a public key of the terminal;
  • the sender is specifically configured to: send a probe response message to the terminal, where the probe response message includes a public key of the access point;
  • the beacon frame including a public key of the access point.
  • the transmitter is specifically configured to: send, to the terminal, indication information, where the indication information is used to indicate that the access point supports a device of the terminal that is encrypted with the terminal.
  • Ability information transmission is specifically configured to: send, to the terminal, indication information, where the indication information is used to indicate that the access point supports a device of the terminal that is encrypted with the terminal.
  • the transmitter is further configured to: send a probe response message to the terminal, where the probe response message includes the indication information;
  • the beacon frame including the indication information.
  • the sender is specifically configured to: send, to the terminal, a fifth message, where the fifth message includes the pre-association index information, and the fifth message is a management message;
  • the processor is further configured to: generate, by the access point, capability information of the encrypted access point;
  • the sending module is further configured to send capability information of the encrypted access point to the terminal.
  • the access point may be used to perform various processes and/or steps corresponding to the access point in the foregoing method embodiments. To avoid repetition, details are not described herein again.
  • FIG. 13 is a schematic block diagram of a terminal according to still another embodiment of the present invention.
  • the terminal includes:
  • the processing module 1301 is configured to control the actions of each module in the terminal.
  • the discovery module 1302 is configured to perform discovery of an access point.
  • the discovery module is configured to discover an access point that supports a security association mode, and/or generate a probe request message.
  • the encryption and decryption module 1303 is configured to generate a public key and a private key pair for protecting capability information of the terminal.
  • the encryption and decryption module may further generate an encryption key and perform encryption and decryption processing on the capability information of the terminal.
  • the encryption and decryption module may further calculate an encryption key of the capability information of the terminal after obtaining the public key of the access point.
  • the encryption and decryption module may further encrypt the capability information of the terminal to generate capability information of the encrypted terminal.
  • the encryption and decryption module may further decrypt the capability information of the access point after receiving the capability information of the access point encrypted by the access point. Xu.
  • the association module 1304 is configured to perform authentication and association between the terminal and the access point, including completing authentication and association of the terminal according to the pre-security association index information.
  • terminal may be used to perform various processes and/or steps corresponding to the terminal in the foregoing method embodiments. To avoid repetition, details are not described herein again.
  • FIG. 14 is a schematic block diagram of an access point according to still another embodiment of the present invention, the access point includes:
  • the processing module 1401 is configured to control actions of internal modules in the access point.
  • the discovery response module 1402 is configured to perform generation and reply of the response of the discovery of the terminal.
  • the discovery response module is further configured to generate a probe response message.
  • the access point can also be instructed to support the anti-tracking mode.
  • the encryption and decryption module 1403 is configured to generate a public key and a private key pair that protect the access point capability information.
  • the encryption and decryption module may also generate an encryption key.
  • the encryption and decryption module may further perform encryption and decryption processing on the capability information of the access point.
  • the encryption and decryption module is further capable of calculating an encryption key of the capability information of the access point.
  • the encryption and decryption module may further decrypt the capability information of the encrypted terminal to obtain capability information of the terminal.
  • the encryption and decryption module may further encrypt the device capability information to generate capability information of the encrypted access point.
  • the encryption and decryption module may also generate pre-association index information.
  • the association module 1404 is configured to perform authentication and association of the terminal, including completing authentication and association with the terminal according to the pre-association index information.
  • the access point may be used to perform the various processes and/or steps corresponding to the access point in the foregoing method embodiment. To avoid repetition, details are not described herein.
  • the device configuration diagrams given in the various device embodiments of the present invention show only a simplified design of the corresponding device.
  • the device may include any number of transmitters, receivers, transceivers, processors, memories, etc., to implement the functions or operations performed by the device in various embodiments of the present invention, and all of which may be implemented.
  • the device to be applied is within the scope of this application.
  • the names of the message/frame/instruction information, modules, units, and the like provided in the embodiments of the present invention are merely examples, and other names may be used as long as the functions of the message/frame/instruction information, the module or the unit, and the like are the same.
  • the disclosed systems, devices, and methods may be implemented in other manners.
  • the device embodiments described above are merely illustrative.
  • the division of the unit is only a logical function division.
  • there may be another division manner for example, multiple units or components may be combined or Can be integrated into another system, or some features can be ignored or not executed.
  • the mutual coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interface, device or unit, and may be in an electrical, mechanical or other form.
  • the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of the embodiment.
  • each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.
  • the functions may be stored in a computer readable storage medium if implemented in the form of a software functional unit and sold or used as a standalone product. Based on such understanding, the technical solution of the embodiments of the present invention, or the part contributing to the prior art or the part of the technical solution, may be embodied in the form of a software product stored in a storage medium.
  • a number of instructions are included to cause a computer device (which may be a personal computer, server, or network device, etc.) or a processor to perform all or part of the steps of the methods described in various embodiments of the present invention.
  • the foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, and the like. .

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Databases & Information Systems (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本发明实施例提供了一种无线局域网中建立关联的方法、终端和接入点，该方法包括：终端生成加密的该终端的能力信息；该终端接收接入点发送的关联前索引信息，该关联前索引信息用于该接入点识别该终端；该终端向该接入点发送加密的该终端的能力信息和关联请求消息，该关联请求消息包括该关联前索引信息；该终端接收该接入点根据该终端的能力信息发送的关联响应消息，从而该终端与该接入点建立起关联。终端的能力信息通过加密的方式发送给接入点，并通过关联前索引信息来标识该终端，这样，窃听者在空口即使监听到该终端的能力信息，也不能获取该终端的能力信息，提高了用户隐私保护能力。

