Authentication enhancement with neighbor device

In embodiments of the present disclosure, there is provided a method for authenticating an access point. In the method, a request for joining a network is received from an access point. A neighbor authentication notification is transmitted to the access point for obtaining an authentication code from a neighbor access point that is connected in the network in accordance with a determination that the access point is verified. The authentication code that is generated by the neighbor access point is received from the access point. The access point is accepted to join the network in accordance with a determination that the authentication code is valid. Embodiments of the present disclosure present a safe and effective way for authenticating the access point that is requesting to join the network, which provides enhanced authentication and increases the security level of the network.

BACKGROUND

An access point (AP) is a networking device that allows terminal devices to connect to a network. The AP may request to join the network via a wired or wireless mode, and become a node in the network. A controller of the network may implement an authentication procedure to acceptor reject the AP. Once the AP is accepted, it can join the network and then be connected by other terminal devices, such as a notebook or a cellphone and the like, for accessing resources in the network. The security level of the authentication procedure greatly influences operations of the network.

SUMMARY

According to a first aspect of the present disclosure, there is provided a method for authenticating an AP. In the method, a request for joining a network is received from an AP. A neighbor authentication notification is transmitted to the AP for obtaining an authentication code from a neighbor AP that is connected in the network in accordance with a determination that the AP is verified. The authentication code that is generated by the neighbor AP is received from the AP. The AP is accepted to join the network in accordance with a determination that the authentication code is valid.

According to a second aspect of the present disclosure, there is provided a method for authenticating an AP. In the method, a neighbor authentication command is received from a controller in a network for generating an authentication code for a target AP, here the target AP is verified by the controller to join the network. A request is received from an AP for obtaining an authentication code. The authentication code is generated based on the neighbor authentication command in accordance with a determination that the AP matches the target AP. The authentication code is transmitted to the AP.

According to a third aspect of the present disclosure, there is provided an authentication device in a network. The authentication device comprises: a processor; and a memory coupled to the processor, the memory storing instructions to cause the processor to implement acts comprising: receiving, from an AP, a request for joining the network; in accordance with a determination that the AP is verified, transmitting to the AP a neighbor authentication notification for obtaining at least one authentication code from at least one neighbor AP that is connected in the network; receiving, from the AP, the at least one authentication code that is generated by the at least one neighbor AP; and in accordance with a determination that any of the at least one authentication code is invalid, rejecting the AP to join the network.

The above aspects of the