Description

无线局域网中建立关联的方法、终端和接入点
本申请要求于2016年8月31日提交中国专利局、申请号为CN201610799549.0、申请名称为“一种设备之间进行安全关联的方法和设备”的中国专利申请,以及于2016年11月11日提交中国专利局、申请号为CN201610995436.8、申请名称为“无线局域网中建立关联的方法、终端和接入点”的中国专利申请的优先权，它们的全部内容通过引用结合在本申请中。
技术领域
本发明实施例涉及通信领域，尤其涉及通信领域中无线局域网中建立关联的方法、终端和接入点。
背景技术
无线保真(Wireless Fidelity，WiFi)技术作为一种短距离的无线局域网通信技术，以其频谱免费、传输速率高等优点得到了非常广泛的应用。目前在机场、餐馆和会议室等许多公共场合都设置有WiFi的接入点(Access Point，AP)。用户可以通过带有WiFi网络接口的终端与AP相连，实现低资费或者免费的网络访问。
终端在向AP发送关联请求消息之前，首先向AP发送探测请求消息，在该探测请求消息中，携带了终端的设备信息，例如，设备的能力信息，支持的速率信息(Support rates)、扩展支持的速率信息(Extended Supported Rates)和厂商特定信息(Vendor Specific)等。这些设备信息在正常情况下不会发生变化，也就是说终端在与AP关联之前的探测请求消息中携带的这些设备信息长时间保持不变。这些信息中的某一种信息单独看在不同设备之间不是全局或者全球唯一的，但是其中一个或者多个信息的组合，就有可能成为该设备的一种“指纹”信息，这种“指纹”信息在局部地区或者甚至整个网络中都有可能在很大程度上能够唯一标识出该设备，因此，窃听者通过在空口接收探测请求消息并分析该消息中携带的这些“指纹”信息，便能够追踪到该设备，获取用户的隐私信息，例如，窃听者获取用户经常出现的地点、时间，从而通过大量的数据分析便可以获得用户的生活习惯、社会关系甚至社会关系等隐私信息。
发明内容
本申请提出了一种无线局域网中建立关联的方法、终端和接入点，以解决用户隐私在终端与接入点关联过程中泄露的问题。
第一方面，提供了一种无线局域网中建立关联的方法，该方法包括：终端生成加密的所述终端的能力信息；所述终端接收接入点发送的与所述终端相关的关联前索引信息，所述关联前索引信息用于所述接入点在所述终端与所述接入点尚未建立关联时识别所述终端；所述终端向所述接入点发送加密的所述终端的能力信息和关联请求消息，所述关联请求消息包括所述关联前索引信息；所述终端接收所述接入点根据所述终端的能力信息和所述关联前索引信息发送的关联响应消息，从而所述终端与所述接入点建立起关联。
该关联前索引信息能够标识该终端。该终端与该接入点尚未建立关联时，可以指在该终端与该接入点尚未成功建立本次关联时，可以是在建立本次关联前或在建立本次关联的过程中，具体可以包括：在STA向AP发送关联请求消息时，或者说，在AP接收到STA发送的关联请求消息时。当然，该关联前 索引信息也可以在该终端与该接入点成功建立本次关联后继续使用，例如，用于下一次该终端与该接入点进行关联前或关联过程中。
终端的能力信息通过加密的方式发送给接入点，并通过关联前索引信息来标识该终端，这样，窃听者不管是在关联之前或者是在关联过程中在空口即使监听到该终端的能力信息，也不能获取该终端的能力信息，从而可以防止窃听者根据终端的能力信息确定终端所在的位置、时间等信息，避免用户隐私的泄露。
结合第一方面，在第一方面的某些实现方式中，所述终端向所述接入点发送加密的所述终端的能力信息和关联请求消息(可称为：Association Request消息)，包括：所述终端向所述接入点发送所述关联请求消息，所述关联请求消息包括所述加密的所述终端的能力信息。
通过所述关联请求消息来携带所述加密的终端的能力信息，可以进一步节省信令的开销，提高无线资源的利用率。
结合第一方面，在第一方面的某些实现方式中，所述终端向所述接入点发送加密的所述终端的能力信息和关联请求消息，包括：所述终端向所述接入点发送第一消息，所述第一消息包括所述加密的所述终端的能力信息，所述第一消息为管理消息；所述终端向所述接入点发送所述关联请求消息。
结合第一方面，在第一方面的某些实现方式中，在所述终端向所述接入点发送加密的所述终端的能力信息之前，所述方法还包括：所述终端向所述接入点发送所述终端的公钥，所述终端的公钥用于所述接入点生成解密所述加密的终端的能力信息的解密密钥，其中，所述终端接收所述接入点发送的与所述终端相关的关联前索引信息发生在所述终端向所述接入点发送所述终端的公钥之后；所述终端接收所述接入点发送的所述接入点的公钥；所述终端根据所述接入点的公钥生成所述终端的加密密钥，所述终端的加密密钥用于加密所述终端的能力信息。
结合第一方面，在第一方面的某些实现方式中，所述终端向所述接入点发送所述终端的公钥，包括：所述终端向所述接入点发送探测请求消息(即：Probe Request消息)，所述探测请求消息包括所述终端的公钥；或者，所述终端向所述接入点发送第二消息，所述第二消息包括所述终端的公钥，所述第二消息为管理消息。
结合第一方面，在第一方面的某些实现方式中，所述终端接收所述接入点发送的所述接入点的公钥，包括：所述终端接收所述接入点发送的探测响应消息(Probe Response消息)，所述探测响应消息包括所述接入点的公钥；或者，所述终端接收所述接入点发送的第三消息，所述第三消息包括所述接入点的公钥，所述第三消息为管理消息；或者，所述终端接收所述接入点发送的信标帧，所述信标帧包括所述接入点的公钥。
结合第一方面，在第一方面的某些实现方式中，所述方法还包括：所述终端接收所述接入点发送的指示信息，所述指示信息用于指示所述接入点支持与所述终端进行加密的所述终端的设备能力信息的传输。
结合第一方面，在第一方面的某些实现方式中，所述方法还包括：所述终端接收所述接入点发送的指示信息，包括：所述终端接收所述接入点发送的探测响应消息，所述探测响应消息包括所述指示信息；或者，所述终端接收所述接入点发送的第四消息，所述第四消息包括所述指示信息，所述第四消息为管理消息；或者，所述终端接收所述接入点发送的信标帧(即Beacon帧)，所述信标帧包括所述指示信息。
结合第一方面，在第一方面的某些实现方式中，所述终端接收所述接入点发送的关联前索引信息，包括：所述终端接收接入点发送的第五消息，所述第五消息包括所述关联前索引信息，所述第五消息为 管理消息(如：Action Frame)；或者，所述终端接收所述接入点发送的探测响应消息，所述探测响应消息包括所述关联前索引信息。
结合第一方面，在第一方面的某些实现方式中，所述终端向所述接入点发送所述关联请求消息所使用的MAC地址与所述终端向所述接入点发送所述关联请求消息之前所使用的MAC地址不同。
即使所述终端在向所述接入点发送关联请求消息之前使用的MAC地址和发送关联请求消息时使用的MAC地址不同，所述接入点仍然能够通过所述关联前索引信息来识别所述终端。
结合第一方面，在第一方面的某些实现方式中，所述第一消息、第二消息为同一消息，该消息同时包含了所述第一消息和所述第二消息所包含的内容。
结合第一方面，在第一方面的某些实现方式中，所述第一消息和所述第二消息为独立的消息。
应理解，这里独立的消息可以是与上述同一消息相对的概念，也就是说，第一消息和第二消息可以是不同的分别发送的消息。
结合第一方面，在第一方面的某些实现方式中，所述第三消息、第四消息和第五消息为同一消息，该消息包含了所述第三消息、第四消息和第五消息所包含的内容。
结合第一方面，在第一方面的某些实现方式中，所述第三消息、第四消息和第五消息中至少两个消息为独立的消息。
应理解，这里独立的消息可以是与上述同一消息相对的概念，也就是说，第三消息、第四消息和第五消息中至少两个消息可以是不同的分别发送的消息。
第二方面，提供了一种无线局域网中建立关联的方法，该方法包括：接入点生成与终端相关的关联前索引信息，所述关联前索引信息用于所述接入点在所述终端与所述接入点尚未建立关联时识别所述终端；所述接入点向所述终端发送所述关联前索引信息；所述接入点接收所述终端发送的加密的所述终端的能力信息和关联请求消息，所述关联请求消息包括所述关联前索引信息；所述接入点解密所述加密的终端的能力信息；所述接入点根据所述终端的能力信息和所述关联前索引信息向所述终端发送关联响应消息(可称为：Association Response消息)，从而所述接入点与所述终端建立起关联。
结合第二方面，在第二方面的某些实现方式中，所述接入点接收所述终端发送的加密的所述终端的能力信息和关联请求消息，包括：所述接入点接收所述终端发送的所述关联请求消息，所述关联请求消息包括所述加密的所述终端的能力信息。
结合第二方面，在第二方面的某些实现方式中，所述接入点接收所述终端发送的加密的所述终端的能力信息和关联请求消息，包括：所述接入点接收所述终端发送的第一消息，所述第一消息包括所述加密的所述终端的能力信息，所述第一消息为管理消息；所述接入点接收所述终端发送的关联请求消息。
结合第二方面，在第二方面的某些实现方式中，在所述接入点接收所述终端发送的加密的所述终端的能力信息之前，所述方法还包括：所述接入点接收所述终端发送的所述终端的公钥，其中，所述接入点向所述终端发送所述关联前索引信息发生在所述接入点接收所述终端发送的所述终端的公钥之后；所述接入点根据所述终端的公钥生成解密密钥，所述解密密钥用于解密所述加密的所述终端的能力信息；所述接入点向所述终端发送所述接入点的公钥，所述接入点的公钥用于所述终端生成加密所述终端的能力信息的加密密钥。
结合第二方面，在第二方面的某些实现方式中，所述接入点接收所述终端发送的所述终端的公钥，包括：所述接入点接收所述终端发送的探测请求消息，所述探测请求消息包括所述终端的公钥；或者，所述接入点接收所述终端发送的第二消息，所述第二消息包括所述终端的公钥，所述第二消息为管理消息。
结合第二方面，在第二方面的某些实现方式中，所述接入点向所述终端发送所述接入点的公钥，包括：所述接入点向所述终端发送探测响应消息，所述探测响应消息包括所述接入点的公钥；或者，所述接入点向所述终端发送第三消息，所述第三消息包括所述接入点的公钥，所述第三消息为管理消息；或者，所述接入点向所述终端发送信标帧，所述信标帧包括所述接入点的公钥。
结合第二方面，在第二方面的某些实现方式中，所述方法还包括：所述接入点向所述终端发送指示信息，所述指示信息用于指示所述接入点支持与所述终端进行加密的所述终端的设备能力信息的传输。
结合第二方面，在第二方面的某些实现方式中，所述接入点向所述终端发送指示信息，包括：所述接入点向所述终端发送探测响应消息，所述探测响应消息包括所述指示信息；或者所述接入点向所述终端发送第四消息，所述第四消息包括所述指示信息，所述第四消息为管理消息；或者，所述接入点向所述终端发送信标帧，所述信标帧包括所述指示信息。
结合第二方面，在第二方面的某些实现方式中，所述接入点向所述终端发送所述关联前索引信息，包括：所述接入点向所述终端发送第五消息，所述第五消息包括所述关联前索引信息，所述第五消息为管理消息；或者，所述接入点向所述终端发送探测响应消息，所述探测响应消息包括所述关联前索引信息。
结合第二方面，在第二方面的某些实现方式中，在所述接收所述终端发送的所述关联请求消息之前，所述方法还包括：所述接入点生成加密的接入点的能力信息；所述接入点向所述终端发送所述加密的接入点的能力信息。
第三方面，提供了一种终端，该终端可用于执行上述第一方面各方法实施例所提供的方法，该终端包括：生成模块，用于生成加密的所述终端的能力信息；接收模块，用于接收接入点发送的关联前索引信息，所述关联前索引信用于所述接入点识别所述终端；发送模块，用于向所述接入点发送加密的所述终端的能力信息和关联请求消息，所述关联请求消息包括所述关联前索引信息；所述接收模块还用于接收所述接入点根据所述终端的能力信息发送的关联响应消息，从而所述终端和所述接入点建立起关联。
第四方面，提供了一种接入点，该接入点可用于执行上述第二方面各方法实施例所提供的方法，该接入点包括：生成模块，用于生成与终端相关的关联前索引信息，所述关联前索引信息用于所述接入点在所述终端与所述接入点尚未建立关联时识别所述终端；发送模块，用于向所述终端发送所述关联前索引信息；接收模块，用于接收所述终端发送的加密的所述终端的能力信息和关联请求消息，所述关联请求消息包括所述关联前索引信息；解密模块，用于解密所述加密的终端的能力信息；所述发送模块还用于：根据所述终端的能力信息和所述关联前索引信息向所述终端发送关联响应消息，从而所述接入点和所述终端建立起关联。
第五方面，提供了一种终端，该终端可用于执行上述第一方面各方法实施例所提供的方法，该终端包括：处理器1101、存储器1102、发送器1103、接收器1105，终端中的前述各个组件通过耦合的方式连接在一起，接收器1105通过天线1104接收数据，发送器1103通过天线1104发送数据。其中，该处理器1101，用于生成加密的所述终端的能力信息；接收器1105，用于接收接入点发送的关联前索引信息，所述关联前索引信用于所述接入点识别所述终端；发送器1103，用于向向所述接入点发送加密的所述终端的能力信息和关联请求消息，所述关联请求消息包括所述关联前索引信息；所述接收器1104还用于接收所述接入点根据所述终端的能力信息和所述关联前索引信息发送的关联响应消息，从而所述终端和所述接入点建立起关联。
第六方面，提供了一种接入点，该接入点可用于执行上述第二方面各方法实施例所提供的方法，该接入点包括：处理器1201、存储器1202、发送器1203、接收器1205，终端中的各个组件通过耦合的方 式连接在一起，接收器1205通过天线1204接收数据，发送器1203通过天线1204发送数据。其中，该处理器1201，用于生成与终端相关的关联前索引信息，所述关联前索引信息用于所述接入点在所述终端与所述接入点尚未建立关联时识别所述终端；发送器1203，用于向所述终端发送所述关联前索引信息；接收器1205，用于接收所述终端发送的加密的所述终端的能力信息和关联请求消息，所述关联请求消息包括所述关联前索引信息；处理器1201，用于解密所述加密的终端的能力信息；所述发送器1203还用于根据所述终端的能力信息和所述关联前索引信息向所述终端发送关联响应消息，从而所述接入点和所述终端建立起关联。
第七方面，提供了一种计算机可读介质，用于存储计算机程序，该计算机程序包括用于执行第一方面或第一方面的任意可能的实现方式中的方法的指令。
第八方面，提供了一种计算机可读介质，用于存储计算机程序，该计算机程序包括用于执行第二方面或第二方面的任意可能的实现方式中的方法的指令。
第九方面，提供了一种通信的***，包括如第三方面所述的终端和第四方面所述的接入点。
第十方面，提供了一种通信的***，包括如第五方面所述的终端和第六方面所述的接入点。
终端的能力信息通过加密的方式发送给接入点，这样，窃听者不管是在关联之前或者是在关联过程中在空口即使监听到该加密的终端的能力信息，也不能解密获取该终端的能力信息，从而可以防止窃听者根据终端的能力信息确定终端所在的位置、时间等信息，避免用户隐私的泄露。进一步地，接入点通过给终端分配关联前索引信息，通过关联前索引信息来标识该终端，这样，即使终端在向接入点发送关联请求消息之前使用的MAC地址和发送关联请求消息时使用的MAC地址不同，接入点仍然能够通过关联前索引信息来识别终端，并确定解密密钥来解密所述加密的终端的设备能力信息，从而获得终端的设备能力信息。
附图说明
图1是本发明实施例可能使用的应用场景；
图2是根据本发明实施例的智能手机的示意性框图；
图3是本发明实施例的无线局域网中建立关联的方法的流程图；
图4是本发明另一实施例的无线局域网中建立关联的方法的流程图；
图5是本发明再一实施例的无线局域网中建立关联的方法的流程图；
图6是本发明再一实施例的无线局域网中建立关联的方法的流程图；
图7是本发明再一实施例的无线局域网中建立关联的方法的流程图；
图8是本发明再一实施例的无线局域网中建立关联的方法的流程图；
图9是本发明实施例的终端的示意性框图；
图10是本发明实施例的接入点的示意性框图；
图11是本发明另一实施例的终端的示意性框图；
图12是本发明另一实施例的接入点的示意性框图；
图13是本发明再一实施例的终端的示意性框图；
图14是本发明再一实施例的接入点的示意性框图。
具体实施方式
下面结合附图，对本发明的实施例进行描述。
本发明的各实施例，可以应用于各种无线通信***，例如：基于无线保真(Wireless Fidelity，WIFI)、蓝牙(Bluetooth)、及全球微波互联接入(Worldwide Interoperability for Microwave Access，WiMAX)、无线局域网鉴别和保密基础结构(Wireless LAN Authentication and Privacy Infrastructure，WAPI)等等***以及其它将终端以无线方式互相连接的通信***。本发明实施例并不限定，但为描述方便，下述实施例以WiFi***为例进行说明。
接入点(Access Point，AP)，也可称之为无线访问接入点或桥接器或热点等，其可以接入服务器或通信网络。
站点(Station，STA)，可以是无线传感器、无线通信终端或移动终端，如支持WiFi通讯功能的移动电话(或称为“蜂窝”电话)和具有无线通信功能的计算机，例如，可以是支持WiFi通讯功能的便携式、袖珍式、手持式、计算机内置的或者车载的无线通信装置，它们与无线接入网交换语言和/或数据。本发明实施例并不限定，但为描述方便，下述实施例以终端为例进行说明。
图1是本发明实施例可能使用的应用场景。如图1所示，STA在向AP发送关联请求之前，首先向AP发送探测请求消息，该探测请求消息中可以包括该STA的设备信息，并接收AP根据该探测请求消息内容发送的探测响应消息；或者，终端接收接入点发送的信标帧，该信标帧可以包括该接入点的设备信息。之后终端向AP发送关联请求消息，接收AP发送的关联响应消息并完成与AP的关联。终端在与AP关联后可以通过安全认证消息建立与AP的安全连接，从而进行后续的数据传输。
在上述STA与AP建立关联的过程中，探测请求消息和/或关联请求消息中携带的该STA的设备信息是通过空口发送，由于该STA的设备信息中的个性化信息容易构成该STA的“指纹”信息，因此，窃听者可以通过在空口上接收和分析探测请求消息和/或关联请求消息报文，便可以追踪到该STA，造成用户隐私信息的泄露。
应理解，当具有WiFi功能的STA与AP处于未连接状态时，STA一般会周期性的发送探测请求消息来扫面周围的接入点，即使STA已经与当前AP连接，在实际中STA仍然会发送探测请求消息扫描周围的接入点，这样当当前接入点的信号变弱的情况下，STA可以快速完成接入点的切换。这种STA在关联状态下和未关联状态下均会发送探测请求，而探测请求中携带设备信息，例如，设备能力信息、支持速率信息等个性化信息，MAC地址信息等，其中这些设备的全部信息或者是部分信息容易构成该STA的“指纹”信息，窃听者通过监听这些信息便可以获取STA的位置、时间等信息，从而通过分析获取用户的隐私信息。
对于STA的MAC地址泄露用户隐私的问题可以通过临时MAC地址的方法解决，也就是说，在STA发送探测请求时，STA使用临时MAC地址，而在与AP实际关联过程中使用真实MAC地址。这种方法在一定程度上可以避免窃听者通过监听MAC地址而泄露用户的隐私信息，但是探测请求中所包括的设备信息构成的“指纹”信息仍然会泄露用户的隐私信息。
图2示出了与本发明实施例相关的智能手机100的部分结构框图。该智能手机100包括：射频(Radio Frequency，简称为“RF”)电路110，存储器120、输入单元130、显示单元140、音频电路150、WiFi模块160、处理器170、以及电源180等部件。本领域技术人员可以理解，图4中示出的手机结构并不构成对手机的限定，可以包括比图示更多或更少的部件，或者组合某些部件，或者拆分某些部件，或者不同的部件布置。
在本发明实施例中，RF电路110可用于收发信息或通话过程中信号的接收和发送，特别地，将基站的下行信息接收后，给处理器170处理；另外，将涉及上行的数据发送给基站。通常，RF电路110包括但不限于天线、至少一个放大器、收发信机、耦合器、低噪声放大器(Low Noise  Amplifier，简称为“LNA”)、双工器等。此外，RF电路110还可以通过无线通信与网络和其他设备通信。该无线通信可以使用任一通信标准或协议，包括但不限于全球移动通讯***(Global System of Mobile Communication，简称为“GSM”)、通用分组无线服务(General Packet Radio Service，简称为“GPRS”)、码分多址(Code Division Multiple Access，简称为“CDMA”)、宽带码分多址(Wideband Code Division Multiple Access，简称为“WCDMA”)、长期演进(Long Term Evolution，简称为“LTE”)、电子邮件、短消息服务(Short Messaging Service，简称为“SMS”)等。
存储器120可用于存储软件程序，处理器170通过运行存储在存储器120的软件程序，从而执行智能手机100的各种功能应用以及数据处理。存储器120可主要包括存储程序区和存储数据区，其中，存储程序区可存储操作***、至少一个功能所需的应用程序(比如声音播放功能、图象播放功能等)等；存储数据区可存储根据智能手机100的使用所创建的数据(比如音频数据、电话本等)等。此外，存储器120可以包括高速随机存取存储器，还可以包括非易失性存储器，例如至少一个磁盘存储器件、闪存器件、或其他易失性固态存储器件。
输入单元130可用于接收输入的数字或字符信息，以及产生与智能手机100的用户设置以及功能控制有关的键信号输入。具体地，输入单元130可包括触控面板以及其他输入设备。触控面板，也称为触摸屏，可收集用户在其上或附近的触摸操作(比如用户使用手指、触笔等任何适合的物体或附件在触控面板上或在触控面板附近的操作)，并根据预先设定的程式驱动相应的连接装置。可选的，触控面板可包括触摸检测装置和触摸控制器两个部分。其中，触摸检测装置检测用户的触摸方位，并检测触摸操作带来的信号，将信号传送给触摸控制器；触摸控制器从触摸检测装置上接收触摸信息，并将它转换成触点坐标，再送给处理器，并能接收处理器发来的命令并加以执行。此外，可以采用电阻式、电容式、红外线以及表面声波等多种类型实现触控面板。除了触控面板，输入单元还可以包括其他输入设备。具体地，其他输入设备可以包括但不限于物理键盘、功能键(比如音量控制按键、开关按键等)、轨迹球、鼠标、操作杆等中的一种或多种。
显示单元140可用于显示由用户输入的信息或提供给用户的信息以及设备的各种菜单。显示单元140可包括显示面板，可选的，可以采用液晶显示器(Liquid Crystal Display，简称为“LCD”)、有机发光二极管(Organic Light-Emitting Diode，简称为“OLED”)等形式来配置显示面板。进一步的，触控面板可覆盖显示面板，当触控面板检测到在其上或附近的触摸操作后，传送给处理器以确定触摸事件的类型，随后处理器170根据触摸事件的类型在显示面板上提供相应的视觉输出。虽然在图2中，触控面板与显示面板是作为两个独立的部件来实现智能手机100的输入和输出功能，但是在某些实施例中，可以将触控面板与显示面板集成而实现智能手机100的输入和输出功能。
音频电路150、扬声器，麦克风可提供用户与智能手机100之间的音频接口。音频电路150可将接收到的音频数据转换后的电信号，传输到扬声器，由扬声器转换为声音信号输出；另一方面，麦克风将收集的声音信号转换为电信号，由音频电路150接收后转换为音频数据，将音频数据输出至存储器170以便进一步处理。
WiFi模块160是集成WiFi功能的芯片基本电路集合，WiFi模块160能够根据协议进行无线传输。
处理器170是智能手机100的控制中心，利用各种接口和线路连接整个智能手机100的各个部分，通过运行或执行存储在存储器内的软件程序和/或模块，以及调用存储在存储器120内的数 据，执行智能手机100的各种功能和处理数据，从而对智能手机100进行整体监控。可选的，处理器170可包括一个或多个处理单元；可选的，处理器170可集成应用处理器和调制解调处理器，其中，应用处理器主要处理操作***、用户界面和应用程序等，调制解调处理器主要处理无线通信。可以理解的是，上述调制解调处理器也可以不集成到处理器170中。
应理解，上述包含WiFi模块的手机既可以作为接入点，也可以作为关联接入点的终端，不管作为接入点还是作为关联接入点的终端，由于手机包含用户大量的个人隐私信息，因此手机在作为与接入点关联的终端或者是作为接入点时都有隐私保护的需求。
还应理解，手机作为与接入点关联的终端可以是本发明实施例的一种应用场景，即本发明实施例中所述终端可以为此处所述的手机，所述终端的结构可以参考所述手机的部分结构框图(如，所述终端的发送器和接收器可以对应所述手机的RF电路，它们可以完成相似或相同的功能)，并可能具有更多或更少的部件。
图3示出了本发明实施例的无线局域网中建立关联的方法的示意图，该方法可以用于可穿戴设备作为STA和手机作为AP的应用场景中，应理解，在本发明实施例中，该STA也可以称为终端，该方法包括：
S310，终端生成加密的终端的能力信息。
具体而言，终端可以将该终端的个性化能力信息进行加密，生成加密的终端的能力信息。在此，终端的个性化能力信息可以是该终端特有的能力信息，也就是说，窃听者可以根据终端的个性化信息所组成的“指纹”信息跟踪该设备。当然，终端的能力信息也可以包括该终端的通用能力信息，这些终端的能力信息可以是终端的设备信息中的全部信息或者是部分信息，对此本发明实施例不做限定。
可选地，在一些实施例中，AP也可以生成加密的AP的能力信息，应理解这里，AP的能力信息可以是AP的设备信息中的全部信息或者是部分信息。AP可以根据保密传输的需求确定进行加密传输的AP的能力信息。
具体而言，终端在与AP关联，AP也可以具有保护隐私的需求，当AP需要保护隐私时，AP也可以生成加密的AP的能力信息，这里的AP能力信息可以为AP设备信息中的全部或者部分信息。
S320，接入点生成与终端相关的关联前索引信息，该关联前索引信息用于在所述终端与所述接入点尚未建立关联时识别所述终端。
具体而言，接入点生成关联前索引信息，该关联前索引信息可以在一段时间内不发生改变，当然，AP也可以设置该关联前索引足够长，该关联前索引信在很长时间内可以保持唯一。这样，AP生成该关联前索引后，可以在很长时间内标识某一特定终端，从而根据该关联前索引信息确定与该关联前索引对应的终端的能力信息，在后续关联过程中可以确定使用与该终端对应的能力建立关联。应理解，该关联前索引信息还可以对应一个终端，AP生成的关联前索引信息在该索引信息的有效时间内保持唯一，即每一个终端对应不同的关联前索引信息，也就是说，关联前索引信息与终端是一对一的关系。还应理解，这里的关联前索引信息可以是一个身份(Identity，ID)标识符，或者是一串数字，或者是某一字符，或者是数字与字符等的组合，对此本发明实施例不做限定。关联前索引信息可以是在关联前生成，有效期可以持续不同的时间，例如，可以是STA完成与AP的本次关联后即失效；也可以是很长时间，这样，在STA完成与AP的关联进行本次关联回话后，该关联前索引信息在STA与AP的下次关联时仍然有效。
可选地，在一些实施例中，AP生成关联前索引信息，该关联前索引信息还可以标识终端的 能力信息。例如，当终端具备能力信息1，则AP生成关联前索引信息1与该能力信息1对应，当终端具备能力信息2，则AP生成关联前索引信息2与该能力信息2对应。在后续AP与终端实际关联过程中，AP可以根据该关联前索引信息确定终端的能力信息，从而采用对应的能力与终端进行数据传输。这里，当AP生成的关联前索引信息与不同的设备能力信息相对应时，同一个关联前索引信息可以对应多个终端，是一对多的关系，例如，具备能力信息1的终端都可以对应关联信息1。当关联前索引信息用于标识终端的能力信息时，这样关联前索引信息可能只有有限的几种，这样避免了终端的个性化设备能力信息形成“指纹”造成隐私信息的泄露，提升了终端隐私的保护能力。
可选地，在一些实施例中，AP也可以生成加密的关联前索引信息。当AP生成加密的关联前索引信息，可以避免窃听者通过空口获取该关联前索引信息，更好的保护用户的隐私。
另外，在本实施例中，不限定S310生成加密的终端的能力信息和S320生成关联前索引信息之间的先后关系。可以是终端先生成加密的能力信息，也可以是AP先生成关联前索引信息。
S330，接入点向终端发送关联前索引信息。
应理解，在本发明实施例中，接入点也可以向终端发送加密的关联前索引信息，对此本发明实施例不做限定。
可选地，在一些实施例中，该接入点可以向终端发送第五消息，该第五消息包括该关联前索引信息。
具体地，在本发明实施例中，该第五消息可以是一种新定义的帧，例如，该第五消息可以是一种管理帧，例如Action frame或者是Public Action frame，在该Action frame中携带上述关联前索引信息。应理解，在AP通过第五消息向终端发送关联前索引信息之前，该接入点还可以接收终端发送的关联帧，该关联帧可以包括终端的通用的能力信息，这里的关联帧也可以是一种新定义的管理帧，例如，Action frame。也就是说，终端通过新定义的管理帧向接入点发送该终端的通用能力信息时，接入点可以通过新定义的第五消息向终端发送关联前索引信息。
还应理解，当终端对保密能力要求较高时，接入点还可以通过第五消息来发送加密的关联前索引信息。
可选地，在一些实施例中，该接入点可以向终端发送探测响应消息，该探测响应消息包括关联前索引信息。
应理解，在接入点向终端发送探测响应消息之前，该方法还包括：该终端向接入点发送探测请求消息。
具体而言，在本发明实施例中，终端向AP发送探测请求消息，该探测请求消息中可以包括该终端的通用能力信息，应理解，终端也可以根据其对隐私保护的需求情况确定该探测请求信息中所包括的通用能力信息，例如，当终端对隐私保护需求很高时，所有可以被窃听者用来生成“指纹”的设备能力信息将不传输。当然，接入点也可以将该关联前索引信息进行加密，也就是说，接入点可以通过探测响应消息来向终端发送加密的关联前索引信息。接入点在接收终端的探测请求消息后，接入点向终端发送该探测请求消息的探测响应消息，该探测响应消息可以包括AP生成的关联前索引信息。
应理解，当终端发送新定义的管理帧来传输通用能力信息时，接入点向终端发送的也是新定义的关联帧，用来传输关联前索引信息。但本发明实施例不限于此，例如，终端可以通过探测请求消息来携带该终端的通用能力信息，接入点可以通过新定义的帧来向终端发送关联前索引信息， 或者，终端可以通过新定义的帧来向接入点发送该终端的关联前索引信息，接入点可以通过在探测响应消息中向终端发送关联前索引信息。这里新定义的帧可以是一种管理帧，例如Action frame。
还应理解，S330步骤与S310步骤之前不限定先后关系。AP传输关联前索引信息只要在终端发起关联请求之前即可。该关联前索引信息将被终端用来携带在关联请求中，以便于AP识别该关联请求对应的终端。
S340，终端向接入点发送加密的终端的能力信息和关联请求消息，该关联前请求消息包括所述关联前索引信息。
应理解，在本发明实施例中，加密的终端的能力信息和关联请求消息可以同时发送，也可以在不同的消息中发送。例如先发送加密的终端的能力信息，再发送关联请求消息。对于终端向接入点发送加密的终端的能力信息可以有多种方式实现，对于具体实现方式将在下文描述。
可选地，在一些实施例中，该终端向接入点发送加密的终端的能力信息和关联请求消息，包括：
所述终端向所述接入点发送关联请求消息，所述关联请求消息包括所述加密的所述终端的能力信息。
具体而言，终端可以在向AP发送的关联请求消息中包含一个IE，在该IE中携带所述加密的所述终端的能力信息，也就是说，通过在关联前请求消息中新建一个信息元素(Information Element，IE)来承载所述加密的所述终端的能力信息。在这种情况下，AP可以根据关联前索引信息确定该终端，并确定之前跟该终端协商的密钥，以便于该AP确定使用对应的密钥解密接收到的所述加密的所述终端的能力信息。
可选地，在一些实施例中，该终端向接入点发送加密的所述终端的能力信息和关联请求消息，包括：
终端向接入点发送第一消息，所述第一消息包括加密的所述终端的能力信息，该第一消息为管理消息；
该终端向接入点发送该关联请求消息。
具体而言，第一消息可以是一种新定义的帧，例如第一消息可以是一种管理帧，例如Action frame或者是Public Action frame，终端可以通过该Action frame来携带加密的所述终端的能力信息，当然该第一消息也可以是其他类型的帧。终端向接入点发送关联请求消息，该关联请求消息中可以携带关联前索引信息。具体地，可以在该关联请求消息中新建一个IE，在该IE中承载该关联前索引信息。该关联前索引信息是AP生成并发送给终端，终端可以在该关联请求信息中携带该关联前索引信息，以便于AP能够根据该关联前索引信息确定该终端。这样，即使关联消息和终端之前发送给AP的消息采用不同的MAC地址，AP仍然能够根据关联前索引信息来确定终端之间的对应关系。
应理解，终端向接入点发送第一消息可以在终端发送关联请求消息之前，也就是说，终端在向AP发送关联请求消息之前，AP可以已经获取该终端的能力信息；AP向终端发送关联前索引信息可以在终端发送第一消息之前，也可以在终端发送第一消息之后，对此本发明实施例不做限定；但是AP发送关联前索引信息一定在终端发送关联请求消息之前；当接入点向终端发送关联前索引信息在终端发送第一消息之后时，终端通过第一消息发送加密的所述终端的能力信息，AP收到该终端的能力信息后给终端发送分配的关联前索引信息，并发送给终端，后续当终端向接入点发送关联请求消息时，携带之前AP为终端分配的关联前索引信息，这样终端在发送关联请求消息时即 使不携带终端的能力信息，AP也可以根据关联请求消息中携带的关联前索引信息来确定终端的能力信息。
应理解，AP在收到终端的加密的能力信息之后，为终端分配关联前索引信息，在这种情况下，接入点为终端分配的关联前索引信息可以用来标识终端的能力信息，例如，接入点在获取终端的加密的能力信息之后，接入点通过关联前索引信息1来标识终端的能力信息1，并将该关联前索引信息1发送给终端，在终端后续关联时，携带该关联前索引信息1，接入点通过该关联前索引信息1可以确定终端的能力信息。
应理解，在本发明实施例中，终端的能力信息可以通过第一消息在关联请求消息之前发送，因此，在该关联请求消息中可以不包括该终端的能力信息，或者该关联请求消息中可以仅仅包括该终端的通用能力信息，接入点可以通过关联前请求消息来确定对应的终端。
可选地，在一些实施例中，该终端向接入点发送加密的所述终端的能力信息包括：
终端向接入点发送探测请求消息，该探测请求消息包括加密的该终端的能力信息。
具体地，终端向接入点发送探测请求消息，可以在该探测请求消息中新建一个IE，在该IE中承载该加密的终端的能力信息，当然，也可以通过该探测请求消息中已有的IE来承载加密的终端的能力信息。
可选地，在一些实施例中，终端向接入点发送关联请求消息所使用的MAC地址与终端向接入点发送关联请求消息之前的消息所使用的MAC地址不同。
应理解，在本发明实施例中，终端在与AP关联过程中，终端在扫描阶段，也就是终端在向AP发送关联请求之前，终端与AP进行信令交互所使用的MAC地址与终端与AP进行关联所使用的MAC地址可以是不同的，因此在本发明实施例中，AP可以通过生成的关联前索引信息，在终端与AP实际关联时识别该终端和/或该终端的能力，这样，即时在终端向AP发送关联请求时的MAC地址发生改变，AP也可以通过该关联前索引信息确定该关联请求对应之前哪个终端，并确定对应的能力信息。
S350，接入点解密加密的终端的能力信息。
具体而言，接入点在接收终端发送的加密的该终端的能力信息之后，解密该加密的终端的能力信息，从而获取该终端的能力信息。
应理解，在S340中，当终端通过第一消息发送加密的该终端的能力信息时，S350中接入点解密加密的终端的能力信息可以是在S340中终端发送关联请求消息之前，而在第一消息之后。
还应理解，接入点生成关联前索引信息还可以在S350之后，也就是说，接入点可以在获取终端的加密的能力信息之后，根据该终端的能力信息来生成关联前索引信息。当然，接入点生成关联索引信息也可以在S350之前，对此本发明实施例不做限定。
S360，接入点根据终端的能力信息和所述关联前索引信息向该终端发送关联响应消息，从而完成与终端的关联。
在一些实施例中，当该关联前索引信息还可以标识终端的能力信息时，步骤S360可以为该接入点根据该关联前索引信息向该终端发送关联响应消息，并完成与终端的关联。
S370，接入点和终端建立起安全的连接。
需要说明的是，当终端接收到AP发送的携带指示关联成功的指示信息的关联响应消息时,即终端完成与AP的关联,之后两者可以进一步建立连接以传输数据；在终端发送关联请求消息之前还可能包括终端与AP之间的安全认证,或者是终端在接收到关联响应消息之后,两者完成连接 建立之前两者进行安全认证。
应理解，在本发明实施方式中，上述各过程的序号的大小并不意味者执行顺序的先后，例如，S330中接入点向终端发送关联前索引信息并不一定在S310之后，S330也可以先于S310执行。各个过程的执行顺序应以其功能和内在逻辑确定，而不应对本发明实施例的实施过程构成任何限定。
终端的能力信息通过加密的方式发送给接入点，这样，窃听者不管是在关联之前或者是在关联过程中在空口即使监听到该能力信息，也不能获取该终端的能力信息，从而可以防止窃听者根据终端的能力信息确定终端所在的位置、时间等信息，避免用户隐私的泄露。进一步地，接入点通过给终端分配关联前索引信息，通过关联前索引信息来标识终端，这样，即使终端在向接入点发送关联请求消息之前使用的MAC地址和发送关联请求消息时使用的MAC地址不同，接入点仍然能够通过关联前索引信息来识别终端，并确定终端的加密的设备能力信息的解密密钥来解密终端的设备能力信息，从而获得终端的设备能力信息。
可选地，在一些实施例中，该终端向接入点发送该加密的终端的能力信息之前，该方法还包括：
该终端向接入点发送探测请求消息；
该终端接收接入点根据该探测请求消息发送的探测响应消息。
具体地，在本发明实施例中，当终端通过新定义的帧，例如一种管理帧来发送加密的终端的能力信息，并且接入点通过新定义的帧来向终端发送关联请求消息时，终端在向接入点发送探测请求消息时，可以仅仅在该探测请求消息中携带该终端的通用能力信息，这些通用能力信息可以用于AP判断是否进一步与终端进行后续关联。当然，AP在向接入点发送探测响应消息时，也可以在该探测响应消息中携带该AP的通用能力信息，若果该AP不需要保密，AP也可以在该探测响应消息中携带AP的个性化能力信息。
可选地，在一些实施例中，在该终端向接入点发送加密的终端的能力信息之前，该方法还包括：
该终端向该接入点发送所述终端的公钥，该终端的公钥用于该接入点生成解密该加密的终端的能力信息的解密密钥，其中，所述终端接收所述接入点发送的与所述终端相关的关联前索引信息发生在所述终端向所述接入点发送所述终端的公钥之后；
该终端接收给接入点发送的该接入点的公钥；
该终端根据该接入点的公钥生成该终端的加密密钥，该终端的加密密钥用于加密该终端的能力信息。
具体地，在本发明实施例中，终端与AP相互发送各自的公钥实现公钥交换，终端的公钥与该终端的私钥相对应，接入点的公钥与该接入点的私钥相对应。应理解，终端向接入点发送公钥和接入点向终端发送公钥这两个动作可以不区分先后顺序，只要通过信令交互实现彼此公钥的交换即可。这里终端的公钥也可以称为终端的公钥信息，AP的公钥也可以称为AP的公钥信息。还应理解，终端和接入点之间通过信令实现密钥交换可以由多种实现方式，下文将对终端和接入点之间的密钥交换进行描述，应理解，下文描述仅仅是本发明实施例的几种可选方式，但本发明实施例不限于此。
还应理解，当终端先接收到接入点发送的公钥时，终端便可以根据终端的私钥信息，以及接入点的公钥生成加密密钥，该加密密钥用来加密终端的设备能力信息，从而生成加密的设备能力信息。当然，这里终端生成加密密钥时还可以使用其他信息，例如，接入点的位置信息，或者一 个随机值Nonce。还应理解，当终端根据加密密钥生成加密的能力信息之后，可以在向接入点发送公钥的消息中同时携带生成的加密的终端的能力信息。当接入点接收到终端发送的终端的公钥之后，可以根据该终端的公钥信息，并结合接入点自己的私钥信息，生成解密密钥，从而解密设备的加密的终端的能力信息，从而获得终端的设备的能力信息。
可选地，在一些实施例中，终端向接入点发送所述终端的公钥，包括：
终端向该接入点发送探测请求消息，该探测请求消息包括该终端的公钥；
或者，终端向接入点发送第二消息，该第二消息包括该终端的公钥，该第二消息为管理消息。
具体而言，终端向所述接入点发送探测请求消息，该探测请求消息包括所述终端的公钥，终端向接入点发送的探测请求消息中，可以包含一个新定义IE，在该IE中承载该终端的公钥，当然，也可以通过该探测请求消息中现有的IE来承载该终端的公钥。应理解，这里终端可以通过单播和/或多播的探测请求消息和/或第二消息来携带该终端的公钥，这里的多播可以包括广播。
终端向接入点发送第二消息，该第二消息包括该终端的公钥，该第二消息为管理消息。该第二消息可以是一种新定义的帧，例如，Action frame或Public action frame，在该Action frame中携带终端的密钥。
可选地，在一些实施中，终端接收接入点发送的该接入点的公钥，包括：
终端接收该接入点发送的探测响应消息，该探测响应消息包括该接入点的公钥；
具体而言，在本发明实施例中，接入点在接收到终端发送的探测请求消息之后，根据该探测请求消息向终端发送探测响应消息，可以在该探测响应消息中新定义一个IE来承载该接入点的公钥，当然，也可以通过该探测响应消息中现有的IE来承载该接入点的公钥。
可选地，在一些实施例中，终端接收接入点发送的该接入点的公钥，包括：
终端接收该接入点发送的第三消息，该第三消息包括该接入点的公钥，该第三消息为管理消息。
应理解，该第三消息可以是一种新定义的帧，例如Action frame或Public action frame，在该action frame中携带接入点的公钥。
这里接入点可以为通过单播和/或多播的探测响应消息和/或第三消息来携带该接入点的公钥，这里的多播可以包括广播。
可选地，在一些实施例中，终端接收接入点发送的该接入点的公钥，包括：
终端接收该接入点发送的信标帧，该信标帧包括该接入点的公钥。
具体而言，在本发明实施例中，接入点可以向终端发送的信标帧中定义一个IE，该新定义的IE可以用来承载接入点的公钥，当然也可以通过该信标帧中现有的IE来承载该接入点的公钥。
应理解，这里AP向终端发送该AP的公钥还可以与AP向该终端表明自己支持安全关联模式同步完成，例如，AP可以在探测响应消息中同时携带该AP的公钥以及指示接入点支持安全关联模式的指示信息，当然，AP还可以仅仅以向终端发送公钥来隐含表明该AP支持安全关联模式。还应理解，AP与终端交换密钥的过程还可以先于终端发现AP能力过程，也可以在终端发现AP能力之后，对此本发明实施例不做限定，这里发现AP的能力可以指终端获知AP支持安全关联模式。
可选地，在一些实施例中，终端和AP可以采用迪菲－赫尔曼(Diffie–Hellman，DH)密钥交换算法计算生成各自的加密密钥。例如，终端在获取AP的公钥AP-PK(对应AP的私钥AP-pk)之后，便可以通过DH算法以及自身的私钥STA-pk计算该终端的加密密钥STA-dhk，同样AP在获取终端的公钥STA-PK(对应STA的私钥STA-pk)之后，也可以根据DH算法以及自身的私钥AP-pk 计算该AP的加密密钥AP-dhk，这里的STA-dhk和AP-dhk是相同的对称加密密钥，也就是说，AP可以利用AP-dhk来解密终端通过STA-dhk加密的能力信息，终端也可以通过STA-dhk来解密AP通过AP-dhk加密的能力信息。
应理解，终端和AP还可以基于其他密钥交换算法来生成各自的加密密钥，例如，终端和AP还可以通过基于椭圆曲线密码体制的迪菲－赫尔曼(Elliptic Curve Cryptosystems Diffie Hellman，ECDH)密钥交换算法，来生成各自的加密密钥。
可选地，在一些实施例中，在终端向接入点发公钥时，可以同时向接入点发送一个现场值和/或随机数(Number used once，Nonce)。例如，终端在向接入点发送公钥时，可以在承载该终端的公钥的第二消息中携带一个现场值和/或Nonce，从而可以使接入点生成的AP-dhk产生变化效果，从而可以使终端和/或接入点生成的加密密钥可以更好的保护终端和/或接入点的能力信息，提高用户的隐私保护能力。
可选地，在一些实施例中，接入点向终端发送公钥时，可以同时向终端发送一个现场值和/或随机数(Number used once，Nonce)。例如，接入点在向终端发送公钥时，可以在承载该接入点的公钥的第三消息中携带一个现场值和/或Nonce，从而可以使终端生成的AP-dhk产生变化效果，从而可以使终端和/或接入点生成的加密密钥可以更好的保护终端和/或接入点的能力信息，提高用户的隐私保护能力。
可选地，在一些实施例中，接入点和/或终端可以周期性变化各自的公钥和私钥对。这样，接入点和终端在进行公钥交换后生成的加密密钥也将产生周期性变化，从而可以使终端和/或接入点生成的加密密钥可以更好的保护终端和/或接入点的能力信息，提高用户的隐私保护能力。
可选地，在一些实施例中，该方法还包括：终端接收接入点发送的指示信息，该指示信息用于指示该接入点支持与该终端进行加密的该终端的能力信息传输。
应理解，该接入点支持与终端进行加密的终端的能力信息的传输也可以称为接入点支持安全关联模式，或者反追踪工作模式，当然也可以称为其他模式，对此本发明实施例不做限定。还应理解，在本发明实施例中，终端需要确定AP支持与该终端进行加密的终端的能力信息的传输的特性，当然，AP也可以默认支持与终端进行加密的终端的能力信息的传输，也就是说，AP可以不需要单独向终端发送指示信息用来指示该AP支持与终端进行加密的终端的能力信息的传输，终端默认该AP支持与终端进行加密的终端的能力信息的传输。
还应理解，在本发明实施例中，接入点向终端发送该指示信息也可以称为能力发现过程，也就是说，终端接收接入点发送的指示信息来发现接入点支持安全关联模式。
可选地，在一些实施例中，该终端接收所述接入点发送的指示信息，包括：该终端接收所述接入点发送的探测响应消息，该探测响应消息包括该指示信息。
接入点在接收到终端发送的探测请求消息之后，可以在向该终端发送的探测响应消息中携带上述指示信息。具体地，可以在向终端发送的探测响应消息中新定义一个IE，该IE可以用来承载上述指示信息，用来指示AP支持安全关联模式，当然，该接入点也可以探测响应消息中现有的IE来承载上述指示信息。
应理解，在本发明实施例中，终端也可以在探测请求消息中携带指示该终端支持安全关联模式的指示信息，在这种情况下，AP也可以仅仅通过回复终端探测响应信息来隐含指示AP支持安全关联模式，也就是说，AP不用再在探测响应消息中包含指示AP支持安全关联模式的指示信息。
可选地，在一些实施例中，终端接收接入点发送的指示信息，包括：
该终端接收该接入点发送的第四消息，该第四消息包括指示信息，该第四消息为管理消息。
具体而言，在本发明实施例中，该第四消息可以是一种新定义的帧，例如，Action frame，在该Action frame中可以携带指示接入点支持终端进行加密的该终端的能力信息传输的指示信息，也就是说，接入点可以通过一种新定义的帧来承载该指示信息，用来指示该接入点支持安全关联模式。
应理解，在本发明实施例中，AP通过新定义的Action frame携带该AP支持安全关联模式，在此情况下，AP首先接收终端发送的新定义的Action frame，在该终端的Action frame中可以携带终端也支持安全关联模式。当然，终端在向AP发送的Action frame中也可以不携带该终端支持安全关联模式的指示信息，默认终端支持该安全关联模式。终端在向AP发送的Action frame中携带指示终端支持安全关联模式的指示信息时，AP也可以通过向终端发送的Action frame中不携带AP支持安全关联模式的指示信息来隐式指示AP支持该安全关联模式。
可选地，在一些实施例中，该终端接收所述接入点发送的指示信息，包括：该终端接收所述接入点发送的信标帧，所述信标帧包括所述指示信息。
具体地，在本发明实施例中，该信标帧中可以新定义一个IE，该IE用来承载上述指示信息，用来指示AP指示安全关联模式，当然，也可以通过信标帧中现有的IE来承载上述指示信息。
应理解，终端获取指示AP支持安全关联模式的指示信息还可以有其他方式，例如，AP可以通过广播方式向终端发送广播消息和/或其他同步消息，在该广播消息和/或其他同步消息中可以携带该指示信息，终端听到该广播消息后，便可以获知AP支持安全关联模式。这里AP还可以向其他设备发送指示信息，当需要与该AP进行关联的终端听到该指示信息，便可以得知AP支持安全关联模式。当然，本领域技术人员还可以根据实际应用场景获得其他的指示接入点支持安全关联模式的指示信息，对此本发明实施例不做限定。
本发明实施例的技术方案还可以用来被厂商作为私有的技术解决方案，也就是说，同一厂商的设备可以采用本发明实施例的技术方案，这种方式可以通过扩展现有消息中的厂商特定信息元素(Vender Specific IE)来实现。
下面将以STA(或称为终端)为可穿戴设备，AP为智能手机为例，详细描述本发明实施例的无线局域网中建立关联的方法。应理解，以AP为智能手机和STA为可穿戴设备为例仅仅是为了方便描述，而不应对本发明实施例的保护范围构成限定。还应理解，智能手机作为AP时和STA一样，同样也可以有保护隐私的需求。还应理解，在本发明实施例中，STA也可以成为终端。
图4示出了本发明实施例的无线局域网中建立关联的方法流程图。该方法包括：
S401，终端接收AP发送的信标帧。
可选地，在一些实施例中，该信标帧可以携带指示AP支持与终端安全关联模式的指示信息。
具体地，在本发明实施例中，该信标帧可以包括一个新定义的IE，在该新定义的IE中可以携带上述指示信息。
应理解，该安全关联模式可以是AP支持与终端进行设备能力信息加密传输。也就是说，该AP支持本发明实施例的技术方案。
可选地，在一些实施例中，该信标帧可以携带该AP的公钥。
具体而言，在该信标帧中可以包含一个新定义的IE，在该IE中可以携带该AP的公钥。应理解，AP的公钥与该AP的私钥相对应，该公钥可以使STA生成该STA的加密密钥。应理解，终端生成加密密钥的过程包括终端至少根据AP的公钥和种终端自己的私钥，当然，终端也可以结合 其它信息来生成加密密钥，例如，终端的位置信息等来生成STA的加密密钥，从而使生成的加密密钥产生变化效果。
可选地，在一些实施例中，该信标帧还可以携带AP的通用能力信息。
具体地，接入点向终端发送信标帧，该信标帧可以携带终端的通用能力信息，用于终端根据该接入点的通用能力信息判断是否需要进一步进行后续关联。应理解，在本发明实施例中，当AP不需要保护隐私时，该信标帧也可以携带该AP的个性化的能力信息。
S402，终端向AP发送探测请求消息。
可选地，在一些实施例中，该探测请求消息中可以携带该终端的通用能力信息。也就是说，该探测请求消息可以不再包含我们希望隐藏或保护的终端的能力信息，或者是仅包含部分不具有很明显的个性化特征的终端的能力信息。这样，即使攻击者仅通过监听该Probe Request消息，也无法获得可以识别该终端的“指纹”信息，从而无法跟踪该终端。例如，终端可以使用一类或者几类通用的能力信息来向AP表明自己的能力，从而让AP确定自身是否满足STA的查询的条件(也可理解为，让AP确定其是否能满足终端的需求)，或者让AP确定STA是否满足AP的通信条件，便于AP判断是否回复探测响应消息。应理解，由于终端发送的是通用的设备能力信息中的一种或几种，由于很多其他终端可以同时使用这几种或一种能力信息，这样即使窃听者获取该通用能力信息，也无法识别该终端，从而降低了终端被追踪的可能。
可选地，在一些实施例中，该探测请求消息中可以携带指示终端支持安全关联模式的指示信息。
可选地，在一些实施例中，该探测请求消息中可以携带该终端的公钥，该公钥用于AP生成解密加密的终端的能力信息的解密密钥。
应理解，在本发明实施例中，终端和AP可以采用迪菲－赫尔曼(Diffie Hellman，DH)密钥交换算法计算生成各自的加密密钥。例如，终端在获取AP的公钥AP-PK之后，便可以通过DH算法以及自身的私钥STA-pk计算该终端的加密密钥STA-dhk，同样AP在获取终端的公钥STA-PK之后，也可以根据DH算法以及自身的私钥AP-pk计算该AP的加密密钥AP-dhk，这里的STA-dhk和AP-dhk是相同的对称加密密钥，也就是说，AP可以利用AP-dhk来解密终端通过STA-dhk加密的能力信息，终端也可以通过STA-dhk来解密AP通过AP-dhk加密的能力信息。
还应理解，AP与终端采用DH密钥交换算法生成各自的加密密钥仅仅是一种实现方式，本领域技术人员还可以通过其他密钥交换算法生成各自的加密密钥，对此，本发明实施例不做限定。
S403，接入点向终端发送探测响应消息。
可选地，在一些实施例中，该探测响应消息可以携带AP的通用能力信息。
应理解，当AP不需要保护隐私时，该探测响应消息还可以包括AP的个性化能力信息。对此本发明实施例不做限定。
可选地，在一些实施例中，该探测响应消息可以携带AP的公钥。
可选地，在一些实施例中，该探测响应消息可以携带指示接入点支持安全关联模式的指示信息。
S404，终端向接入点发送第一请求帧，该第一请求帧是一种新定义的管理帧。
具体地，该第一请求帧可以是Action frame(一种管理帧)，但本发明不限于此。
可选地，在一些实施例中，该第一请求帧还可以是其他类型的帧。
可选地，在一些实施例中，该第一请求帧可以携带终端的公钥。
应理解，在本发明实施例中，接入点在获取终端的公钥之后，便可以根据DH算法计算该接入多点的解密秘钥AP-dhk，该AP-dhk用于解密终端的能力信息，还可以用于加密该接入点的能力信息。
可选地，在一些实施例中，该第一请求帧可以携带终端的通用能力信息。
具体地，终端可以通过该第一请求帧中携带一类或者几类通用能力信息(可以理解为，通用的设备能力信息中的一种或几种)来向接入点表明自己的能力信息，从而让接入点确定自身是否满足终端的查询条件，或者终端是否满足AP的通信能力条件，便于接入点判断是否回复响应帧。
可选地，在一些实施例中，该第一请求帧可以携带指示终端支持安全关联模式的指示信息。
应理解，这里的第一请求帧可以对应权利要求中的第二消息。
S405，接入点向终端发送第一响应帧，该第一响应帧是一种新定义的管理帧。
具体地，该第一响应帧可以是Action frame(一种管理帧)，但本发明实施例不限于此。
可选地，在一些实施例中，该第一响应帧还可以是其他类型的帧。
可选地，在一些实施例中，该第一响应帧可以携带接入点的通用能力信息。
可选地，在一些实施例中，该第一响应帧还可以携带接入点的公钥。
应理解，在本发明实施例中，终端在获取终端的公钥之后，便可以根据DH算法计算该终端的加密密钥秘钥STA-dhk，该STA-dhk用于解密终端的能力信息，还可以用于加密该接入点的能力信息。还应理解，当AP不需要隐私保护时，该AP可以在该第一响应帧中携带接入点的个性化能力信息；如果接入点也需要隐私保护，当接入点已经获得终端的公钥的情况下，可以根据终端的公钥，接入点自己的私钥等信息生成AP-dhk，加密接入点的个性化的能力信息，在接入点向终端发送该接入点的公钥时，可以在同一消息中发送加密的接入点的能力信息，终端在接收到加密的接入点的能力信息和接入点的公钥后，可以计算STA-dhk来解密接入点的设备的能力信息，从而获取接入点的能力信息；或者是，如果接入点也需要隐私保护，那么接入点也可以不发送设备的信息，也就是说接入点不发送个性化的设备能力信息，这样接入点也不会因为发送设备的能力信息带有“指纹”信息而导致隐私被泄露，这种接入点的通用能力信息可以用于被终端判断是否满足自己的要求，从而确定是否执行进一步的能力信息传输或者关联，对此本发明实施例不做限定。
可选地，在一些实施例中，该第一响应帧可以携带指示接入点支持安全关联模式的指示信息。
应理解，在本发明实施例中，当终端向接入点发送第一请求帧携带终端支持安全关联模式的指示信息时，接入点也可以仅仅通过回复终端第一响应帧来隐式指示该接入点支持安全关联模式，也即是说，接入点在第一响应帧中不携带指示接入点支持安全关联模式的展示信息。
还应理解，这里的第一响应帧可以对应权利要求中的第三消息和/或第四消息。例如，当第一响应帧携带接入点的公钥时，该第一响应帧可以对应于权利要求中的第三消息；当第一响应帧携带接入点支持与所述终端进行加密的所述终端的能力信息的传输的指示信息时，该第一响应帧可以对应于权利要求中的第四消息。当然，这里第一响应帧还可以同时是第三消息和第四消息，也就是说，第三消息和第四消息可以是同一消息，而这同一消息即可以是这里的第一响应帧。
S406，终端生成加密的终端的能力信息。
具体地，在本发明实施例中，终端在获取接入点的公钥之后，便可以通过DH算法和自身的私钥生成加密该终端能力信息的加密密钥，之后使用该加密密钥加密终端的能力信息。
应理解，在本发明实施例中，标号S406并不限定该步骤的执行顺序，终端一旦获取接入点 的公钥后，便可以根据生成的加密密钥来生成加密的终端的能力信息，对此本发明实施例不做限定。
可选地，在一些实施例中，接入点和终端在根据DH算法计算各自的加密密钥时，可以加入位置信息和/或Nonce。
在计算加密密钥时通过加入位置信息和/或Nonce，可以使加密后的内容产生变化的效果。当然，也可以是STA或者AP隔一段时间变化自身的公钥私钥对。
S407，终端向接入点发送第二请求帧，该第二请求帧携带加密的终端的能力信息，该第二请求帧是新定义的管理帧。
加密的终端的能力信息通过新定义的管理帧发送给接入点，从而避免了终端的能力信息直接在空口发送，避免了攻击者通过监听空口消息获得终端的能力信息，从而根据能力信息中的信息生成该终端的“指纹”特征信息，从而跟踪终端。
可选地，在一些实施例中，该第二请求帧可以是Public Action frame。
可选地，在一些实施例中，该第二请求帧也可以是其他类型的帧，对此本发明实施例不做限定。
应理解，这里的第二请求帧可以对应权利要求中的第一消息。
S408，接入点根据终端的能力信息生成关联前索引信息，该关联前索引信息用于标识该终端。
具体地，在本发明实施例中，AP在获取终端的公钥之后，便可以根据自己的私钥和DH算法生成解密加密的终端的能力信息的解密密钥。接入点在收到终端发送的终端的能力信息后，利用自身生成的解密密钥来解密该加密的终端的能力信息，从而得到终端的能力信息。接入点在获得终端的能力信息之后，可以判断自己是否符合终端要寻找的AP的要求，或者是判断终端是否满足与其关联的要求，以确定是否继续跟终端进行后续通信。
应理解，在本发明实施例中，该关联前索引信息可以在一段时间内保持唯一，即区别不同的终端即可。当然，该关联前索引信息也可以设置足够长，在很长时间内唯一，这样接入点在后续收到终端的关联请求时，可以确定对应该终端的能力信息，并在后续关联过程中使用对应的能力来建立关联。
可选地，在一些实施例中，该关联前索引信息可以对应一种设备能力信息。
例如，在本发明实施例中，具备能力信息1的终端对应关联前索引1，具备能力信息2的终端对应关联前索引2。具体可以参考前面所述的相关内容。
S409，接入点向终端发送第二响应帧，该第二响应帧携带接入点生成的关联前索引信息，该第二请求帧是新定义的管理帧。
可选地，在一些实施例中，该第二响应帧中携带的关联前索引信息可以是加密的关联前索引信息。
具体地，在本发明实施例中，接入点可以使用和终端进行公钥交换后生成的加密密钥来加密该关联前索引信息。在这情况下，终端可以通过与接入点公钥交换后生成的解密密钥来解密该加密的关联前索引信息。该关联前索引信息是用来给终端后续向接入点发起关联的时候使用，以便接入点知道用什么样的能力与该终端进行通信，也就是说，接入点通过该关联前索引信息来记住终端的能力信息，后续在通信中可以通过该关联索引信息既可以确定该关联索引信息对应的终端，这样即使在终端发送关联请求时使用的MAC地址不同，接入点也可以确定该新的MAC地址的关联请求对应之前哪个终端，或者终端的能力信息。
可选地，在一些实施例中，该第二响应帧可以是新定义的管理帧，例如Publ ic Act ion frame。
可选地，在一些实施例中，该第二响应帧也可以是其他类型的帧，对此本发明实施例不做限定。
应理解，这里的第二响应帧可以对应与权利要求中的第五消息。
S410，终端向接入点发送关联请求消息，该关联请求消息中携带关联前索引信息。
应理解，在本发明实施例中，终端向接入点发送关联请求消息，该关联请求消息中可以不携带终端的个性化能力信息。可以想到的是，在本发明实施例中，所有可能泄露终端隐私信息的终端的设备能力信息都可以在终端向接入点发送关联请求之前通过加密的方式发送给接入点。
可选地，在一些实施例中，终端还在关联请求消息中携带加密的终端的设备能力信息，接入点可以根据之前步骤交换的信息生成的AP-dhk来解密终端的加密的能力信息；这里解密密钥可以通过关联前索引来确定，在这个实施例中，关联前索引信息用来标识对应的终端，或者是进一步对应了终端使用的加密密钥；该索引信息用于AP确定解密终端的加密的能力信息所使用的解密密钥。
可选地，在一些实施例中，终端向接入点发送关联请求，该关联请求中可以携带加密的关联前索引信息。
具体而言，终端可以使用与接入点交换公钥后生成的加密密钥来加密该关联前索引信息，当终端向接入点发送关联请求消息之前使用的MAC地址与终端发送关联请求消息使用的MAC地址相同时，接入点在收到该加密的关联前索引信息后，接入点可以通过关联请求消息的MAC地址来确定对应的解密密钥来解密该关联前索引信息，从而根据该关联前索引信息确定终端的设备能力信息。
S411，接入点向终端发送关联响应消息，从而与终端建立起关联。
具体而言，接入点在接收到终端发送的关联请求后，根据该关联请求中的关联前索引信息确定终端的能力信息，或者是当关联请求消息中直接携带加密的设备的能力信息时，利用关联前索引信息确定的解密密钥并解密设备的加密能力信息后，从而向该终端发送关联响应消息，从而与终端建立起关联。
S412，接入点和终端建立起安全的连接。
需要注意的是，在本发明实施例中上述各过程的序号的大小并不意味者执行顺序的先后。此外，在终端与接入点建立关联的整个流程中，上述过程也并不一定都必须执行，例如，在终端与接入点交换公钥过程中，终端可以通过探测请求消息中携带该终端的公钥，接入点可以通过探测响应消息携带该接入点的公钥，此时步骤S401可以作为可选步骤。步骤S402和S403可以用步骤S404和S405来替代，即步骤S402-S405中可以选择只执行S402和S403，或只执行S404和S405。
应理解，各个过程的执行顺序和执行必要性应以其功能和内在逻辑确定，而不应对本发明实施例的实施过程构成任何限定。
还应理解，在发明实施例中，第一请求帧、第二请求帧、第一响应帧和第二响应帧可以是一种新定义的帧，这里也可以称为消息帧或消息，具体序号称为第一或第二等可根据实际情况而定。这里的序号如第一和第二，是为了表述的方便，可用于区分不同的对象，当然这里的第一请求帧和第二请求帧也可以是同一消息(即同一对象)，第一响应帧和第二响应帧也可以是同一消息，也就是说，在同一消息中可以携带多种信息，例如本发明实施例中终端的公钥和加密的终端的能力信息都可以承载在第一请求帧中。本领域技术人员可以根据具体使用场景，对此本发明实施例 不做限定。
应理解，如果在S401-S405中AP与终端进行了能力发现，则该过程也可以称为AP能力发现过程；若果S401-S405中AP与终端进行了密钥交换，则该过程也可以称为加密密钥生成过程。S406-S409也可以称为加密的终端能力信息发送过程。S410-S411也可以称为AP与终端建立关联过程。这里的过程划分不应对本发明实施例构成限定。
还应理解，图4所示的无线局域网中建立关联方法的核心思想是可以通过一种新定义的帧，例如Public action frame，来传输加密的终端的能力信息，从而保护终端的个性化信息不被窃听者攻击，保护用户的隐私信息。
图5示出了本发明另一实施例的无线局域网中建立安全连接的方法的流程图。该方法包括：
S501，终端接收接入点发送的信标帧。
可选地，在一些实施例中，该信标帧可以携带指示AP支持与终端安全关联模式。
应理解，该安全关联模式可以是AP支持与终端进行设备能力信息加密传输。也就是说，该AP支持本发明实施例的技术方案。
可选地，在一些实施例中，该信标帧可以携带该AP的公钥。这里AP的公钥可以是每次都不同，或者是过一段时间修改，或者是一直保持不变，也就是说，AP可以根据自身性能或者参数来改变自己的公钥和私钥对，从而使终端根据该接入点的公钥生成加密密钥时可以产生变化的效果。
应理解，AP的公钥与该AP的私钥相对应，接入点向终端发送该接入点的公钥可以用于STA生成该STA的加密密钥。
可选地，在一些实施例中，该信标帧还可以携带AP的通用能力信息。
应理解，当AP不需要保护隐私时，该信标帧也可以携带AP的个性化信息。
S502，终端向接入点发送探测请求消息。
可选地，在一些实施例中，该探测请求消息中可以携带该终端的通用能力信息。也就是说该探测请求消息不再包含我们希望隐藏或保护的终端的能力信息，或者是仅包含部分不具有很明显的个性化特征的终端的能力信息。即攻击者仅通过监听该Probe Request消息无法获得可以区别该终端的“指纹”信息，用于后续的终端跟踪。例如，终端可以使用一类或者几类通用的能力信息来向AP表明自己的能力，从而让AP确定是否满足STA的查询的条件，或者是STA是否满足AP的通信条件，便于AP判断是否回复探测响应消息。应理解，由于终端发送的是通用的设备能力信息的一种或几种，由于很多终端同时使用这几种，从而降低了被追踪的可能。当然，在该探测请求消息中，也可以不携带终端的能力信息。
可选地，在一些实施例中，该探测请求消息中可以携带指示终端支持安全关联模式的指示信息。
可选地，在一些实施例中，该探测请求消息中可以携带该终端的公钥，该公钥用于AP生成解密加密的终端的能力信息的解密密钥。
可选地，在一些实施例中，当S501中的信标帧中包含接入点的公钥信息时，终端在发送S502探测请求消息之前就已经可以根据接入点的公钥信息和终端的私钥信息，生成加密密钥信息，从而生成加密的终端的能力信息(对应于S503步骤)；这样在S502步骤的探测请求消息中，终端可以携带加密的终端的能力信息。
应理解，在本发明实施例中，终端和AP可以采用迪菲－赫尔曼(Diffie Hellman，DH)密钥交换算法计算生成各自的加密密钥。例如，终端在获取AP的公钥AP-PK之后，便可以通过 DH算法以及自身的私钥STA-pk计算该终端的加密密钥STA-dhk，同样AP在获取终端的公钥STA-PK之后，也可以根据DH算法以及自身的私钥AP-pk计算该AP的加密密钥AP-dhk，这里的STA-dhk和AP-dhk是相同的对称加密密钥，也就是说，AP可以利用AP-dhk来解密终端通过STA-dhk加密的能力信息，终端也可以通过STA-dhk来解密AP通过AP-dhk加密的能力信息。
还应理解，AP与终端采用DH密钥交换算法生成各自的加密密钥仅仅是一种实现方式，本领域技术人员还可以通过其他密钥交换算法生成各自的加密密钥，对此，本发明实施例不做限定。
S503，接入点生成关联前索引信息，该关联前索引信息用于标识该终端。
具体地，在本发明实施例中，接入点接收终端通过探测请求消息携带的公钥后，便可以根据自己的私钥和DH算法生成解密加密的终端的能力信息的解密密钥。应理解，在本发明实施例中，终端与AP通过DH密钥交换算法生成终端的加密密钥STA-dhk和接入点的解密密钥AP-dhk可以是相同的，也就是说终端的加密密钥STA-dhk也可以解密接入点使用解密密钥AP-dhk加密的接入点的设备能力信息。在这种情况下，接入点生成关联前索引消息，该关联前索引信息用于终端在后续发起关联时使用，也就是说，在后续关联时，接入点根据该关联前索引信息可以确定该终端，或者是进一步确定该终端对应的加密密钥。
应理解，在本发明实施例中，该关联前索引信息可以在一段时间内保持唯一，即区别不同的终端即可。当然，该关联前索引信息也可以设置足够长，在很长时间内唯一，这样接入点在后续收到终端的关联请求时，可以确定对应该终端的能力信息，并在后续关联过程中使用对应的能力来建立关联。
应理解，当S502步骤中发送的探测请求消息包含加密的终端的能力信息时，在步骤S502之后，即AP接收到探测请求消息时即已经包含了加密的终端的能力信息和终端的公钥信息，AP这时就可以结合自己的私钥和终端的公钥信息，和其它信息(如果在这里需要其它信息，还需要AP和终端在交互过程中确认，或者是之前通过消息指示出来)生成解密密钥，对加密的设备的能力信息进行解密，获得终端的能力信息。
S504，接入点向终端发送探测响应消息，该探测响应消息中携带关联前索引信息。
应理解，在本发明实施例中，该探测请求消息中携带的关联前索引信息可以是加密的，也就是说，接入点可以使用与终端交换公钥后生成的加密密钥加密该关联前索引信息。当然，该探测请求消息中携带的关联前索引信息也可以是不加密的。
可选地，在一些实施例中，该探测响应消息可以携带AP的通用能力信息。
应理解，在本发明实施例中，如果接入点也需要保护隐私，此时该探测响应消息中也可以携带该加密的接入点的能力信息。
应理解，当AP不需要保护隐私时，该探测响应消息还可以包括AP的个性化能力信息。对此本发明实施例不做限定。
可选地，在一些实施例中，该探测响应消息可以携带AP的公钥。
可选地，在一些实施例中，该探测响应消息可以携带指示终端支持安全关联模式的指示信息。
S505，终端生成加密的终端的能力信息。
具体地，在本发明实施例中，终端在获取接入点的公钥之后，便可以通过DH算法和自身的私钥生成加密该终端能力信息的加密密钥，之后使用该加密密钥加密终端的能力信息。
应理解，在本发明实施例中，标号S505并不限定该步骤的执行顺序，终端一旦获取接入点的公钥后，便可以生成加密的终端的能力信息，对此本发明实施例不做限定。
可选地，在一些实施例中，接入点和终端在根据DH算法计算各自的加密密钥时，可以加入位置信息和/或Nonce。应理解，如果这里使用了现场值或者其他信息，需要在之前终端向AP发送公钥的消息中携带，或者是AP向终端发送的公钥消息中携带，或者是在其它消息中携带。
在计算加密密钥时通过加入位置信息和/或Nonce，可以使加密后的内容产生变化的效果。当然，也可以是STA或者AP隔一段时间变化自身的公钥私钥对。
S506，终端向接入点发送关联请求消息，该关联请求消息包括加密的终端的能力信息和所述关联前索引信息。
在本发明实施例中，加密的终端的能力信息通过现有信令进行传输，节省了信令的开销。终端能力信息和关联前索引信息通过加密的方式发送给接入点，从而避免了终端的能力信息和直接在空口发送，避免了攻击者通过监听空口消息获得终端的能力信息，从而根据能力信息中的信息生成该终端的“指纹”特征信息，从而跟踪终端。
应理解，在本发明实施例中，加密的终端能力信息通过关联请求消息发送给接入点，在这种情况下，接入点可以通过关联请求消息中携带的关联前索引信息来去确定该终端，这样即使在终端发送关联请求的MAC地址发生改变，接入点任然能够通过关联前索引信息来确定变化MAC地址的终端，从而采用该终端对应的解密密钥解密加密的终端的能力信息。
S507，接入点向终端发送关联响应消息，从而与终端建立起关联。
具体而言，接入点在接收终端通过关联请求消息发送的加密的终端的能力信息和关联前索引信息之后，根据关联前索引信息确定解密该终端加密的能力信息的解密密钥，根据该解密密钥解密加密的终端的能力信息，从而获取该终端的能力信息，接入点根据该终端的能力信息确定是否向终端发送关联响应消息，并在向终端发送关联响应消息后两者建立起关联。
S508，接入点和终端建立起安全的连接。
需要注意的是，在本发明实施例中上述各过程的序号的大小并不意味者执行顺序的先后。此外，在终端与接入点建立关联的整个流程中，上述过程也并不一定必须执行，例如，在终端与接入点交换公钥过程中，终端可以通过探测请求消息中携带该终端的公钥，接入点可以通过探测响应消息携带该接入点的公钥，此时步骤S504和S505仅仅作为公钥交换步骤时可以作为可选步骤。应理解，各个过程的执行顺序和执行必要性应以其功能和内在逻辑确定，而不应对本发明实施例的实施过程构成任何限定。
应理解，在上述图5所示的具体实施例中，核心思想是通过现有技术中的消息来增加信息元素或者已有信息元素来实现本发明实施例技术方案，而不增加新定义的消息。当然，这里的实施例仅仅以加密的终端的能力信息在关联请求消息中携带为例进行说明，但本发明实施例不限于此，例如，加密的终端的能力信息还可以通过探测请求消息来携带。
上文详细说明了本发明实施例的无线局域网中建立关联的方法，下面将详细说明本发明实施例的接入点和终端。
图6是本发明实施例的一种无线局域网中建立关联的方法示意图。该方法包括：
S601，终端向接入点发送探测请求消息(Probe Request)，该探测请求消息包括指示终端支持安全关联模式的指示信息以及该终端的公钥STA-PK；
S602，接入点向终端发送探测响应消息(Probe Response)，该探测响应消息包括指示接入点支持安全关联模式的指示信息以及该接入点的公钥AP-PK；
S603，终端根据自身的私钥STA-pk以及接收到的接入点的公钥AP-PK生成加密密钥STA-dhk， 该加密密钥用于加密该终端的能力信息；
S604，接入点根据自身的私钥AP-pk以及接收的终端的公钥STA-PK生成解密密钥AP-dhk，该解密密钥用于解密所述加密的该终端的能力信息；
S605，终端根据生成的加密密钥加密终端的能力信息；
S606，接入点生成关联前索引信息，该关联前索引信息用于接入点在该终端与该接入点尚未建立关联时识别该终端；
S607，终端向接入点发送Action frame，该Action frame可以是一种新定义的管理帧，该Action frame可以携带终端生成的加密的终端的能力信息；
S608，接入点接收到终端发送的加密的终端的能力信息，用解密密钥进行解密以获得终端的能力信息；
S609，接入点向终端发送Action frame，该Action frame可以是一种新定义的管理帧，该Action frame可以携带接入点生成的关联前索引信息；
S610，终端向接入点发送关联请求消息(Association Request)，该关联请求消息包括该关联前索引信息；
S611，接入点根据终端发送的关联前索引信息向该终端发送关联响应消息(Association Response)，从而该接入点与该终端完成本次关联的建立。
S612，接入点和终端建立起安全的连接。
其中S603和S604可以不限定先后关系,S604与S606也可以不限定先后关系，S604和S607也可以不限定先后关系。
应理解，图6所示的本发明实施例的无线局域网中建立关联的方法仅仅是一种具体的实现方式，而不应对本发明实施例构成限定。
还应理解，上述方法中的序号不应对本发明实施例的执行顺序构成限定，本发明实施例中的各个步骤的执行顺序应当以其内在逻辑为准。
图7是本发明实施例的一种无线局域网中建立关联的方法示意图。该方法包括：
S701，终端向接入点发送探测请求消息(Probe Request)，该探测请求消息包括终端的公钥STA-PK以及终端支持安全关联模式的指示信息；
S702，接入点根据终端发送的该终端的公钥STA-PK和自身的私钥AP-pk，生成解密密钥AP-dhk，该解密密钥用于解密加密的终端的能力信息；
S703，接入点生成关联前索引信息，该关联前索引信息用于接入点在该终端与该接入点尚未建立关联时识别该终端；
S704，接入点向终端发送探测响应消息(Probe Response)，该探测响应消息包括接入点支持安全关联模式的指示信息、该接入点的公钥AP-PK以及关联前索引信息；
S705，终端根据接入点的公钥AP-PK及自身的私钥STA-pk生成加密密钥STA-dhk，该加密密钥用于加密该终端的能力信息；
S706，终端根据其生成的加密密钥来加密该终端的能力信息；
S707，终端向接入点发送关联请求消息(Association Request)，该关联请求消息包括关联前索引信息和加密的终端的能力信息。
应理解，接入点在接收到终端发送的关联请求消息之后，获取该关联请求消息中的关联前索引信息，根据该关联前索引信息来确定该终端的解密密钥，从而解密加密的该终端的能力信息。
S708，接入点接收到终端发送的关联前索引信息和加密的终端的能力信息，用解密密钥进行解密以获得终端的能力信息；
S709，接入点根据终端发送的关联前索引信息向该终端发送关联响应消息(Association Response)，从而该接入点与该终端完成关联的建立。
S710，终端和接入点建立起安全的连接。
其中S702和S704的先后关系可以不限制，S702与S707也可以不限定先后关系。
应理解，图7所示的本发明实施例的无线局域网中建立关联的方法仅仅是一种具体的实现方式，而不应对本发明实施例构成限定。
还应理解，上述方法中的序号不应对本发明实施例的执行顺序构成限定，本发明实施例中的各个步骤的执行顺序应当以其内在逻辑为准。
图8是本发明实施例的一种无线局域网中建立关联的方法示意图。该方法包括：
S801，终端向接入点发送探测请求消息(Probe Request)，该探测请求消息包括指示终端支持安全关联模式的指示信息；
S802，接入点向终端发送探测响应消息(Probe Response)，该探测响应消息包括指示该接入点支持安全关联模式的指示信息；
S803，终端向接入点发送Public Action frame，该Public Action frame可以是一种新的管理帧，该Public Action frame可以包括该终端的公钥STA-PK；
S804，接入点根据终端发送的该终端的公钥STA-PK和自身的私钥AP-PK，生成解密密钥AP-dhk，该解密密钥用于解密加密的终端的能力信息；
S805，接入点生成关联前索引信息，该关联前索引信息用于接入点在该终端与该接入点尚未建立关联时识别该终端；
S806，接入点向终端发送Public Action frame，该Public Action frame可以为一种新的管理帧，该Public Action frame可以包括该接入点的公钥AP-PK和关联前索引信息；
S807，终端根据接入点的公钥AP-PK及自身的私钥STA-pk生成加密密钥STA-dhk，该加密密钥用于加密该终端的能力信息；
S808，终端根据其生成的加密密钥来加密该终端的能力信息；
S809，终端向接入点发送关联请求消息(Association Request)，该关联请求消息包括关联前索引信息和加密的终端的能力信息。
应理解，接入点在接收到终端发送的关联请求消息之后，获取该关联请求消息中的关联前索引信息，根据该关联前索引信息来确定该终端的解密密钥，从而解密加密的该终端的能力信息。
S810，接入点接收到终端发送的关联前索引信息和加密的终端的能力信息，用解密密钥进行解密以获得终端的能力信息；
S811，接入点根据终端发送的关联前索引信息向该终端发送关联响应消息(Association Response)，从而该接入点与该终端完成本次关联的建立。
S812，终端和接入点建立起安全的连接。
其中S804和S806可以不限定先后关系；S804和S809也可以不限定先后关系。
应理解，图8所示的本发明实施例的无线局域网中建立关联的方法仅仅是一种具体的实现方式，而不应对本发明实施例构成限定。
还应理解，上述方法中的序号不应对本发明实施例的执行顺序构成限定，本发明实施例中的 各个步骤的执行顺序应当以其内在逻辑为准。
图9示出了本发明实施例的终端的示意性框图，该终端可以为图2所示的智能手机，该终端900包括：
生成模块910，用于生成加密的所述终端的能力信息；
接收模块920，用于接收接入点发送的与所述终端相关的关联前索引信息，所述关联前索引信息用于所述接入点在所述终端与所述接入点尚未建立关联时识别所述终端；
发送模块930，用于向所述接入点发送加密的所述终端的能力信息和关联请求消息，所述关联请求消息包括所述关联前索引信息；
所述接收模块920还用于接收所述接入点根据所述终端的能力信息和所述关联前索引信息发送的关联响应消息，从而所述终端和所述接入点建立起关联。
本发明实施例的终端，将终端的能力信息通过加密的方式发送给接入点，并通过关联前索引信息来标识该终端，这样，窃听者不管是在关联之前或者是在关联过程中在空口即使监听到该能力信息，也不能获取该终端的能力信息，从而可以防止窃听者根据终端的能力信息确定终端所在的位置、时间等信息，避免用户隐私的泄露。
可选地，在一些实施例中，所述发送模块具体用于：向所述接入点发送关联请求消息，所述关联请求消息包括所述加密的所述终端的能力信息。
可选地，在一些实施例中，所述发送模块具体用于：向所述接入点发送第一消息，所述第一消息包括所述加密的所述终端的能力信息，所述第一消息为管理消息；
向所述接入点发送所述关联请求消息。
可选地，在一些实施例中，所述发送模块还用于：在所述发送模块发送加密的所述终端的能力信息之前，向所述接入点发送所述终端的公钥，所述终端的公钥用于所述接入点生成解密所述终端的能力信息的解密密钥；
所述接收模块还用于接收所述接入点发送的所述接入点的公钥；
所述生成模块还用于根据所述接入点的公钥生成所述终端的加密密钥，所述终端的加密密钥用于加密所述终端的能力信息。
可选地，在一些实施例中，所述发送模块具体用于：向所述接入点发送探测请求消息，所述探测请求消息包括所述终端的公钥；
或者，向所述接入点发送第二消息，所述第二消息包括所述终端的公钥，所述第二消息为管理消息。
可选地，在一些实施例中，所述接收模块具体用于：接收所述接入点发送的探测响应消息，所述探测响应消息包括所述接入点的公钥；
或者，接收所述接入点发送的第三消息，该第三消息包括所述接入点的公钥，所述第三消息为管理消息；
或者，接收所述接入点发送的信标帧，所述信标帧包括所述接入点的公钥。
可选地，在一些实施例中，所述接收模块还用于：接收所述接入点发送的指示信息，所述指示信息用于指示所述接入点支持与所述终端进行加密的所述终端的设备能力信息传输。
可选地，在一些实施例中，所述接收模块具体用于：接收所述接入点发送的探测响应消息，所述探测响应消息包括所述指示信息；
或者，接收所述接入点发送的第四消息，该第四消息包括所述指示信息，所述第四消息为管 理消息；
或者，接收所述接入点发送的信标帧，所述信标帧包括所述指示信息。
可选地，在一些实施例中，所述接收模块具体用于：接收接入点发送的第五消息，所述第五消息包括所述关联前索引信息，所述第五消息为管理消息；
或者，接收所述接入点发送的探测响应消息，所述探测响应消息包括所述关联前索引信息。
可选地，在一些实施例中，所述终端向所述接入点发送所述关联请求消息所使用的MAC地址与所述终端向所述接入点发送所述关联请求消息之前所使用的MAC地址不同。
应理解，这里的终端均以功能模块的形式体现。这里的功能模块均可以对应于图2所示的智能手机的各个实体模块，例如，这里的生成模块可以对应于图2中智能手机的处理器，发送模块和接收模块可以对应于智能手机的射频电路等。还应理解，这里的术语“模块”可以指用于应用特有的集成电路、电子电路、用于执行一个或多个软件或固件程序的处理器(例如共享处理器、专有处理器或组处理器)和存储器、合并络级电路和/或奇特支持所描述的功能的合适组件。该终端可以用于执行上述方法实施例中与终端相对应的各个流程和\或步骤，为避免重复，在此不再赘述。
图10是本发明实施例的接入点的示意性框图。该接入点也可以对应于图2中的智能手机，该智能手机作为接入点同样可以有保护隐私的需要。该接入点1000包括：
生成模块1010，用于生成与终端相关的关联前索引信息，所述关联前索引信息用于所述接入点在所述终端与所述接入点尚未建立关联时识别所述终端；
发送模块1020，用于向所述终端发送所述关联前索引信息；
接收模块1030，用于接收所述终端发送的加密的所述终端的能力信息和关联请求消息，所述关联请求消息包括所述关联前索引信息；
解密模块1040，用于解密所述加密的终端的能力信息。
所述发送模块1020还用于根据所述终端的能力信息和所述关联前索引信息向所述终端发送关联响应消息，从而所述接入点和所述终端建立起关联。
本发明实施例的接入点，支持与终端进行加密的终端的能力信息传输，并通过关联前索引信息来标识该终端，这样，窃听者不管是在关联之前或者是在关联过程中在空口即使监听到该能力信息，也不能获取该终端的能力信息，从而可以防止窃听者根据终端的能力信息确定终端所在的位置、时间等信息，避免用户隐私的泄露。
可选地，在一些实施例中，所述接收模块具体用于：
接收所述终端发送的关联请求消息，所述关联请求消息包括所述加密的所述终端的能力信息。
可选地，在一些实施例中，所述接收模块还用于：接收所述终端发送的第一消息，所述第一消息包括所述加密的所述终端的能力信息，所述第一消息为管理消息；接收所述终端发送的关联请求消息。
可选地，在一些实施例中，所述接收器还用于：所述接收模块具体用于：接收所述终端发送的所述终端的公钥；
所述生成模块还用于：根据所述终端的公钥生成解密密钥，所述解密密钥用于解密加密的所述终端的能力信息；
所述发送模块还用于：向所述终端发送所述接入点的公钥，所述接入点的公钥用于所述终端生成加密所述终端的能力信息的加密密钥。
可选地，在一些实施例中，所述接收模块具体用于：接收所述终端发送的探测请求消息，所述探测请求消息包括所述终端的公钥；
或者，接收所述终端向所述接入点发送的第二消息，所述第二消息包括所述终端的公钥，所述第二消息为管理消息。
可选地，在一些实施例中，所述发送模块具体用于：向所述终端发送探测响应消息，所述探测响应消息包括所述接入点的公钥；
或者，向所述终端发送第三消息，所述第三消息包括所述接入点的公钥，所述第三消息为管理消息；
或者，向所述终端发送信标帧，所述信标帧包括所述接入点的公钥。
可选地，在一些实施中，所述发送模块还用于：向所述终端发送指示信息，所述指示信息用于指示所述接入点支持与所述终端进行加密的所述终端的设备能力信息传输。
可选地，在一些实施例中，所述发送模块具体用于：向所述终端发送探测响应消息，所述探测响应消息包括所述指示信息；
或者，向所述终端发送第四消息，所述第四消息包括所述指示信息，所述第四消息为管理消息；
或者，向所述终端发送信标帧，所述信标帧包括所述指示信息。
可选地，在一些实施例中，所述发送模块具体用于：向所述终端发送第五消息，所述第五消息包括所述关联前索引信息，所述第五消息为管理消息；
或者，向所述终端发送探测响应消息，所述探测响应消息包括所述关联前索引信息。
可选地，在一些实施例中，所述生成模块还用于：所述接入点生成加密的接入点的能力信息；
所述发送模块还用于向所述终端发送所述加密的接入点的能力信息。
应理解，这里的接入点均以功能模块的形式体现。这里的术语“模块”可以指用于应用特有的集成电路、电子电路、用于执行一个或多个软件或固件程序的处理器(例如共享处理器、专有处理器或组处理器)和存储器、合并络级电路和/或其他支持所描述的功能的合适组件。该接入点可以用于执行上述方法实施例中与接入点相对应的各个流程和\或步骤，为避免重复，在此不再赘述。
图11示出了本发明另一实施例的终端的示意性框图。该终端包括：处理器1101、存储器1102、发送器1103、接收器1105，终端中的各个组件通过耦合的方式连接在一起，接收器1105通过天线1104接收数据，发送器1103通过天线1104发送数据。需要说明的是，接收器和发送器可以共用一个具有接收和发送信号两种能力的天线，也可以分别使用不同的天线，本发明实施例对此不作限制，仅以前一种情况为示例。
上述本发明实施例揭示的无线局域网中建立关联的方法可以应用于处理器1101中，或者由处理器1101实现。处理器1101可能是一种集成电路芯片，具有信号的处理能力。在实现过程中，上述方法的各步骤可以通过处理器1101中的硬件的集成逻辑电路或者软件形式的指令完成。上述的处理器1101可以是通用处理器、或者是***级芯片(System-on-a-Chip，SOC芯片)、基带处理器、数字信号处理器(Digital Signal Processor，DSP)、专用集成电路(Application Specific Integrated Circuit，ASIC)、现成可编程门阵列(Field Programmable Gate Array，FPGA)或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件。可以实现或者执行本发明实施例中的公开的各方法、步骤及逻辑框图。通用处理器可以是微处理器或者该处理器也可以是 任何常规的处理器等。结合本发明实施例所公开的方法的步骤可以直接体现为硬件译码处理器执行完成，或者用译码处理器中的硬件及软件模块组合执行完成。软件模块可以位于随机存取存储器(Random Access Memory，RAM)、闪存、只读存储器(Read-Only Memory，ROM)、可编程只读存储器或者电可擦写可编程存储器、寄存器等本领域成熟的存储介质中。该存储介质位于存储器1102，处理器1101读取存储器1102中的指令，结合其硬件完成上述方法的步骤。
该处理器1101，用于生成加密的所述终端的能力信息；
接收器1104，用于接收接入点发送的与所述终端相关的关联前索引信息，所述关联前索引信息用于所述接入点在所述终端与所述接入点尚未建立关联时识别所述终端；
发送器1103，用于向所述接入点发送加密的所述终端的能力信息和关联请求消息，所述关联请求消息包括所述关联前索引信息；
所述接收器1104还用于接收所述接入点根据所述终端的能力信息和所述关联前索引信息发送的关联响应消息，从而所述终端和所述接入点建立起关联。
本发明实施例的终端，将终端的能力信息通过加密的方式发送给接入点，并通过关联前索引信息来标识该终端，这样，窃听者不管是在关联之前或者是在关联过程中在空口即使监听到该能力信息，也不能获取该终端的能力信息，从而可以防止窃听者根据终端的能力信息确定终端所在的位置、时间等信息，避免用户隐私的泄露。
可选地，在一些实施例中，所述发送器还用于：向所述接入点发送关联请求消息，所述关联请求消息包括所述加密的所述终端的能力信息。
可选地，在一些实施例中，所述发送器还用于：向所述接入点发送第一消息，所述第一消息包括所述加密的所述终端的能力信息，所述第一消息为管理消息；
向所述接入点发送所述关联请求消息。
可选地，在一些实施例中，所述发送器还用于：在所述发送模块发送加密的所述终端的能力信息之前，向所述接入点发送所述终端的公钥，所述终端的公钥用于所述接入点生成解密所述终端的能力信息的解密密钥；
所述接收模块还用于接收所述接入点发送的所述接入点的公钥；
所述生成模块还用于根据所述接入点的公钥生成所述终端的加密密钥，所述终端的加密密钥用于加密所述终端的能力信息。
可选地，在一些实施例中，所述发送器具体用于：向所述接入点发送探测请求消息，所述探测请求消息包括所述终端的公钥；
或者，向所述接入点发送第二消息，所述第二消息包括所述终端的公钥，所述第二消息为管理消息。
可选地，在一些实施例中，所述接收器具体用于：接收所述接入点发送的探测响应消息，所述探测响应消息包括所述接入点的公钥；
或者，接收所述接入点发送的第三消息，所述第三消息包括所述接入点的公钥，所述第三消息为管理消息；
或者，接收所述接入点发送的信标帧，所述信标帧包括所述接入点的公钥。
可选地，在一些实施例中，所述接收器具体用于：接收所述接入点发送的指示信息，所述指示信息用于指示所述接入点支持与所述终端进行加密的所述终端的设备能力信息传输。
可选地，在一些实施例中，所述接收器还用于：接收所述接入点发送的探测响应消息，所述 探测响应消息包括所述指示信息；
或者，接收所述接入点发送的第四消息，所述第四消息包括所述指示信息，所述第四消息为管理消息；
或者，接收所述接入点发送的信标帧，所述信标帧包括所述指示信息。
可选地，在一些实施例中，所述接收器具体用于：接收接入点发送的第五消息，所述第五消息包括所述关联前索引信息，所述第五消息为管理消息；
或者，接收所述接入点发送的探测响应消息，所述探测响应消息包括所述关联前索引信息。
可选地，在一些实施例中，所述终端向所述接入点发送所述关联请求消息所使用的MAC地址与所述终端向所述接入点发送所述关联请求消息之前所使用的MAC地址不同。
应理解，该终端可以用于执行上述方法实施例中与终端相对应的各个流程和\或步骤，为避免重复，在此不再赘述。
图12是本发明另一实施例的接入点的示意性框图。该接入点包括：处理器1201、存储器1202、发送器1203、接收器1205，终端中的各个组件通过耦合的方式连接在一起，接收器1205通过天线1204接收数据，发送器1203通过天线1204发送数据。需要说明的是，接收器和发送器可以共用一个具有接收和发送信号两种能力的天线，也可以分别使用不同的天线，本发明实施例对此不作限制，仅以前一种情况为示例。
上述本发明实施例揭示的无线局域网中建立关联的方法可以应用于处理器1201中，或者由处理器1201实现。处理器1201可能是一种集成电路芯片，具有信号的处理能力。在实现过程中，上述方法的各步骤可以通过处理器1201中的硬件的集成逻辑电路或者软件形式的指令完成。上述的处理器1201可以是通用处理器、或者是***级芯片(System-on-a-Chip，SOC芯片)、基带处理器、数字信号处理器(Digital Signal Processor，DSP)、专用集成电路(Application Specific Integrated Circuit，ASIC)、现成可编程门阵列(Field Programmable Gate Array，FPGA)或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件。可以实现或者执行本发明实施例中的公开的各方法、步骤及逻辑框图。通用处理器可以是微处理器或者该处理器也可以是任何常规的处理器等。结合本发明实施例所公开的方法的步骤可以直接体现为硬件译码处理器执行完成，或者用译码处理器中的硬件及软件模块组合执行完成。软件模块可以位于随机存取存储器(Random Access Memory，RAM)、闪存、只读存储器(Read-Only Memory，ROM)、可编程只读存储器或者电可擦写可编程存储器、寄存器等本领域成熟的存储介质中。该存储介质位于存储器1202，处理器1201读取存储器1202中的指令，结合其硬件完成上述方法的步骤。
该处理器1201，用于生成与终端相关的关联前索引信息，所述关联前索引信息用于所述接入点在所述终端与所述接入点尚未建立关联时识别所述终端；
发送器1203，用于向所述终端发送所述关联前索引信息；
接收器1205，用于接收所述终端发送的加密的所述终端的能力信息和关联请求消息，所述关联请求消息包括所述关联前索引信息；
处理器1201，用于解密所述加密的终端的能力信息；
所述发送模块1203还用于根据所述终端的能力信息和所述关联前索引信息向所述终端发送关联响应消息，从而所述接入点和所述终端建立起关联。
本发明实施例的接入点，支持与终端进行加密的终端的能力信息传输，并通过关联前索引信息来标识该终端，这样，窃听者不管是在关联之前或者是在关联过程中在空口即使监听到该能力 信息，也不能获取该终端的能力信息，从而可以防止窃听者根据终端的能力信息确定终端所在的位置、时间等信息，避免用户隐私的泄露。
可选地，在一些实施例中，所述接收器具体用于：接收所述终端发送的关联请求消息，所述关联请求消息包括所述加密的所述终端的能力信息。
可选地，在一些实施例中，所述接收器还用于：接收所述终端发送的第一消息，所述第一消息包括所述加密的所述终端的能力信息，所述第一消息为管理消息；接收所述终端发送的关联请求消息
可选地，在一些实施例中，所述接收器还用于：接收所述终端发送的所述终端的公钥；
所述处理器还用于：根据所述终端的公钥生成解密密钥，所述解密密钥用于解密加密的所述终端的能力信息；
所述发送器还用于：向所述终端发送所述接入点的公钥，所述接入点的公钥用于所述终端生成加密所述终端的能力信息的加密密钥。
可选地，在一些实施例中，所述接收器具体用于：接收所述终端发送的探测请求消息，所述探测请求消息包括所述终端的公钥；
或者，接收所述终端向所述接入点发送的第二消息，所述第二消息包括所述终端的公钥，所述第二消息为管理消息。
可选地，在一些实施例中，所述发送器具体用于：向所述终端发送探测响应消息，所述探测响应消息包括所述接入点的公钥；
或者，向所述终端发送第三消息，所述第三消息包括所述接入点的公钥，所述第三消息为管理消息；
或者，向所述终端发送信标帧，所述信标帧包括所述接入点的公钥。
可选地，在一些实施中，所述发送器具体用于：向所述终端发送指示信息，所述指示信息用于指示所述接入点支持与所述终端进行加密的所述终端的设备能力信息传输。
可选地，在一些实施例中，所述发送器还用于：向所述终端发送探测响应消息，所述探测响应消息包括所述指示信息；
或者，向所述终端发送第四消息，所述第四消息包括所述指示信息，所述第四消息为管理消息；
或者，向所述终端发送信标帧，所述信标帧包括所述指示信息。
可选地，在一些实施例中，所述发送器具体用于：向所述终端发送第五消息，所述第五消息包括所述关联前索引信息，所述第五消息为管理消息；
或者，向所述终端发送探测响应消息，所述探测响应消息包括所述关联前索引信息。
可选地，在一些实施例中，所述处理器还用于：所述接入点生成加密的接入点的能力信息；
所述发送模块还用于向所述终端发送所述加密的接入点的能力信息。
应理解，该接入点可以用于执行上述方法实施例中与接入点相对应的各个流程和\或步骤，为避免重复，在此不再赘述。
图13是本发明再一实施例的终端的示意性框图。该终端包括：
处理模块1301，用于控制终端内部各模块动作。
发现模块1302，用于执行接入点的发现。
具体地，该发现模块用于发现周围支持安全关联模式的接入点，和/或产生探测请求消息。
加密解密模块1303，用于产生保护终端的能力信息的公钥和私钥对。
可选地，在一些实施例中，该加密解密模块还可以生成加密密钥和对终端的能力信息进行加密和解密处理。
可选地，在一些实施例中，该加密解密模块还可以在获得接入点的公钥之后，能够计算得到终端的能力信息的加密密钥。
可选地，在一些实施例中，该加密解密模块还可以对终端的能力信息进行加密，生成加密后的终端的能力信息。
可选地，在一些实施例中，当接入点也需要隐私保护时，该加密解密模块还可以在收到接入点加密的接入点的能力信息后，解密获得接入点的能力信许。
关联模块1304，用于执行终端与接入点的认证和关联，包括根据安全前关联索引信息完成终端的认证和关联。
应理解，该终端可以用于执行上述方法实施例中与终端相对应的各个流程和\或步骤，为避免重复，在此不再赘述。
图14示出了本发明再一实施例的接入点的示意性框图，该接入点包括：
处理模块1401，用于控制接入点中内部各个模块的动作。
发现响应模块1402，用于执行终端的发现的响应的生成和回复。
可选地，在一些实施例中，该发现响应模块还用于产生探测响应消息。通过发现响应模块对终端的响应，还可以指示该接入点支持反追踪模式。
加密解密模块1403，用于产生保护该接入点能力信息的公钥和私钥对。
可选地，在一些实施例中，该加密解密模块还可以生成加密密钥。
可选地，在一些实施例中，该加密解密模块还可以对接入点的能力信息进行加密和解密处理。
可选地，在一些实施例中，该加密解密模块在获得终端的公钥后，还能够计算得到接入点的能力信息的加密密钥。
可选地，在一些实施例中，该加密解密模块还可以对加密的终端的能力信息进行解密，获得终端的能力信息。
可选地，在一些实施例中，当接入点也需要隐私保护时，该加密解密模块还可以对设备能力信息进行加密，生成加密的接入点的能力信息。
可选地，在一些实施例中，该加密解密模块还可以产生关联前索引信息。
关联模块1404，用于执行终端的认证和关联，包括根据关联前索引信息完成与终端的认证和关联。
该接入点可以用于执行上述方法实施例中与接入点相对应的各个流程和\或步骤，为避免重复，在此不再赘述。
本领域普通技术人员可以意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，能够以电子硬件、或者计算机软件和电子硬件的结合来实现。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本发明的技术方案的范围。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的***、装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。本发明各方法实施例之间相关部分可以相互参考；各装置实施例所提供的装置用于执行对应的方法实施例所提 供的方法，故各装置实施例可以参考相关的方法实施例中的相关部分进行理解。本发明各实施例之间相关部分均可以相互参考。
本发明各装置实施例中给出的装置结构图仅示出了对应的装置的简化设计。在实际应用中，该装置可以包含任意数量的发射器，接收器，收发器，处理器，存储器等，以实现本发明各装置实施例中该装置所执行的功能或操作，而所有可以实现本申请的装置都在本申请的保护范围之内。
本发明各实施例中提供的消息/帧/指示信息、模块或单元等的名称仅为示例，可以使用其他名称，只要消息/帧/指示信息、模块或单元等的作用相同即可。
在本申请所提供的几个实施例中，应该理解到，所揭露的***、装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个***，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本发明各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。
所述功能如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本发明实施例的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)或处理器(processor)执行本发明各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(ROM，Read-Only Memory)、随机存取存储器(RAM，Random Access Memory)、磁碟或者光盘等各种可以存储程序代码的介质。
以上所述，仅为本发明实施例的具体实施方式，但本发明的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本发明揭露的技术范围内，可轻易想到的变化或替换，都应涵盖在本发明的保护范围之内，因此本发明的保护范围应以权利要求的保护范围为准。

Claims (42)

  1. 一种无线局域网中建立关联的方法，其特征在于，包括：
    终端生成加密的所述终端的能力信息；
    所述终端接收接入点发送的与所述终端相关的关联前索引信息，所述关联前索引信息用于所述接入点在所述终端与所述接入点尚未建立关联时识别所述终端；
    所述终端向所述接入点发送加密的所述终端的能力信息和关联请求消息，所述关联请求消息包括所述关联前索引信息；
    所述终端接收所述接入点根据所述终端的能力信息和所述关联前索引信息发送的关联响应消息，从而所述终端与所述接入点建立起关联。
  2. 根据权利要求1所述的方法，其特征在于，所述终端向所述接入点发送加密的所述终端的能力信息和关联请求消息，包括：
    所述终端向所述接入点发送所述关联请求消息，所述关联请求消息包括所述加密的所述终端的能力信息。
  3. 根据权利要求1所述的方法，其特征在于，所述终端向所述接入点发送加密的所述终端的能力信息和关联请求消息，包括：
    所述终端向所述接入点发送第一消息，所述第一消息包括所述加密的所述终端的能力信息，所述第一消息为管理消息；
    所述终端向所述接入点发送所述关联请求消息。
  4. 根据权利要求1-3中任一项所述的方法，其特征在于，在所述终端向所述接入点发送加密的所述终端的能力信息之前，所述方法还包括：
    所述终端向所述接入点发送所述终端的公钥，所述终端的公钥用于所述接入点生成解密所述加密的终端的能力信息的解密密钥，其中，所述终端接收所述接入点发送的与所述终端相关的关联前索引信息发生在所述终端向所述接入点发送所述终端的公钥之后；
    所述终端接收所述接入点发送的所述接入点的公钥；
    所述终端根据所述接入点的公钥生成所述终端的加密密钥，所述终端的加密密钥用于加密所述终端的能力信息。
  5. 根据权利要求4所述的方法，其特征在于，所述终端向所述接入点发送所述终端的公钥，包括：
    所述终端向所述接入点发送探测请求消息，所述探测请求消息包括所述终端的公钥；
    或者，所述终端向所述接入点发送第二消息，所述第二消息包括所述终端的公钥，所述第二消息为管理消息。
  6. 根据权利要求4或5所述的方法，其特征在于，所述终端接收所述接入点发送的所述接入点的公钥，包括：
    所述终端接收所述接入点发送的探测响应消息，所述探测响应消息包括所述接入点的公钥；
    或者，所述终端接收所述接入点发送的第三消息，所述第三消息包括所述接入点的公钥，所述第三消息为管理消息；
    或者，所述终端接收所述接入点发送的信标帧，所述信标帧包括所述接入点的公钥。
  7. 根据权利要求1-6中任一项所述的方法，其特征在于，所述方法还包括：
    所述终端接收所述接入点发送的指示信息，所述指示信息用于指示所述接入点支持与所述终端进行加密的所述终端的能力信息的传输。
  8. 根据权利要求7所述的方法，其特征在于，所述终端接收所述接入点发送的指示信息，包括：
    所述终端接收所述接入点发送的探测响应消息，所述探测响应消息包括所述指示信息；
    或者，所述终端接收所述接入点发送的第四消息，所述第四消息包括所述指示信息，所述第四消息为管理消息；
    或者，所述终端接收所述接入点发送的信标帧，所述信标帧包括所述指示信息。
  9. 根据权利要求1-8中任一项所述的方法，其特征在于，所述终端接收所述接入点发送的关联前索引信息，包括：
    所述终端接收接入点发送的第五消息，所述第五消息包括所述关联前索引信息，所述第五消息为管理消息；
    或者，所述终端接收所述接入点发送的探测响应消息，所述探测响应消息包括所述关联前索引信息。
  10. 根据权利要求1-9中任一项所述的方法，其特征在于，所述终端向所述接入点发送所述关联请求消息所使用的MAC地址与所述终端向所述接入点发送所述关联请求消息之前所使用的MAC地址不同。
  11. 一种无线局域网中建立关联的方法，其特征在于，包括：
    接入点生成与终端相关的关联前索引信息，所述关联前索引信息用于所述接入点在所述终端与所述接入点尚未建立关联时识别所述终端；
    所述接入点向所述终端发送所述关联前索引信息；
    所述接入点接收所述终端发送的加密的所述终端的能力信息和关联请求消息，所述关联请求消息包括所述关联前索引信息；
    所述接入点解密所述加密的终端的能力信息；
    所述接入点根据所述终端的能力信息和所述关联前索引信息向所述终端发送关联响应消息，从而所述接入点与所述终端建立起关联。
  12. 根据权利要求11所述的方法，其特征在于，所述接入点接收所述终端发送的加密的所述终端的能力信息和关联请求消息，包括：
    所述接入点接收所述终端发送的所述关联请求消息，所述关联请求消息包括所述加密的所述终端的能力信息。
  13. 根据权利要求11所述的方法，其特征在于，所述接入点接收所述终端发送的加密的所述终端的能力信息和关联请求消息，包括：
    所述接入点接收所述终端发送的第一消息，所述第一消息包括所述加密的所述终端的能力信息，所述第一消息为管理消息；
    所述接入点接收所述终端发送的关联请求消息。
  14. 根据权利要求11-13中任一项所述的方法，其特征在于，在所述接入点接收所述终端发送的加密的所述终端的能力信息之前，所述方法还包括：
    所述接入点接收所述终端发送的所述终端的公钥，其中，所述接入点向所述终端发送所述关联前索引信息发生在所述接入点接收所述终端发送的所述终端的公钥之后；
    所述接入点根据所述终端的公钥生成解密密钥，所述解密密钥用于解密所述加密的所述终端的能力信息；
    所述接入点向所述终端发送所述接入点的公钥，所述接入点的公钥用于所述终端生成加密所述终端的能力信息的加密密钥。
  15. 根据权利要求14所述的方法，其特征在于，所述接入点接收所述终端发送的所述终端的公钥， 包括：
    所述接入点接收所述终端发送的探测请求消息，所述探测请求消息包括所述终端的公钥；
    或者，所述接入点接收所述终端发送的第二消息，所述第二消息包括所述终端的公钥，所述第二消息为管理消息。
  16. 根据权利要求14或15所述的方法，其特征在于，所述接入点向所述终端发送所述接入点的公钥，包括：
    所述接入点向所述终端发送探测响应消息，所述探测响应消息包括所述接入点的公钥；
    或者，所述接入点向所述终端发送第三消息，所述第三消息包括所述接入点的公钥，所述第三消息为管理消息；
    或者，所述接入点向所述终端发送信标帧，所述信标帧包括所述接入点的公钥。
  17. 根据权利要求11-16中任一项所述的方法，其特征在于，所述方法还包括：
    所述接入点向所述终端发送指示信息，所述指示信息用于指示所述接入点支持与所述终端进行加密的所述终端的设备能力信息的传输。
  18. 根据权利要求17所述的方法，其特征在于，所述接入点向所述终端发送指示信息，包括：
    所述接入点向所述终端发送探测响应消息，所述探测响应消息包括所述指示信息；
    或者，所述接入点向所述终端发送第四消息，所述第四消息包括所述指示信息，所述第四消息为管理消息；
    或者，所述接入点向所述终端发送信标帧，所述信标帧包括所述指示信息。
  19. 根据权利要求11-18中任一项所述的方法，其特征在于，所述接入点向所述终端发送所述关联前索引信息，包括：
    所述接入点向所述终端发送第五消息，所述第五消息包括所述关联前索引信息，所述第五消息为管理消息；
    或者，所述接入点向所述终端发送探测响应消息，所述探测响应消息包括所述关联前索引信息。
  20. 根据权利要求11-19中任一项所述的方法，其特征在于，在所述接收所述终端发送的所述关联请求消息之前，所述方法还包括：
    所述接入点生成加密的接入点的能力信息；
    所述接入点向所述终端发送所述加密的接入点的能力信息。
  21. 一种终端，其特征在于，包括：
    生成模块，用于生成加密的所述终端的能力信息；
    接收模块，用于接收接入点发送的与所述终端相关的关联前索引信息，所述关联前索引信息用于所述接入点在所述终端与所述接入点尚未建立关联时识别所述终端；
    发送模块，用于向所述接入点发送加密的所述终端的能力信息和关联请求消息，所述关联请求消息包括所述关联前索引信息；
    所述接收模块还用于接收所述接入点根据所述终端的能力信息和所述关联前索引信息发送的关联响应消息，从而所述终端与所述接入点建立起关联。
  22. 根据权利要求21所述的终端，其特征在于，所述发送模块具体用于：
    向所述接入点发送所述关联请求消息，所述关联请求消息包括所述加密的所述终端的能力信息。
  23. 根据权利要求21所述的终端，其特征在于，所述发送模块具体用于：
    向所述接入点发送第一消息，所述第一消息所述第一消息包括所述加密的所述终端的能力信息，所述第一消息为管理消息；
    向所述接入点发送所述关联请求消息。
  24. 根据权利要求21-23中任一项所述的终端，其特征在于，所述发送模块还用于：在所述发送模块向所述接入点发送加密的所述终端的能力信息之前，向所述接入点发送所述终端的公钥，所述终端的公钥用于所述接入点生成解密所述加密的终端的能力信息的解密密钥；其中，所述终端接收所述接入点发送的与所述终端相关的关联前索引信息发生在所述终端向所述接入点发送所述终端的公钥之后；
    所述接收模块还用于接收所述接入点发送的所述接入点的公钥；
    所述生成模块还用于根据所述接入点的公钥生成所述终端的加密密钥，所述终端的加密密钥用于加密所述终端的能力信息。
  25. 根据权利要求24所述的终端，其特征在于，所述发送模块具体用于：
    向所述接入点发送探测请求消息，所述探测请求消息包括所述终端的公钥；
    或者，向所述接入点发送第二消息，所述第二消息包括所述终端的公钥，所述第二消息为管理消息。
  26. 根据权利要求24或25所述的方法，其特征在于，所述接收模块具体用于：
    接收所述接入点发送的探测响应消息，所述探测响应消息包括所述接入点的公钥；
    或者，接收所述接入点发送的第三消息，所述第三消息包括所述接入点的公钥，所述第三消息为管理消息；
    或者，接收所述接入点发送的信标帧，所述信标帧包括所述接入点的公钥。
  27. 根据权利要求21-26中任一项所述的终端，其特征在于，所述接收模块还用于：
    接收所述接入点发送的指示信息，所述指示信息用于指示所述接入点支持与所述终端进行加密的所述终端的设备能力信息的传输。
  28. 根据权利要求27所述的终端，其特征在于，所述接收模块具体用于：
    接收所述接入点发送的探测响应消息，所述探测响应消息包括所述指示信息；
    或者，接收所述接入点发送的第四消息，所述第四消息包括所述指示信息，所述第四消息为管理消息；
    或者，接收所述接入点发送的信标帧，所述信标帧包括所述指示信息。
  29. 根据权利要求21-28中任一项所述的终端，其特征在于，所述接收模块具体用于：
    接收接入点发送的第五消息发送，所述第五消息包括所述关联前索引信息，所述第五消息为管理消息；
    或者，接收所述接入点发送的探测响应消息，所述探测响应消息包括所述关联前索引信息。
  30. 根据权利要求21-29中任一项所述的方法，其特征在于，所述终端向所述接入点发送所述关联请求消息所使用的MAC地址与所述终端向所述接入点发送所述关联请求消息之前所使用的MAC地址不同。
  31. 一种接入点，其特征在于，包括：
    生成模块，生成与终端相关的关联前索引信息，所述关联前索引信息用于所述接入点在所述终端与所述接入点尚未建立关联时识别所述终端；
    发送模块，用于向所述终端发送所述关联前索引信息；
    接收模块，用于接收所述终端发送的加密的所述终端的能力信息和关联请求消息，所述关联请求消息包括所述关联前索引信息；
    解密模块，用于解密所述加密的终端的能力信息；
    所述发送模块还用于：根据所述终端的能力信息和所述关联前索引信息向所述终端发送关联响应消息，从而所述接入点与所述终端建立起关联。
  32. 根据权利要求31所述的接入点，其特征在于，所述接收模块具体用于：
    接收所述终端发送的所述关联请求消息，所述关联请求消息包括所述加密的所述终端的能力信息。
  33. 根据权利要求31所述的接入点，其特征在于，所述接收模块具体用于：
    接收所述终端发送的第一消息，所述第一消息包括所述加密的所述终端的能力信息，所述第一消息为管理消息；
    接收所述终端发送的关联请求消息。
  34. 根据权利要求31-33中任一项所述的接入点，其特征在于，所述接收模块具体用于：接收所述终端发送的所述终端的公钥，其中，所述接入点向所述终端发送所述关联前索引信息发生在所述接入点接收所述终端发送的所述终端的公钥之后；；
    所述生成模块还用于：根据所述终端的公钥生成解密密钥，所述解密密钥用于解密所述加密的所述终端的能力信息；
    所述发送模块还用于：向所述终端发送所述接入点的公钥，所述接入点的公钥用于所述终端生成加密所述终端的能力信息的加密密钥。
  35. 根据权利要求34所述的接入点，其特征在于，所述接收模块具体用于：
    接收所述终端发送的探测请求消息，所述探测请求消息包括所述终端的公钥；
    或者，接收所述终端发送的第二消息，所述第二消息包括所述终端的公钥，所述第二消息为管理消息。
  36. 根据权利要求34或35所述的接入点，其特征在于，所述发送模块具体用于：
    向所述终端发送探测响应消息，所述探测响应消息包括所述接入点的公钥；
    或者，向所述终端发送第三消息，所述第三消息包括所述接入点的公钥，所述第三消息为管理消息；
    或者，向所述终端发送信标帧，所述信标帧包括所述接入点的公钥。
  37. 根据权利要求31-36中任一项所述的接入点，其特征在于，所述发送模块还用于：
    向所述终端发送指示信息，所述指示信息用于指示所述接入点支持与所述终端进行加密的所述终端的设备能力信息的传输。
  38. 根据权利要求37所述的接入点，其特征在于，所述发送模块具体用于：
    向所述终端发送探测响应消息，所述探测响应消息包括所述指示信息；
    或者，向所述终端发送第四消息，所述第四消息包括所述指示信息，所述第四消息为管理消息；
    或者，向所述终端发送信标帧，所述信标帧包括所述指示信息。
  39. 根据权利要求31-38中任一项所述的接入点，其特征在于，所述发送模块具体用于：
    向所述终端发送第五消息，所述第五消息包括所述关联前索引信息，所述第五消息为管理消 息；
    或者，向所述终端发送探测响应消息，所述探测响应消息包括所述关联前索引信息。
  40. 根据权利要求31-39中任一项所述的接入点，其特征在于，所述生成模块还用于：在所述接收模块接收所述终端发送的所述关联请求消息之前，所述接入点生成加密的接入点的能力信息；
    所述发送模块还用于向所述终端发送所述加密的接入点的能力信息。
  41. 一种终端，其特征在于，包括：
    处理器、存储器、发送器和接收器；
    所述存储器用于存储指令；
    所述处理器用于调用所述指令，通过所述发送器和接收器来执行如权利要求1-10任一所述的方法。
  42. 一种接入点，其特征在于，包括：
    处理器、存储器、发送器和接收器；
    所述存储器用于存储指令；
    所述处理器用于调用所述指令，通过所述发送器和接收器来执行如权利要求11-20任一所述的方法。
PCT/CN2017/094374 2016-08-31 2017-07-25 无线局域网中建立关联的方法、终端和接入点 WO2018040805A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
US16/328,842 US10674353B2 (en) 2016-08-31 2017-07-25 Association establishment method in wireless local area network, terminal, and access point
EP17845107.6A EP3499936B1 (en) 2016-08-31 2017-07-25 Method for establishing association in wireless local area network, terminal and access point

Applications Claiming Priority (4)

Application Number Priority Date Filing Date Title
CN201610799549.0 2016-08-31
CN201610799549 2016-08-31
CN201610995436.8A CN107786972B (zh) 2016-08-31 2016-11-11 无线局域网中建立关联的方法、终端和接入点
CN201610995436.8 2016-11-11

Publications (1)

Publication Number Publication Date
WO2018040805A1 true WO2018040805A1 (zh) 2018-03-08

Family

ID=61300157

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/094374 WO2018040805A1 (zh) 2016-08-31 2017-07-25 无线局域网中建立关联的方法、终端和接入点

Country Status (1)

Country Link
WO (1) WO2018040805A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112383915A (zh) * 2020-12-02 2021-02-19 中国联合网络通信集团有限公司 无线网络接入方法、无线接入装置和终端
WO2022267723A1 (zh) * 2021-06-22 2022-12-29 华为技术有限公司 一种会话密钥生成的方法及装置

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103476030A (zh) * 2013-08-29 2013-12-25 小米科技有限责任公司 移动终端连接网络的方法、移动终端与终端设备
CN103596179A (zh) * 2013-11-29 2014-02-19 西安电子科技大学昆山创新研究院 基于射频标签的无线局域网接入认证抗拒绝服务攻击方法
WO2014190243A1 (en) * 2013-05-24 2014-11-27 Qualcomm Incorporated Systems and methods for broadcast wlan messages with message authentication
CN105577365A (zh) * 2014-11-11 2016-05-11 ***通信集团公司 一种用户接入wlan的密钥协商方法及装置

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2014190243A1 (en) * 2013-05-24 2014-11-27 Qualcomm Incorporated Systems and methods for broadcast wlan messages with message authentication
CN103476030A (zh) * 2013-08-29 2013-12-25 小米科技有限责任公司 移动终端连接网络的方法、移动终端与终端设备
CN103596179A (zh) * 2013-11-29 2014-02-19 西安电子科技大学昆山创新研究院 基于射频标签的无线局域网接入认证抗拒绝服务攻击方法
CN105577365A (zh) * 2014-11-11 2016-05-11 ***通信集团公司 一种用户接入wlan的密钥协商方法及装置

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3499936A4 *

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112383915A (zh) * 2020-12-02 2021-02-19 中国联合网络通信集团有限公司 无线网络接入方法、无线接入装置和终端
CN112383915B (zh) * 2020-12-02 2023-11-21 中国联合网络通信集团有限公司 无线网络接入方法、无线接入装置和终端
WO2022267723A1 (zh) * 2021-06-22 2022-12-29 华为技术有限公司 一种会话密钥生成的方法及装置

Similar Documents

Publication Publication Date Title
US12010519B2 (en) Information sharing method, terminal device, storage medium, and computer program product
EP3499936B1 (en) Method for establishing association in wireless local area network, terminal and access point
US11765577B2 (en) Identity obscuration for a wireless station
CN108702623B (zh) 一种无线局域网的配置方法及设备
WO2017198161A1 (zh) 网络连接方法、装置、存储介质及终端
WO2016082801A1 (zh) 一种用于建立无线连接的方法及设备
CN108886685B (zh) 一种终端匹配方法、装置
JP7204792B2 (ja) Ｗｉ－ｆｉホットスポット接続方法および端末
CN104378801A (zh) 接入无线网络的方法及装置
CN104955038A (zh) 分配寻址标识的方法及接入点、站点和通信***
US20230344626A1 (en) Network connection management method and apparatus, readable medium, program product, and electronic device
CN108702625B (zh) 一种建立无线局域网连接的方法、装置和终端
WO2019214351A1 (zh) 消息处理方法及装置
EP4030802A1 (en) Method and apparatus for managing subscription data
US20230318916A1 (en) Network Configuration Method and Apparatus for Intelligent Device
US20180367292A1 (en) Data transmission method, device, and system
CN107734528B (zh) 无线网络检测方法、装置、存储介质及终端
WO2018040805A1 (zh) 无线局域网中建立关联的方法、终端和接入点
CN107404720B (zh) 一种无线设置信息重置的方法及相关设备
CN111770588B (zh) 一种与无线路由器快速建立无线连接的方法及***
WO2018120624A1 (zh) 一种获取认证信息的方法、装置及***
JP6145062B2 (ja) 中継装置、送信制御方法及びコンピュータプログラム
WO2017117775A1 (zh) 一种通信安全处理方法、***及相关设备
WO2023202631A1 (zh) 签约方法、装置、通信设备、物联网设备及网元
WO2023213205A1 (zh) 通信方法和装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17845107

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 2017845107

Country of ref document: EP

Effective date: 20190315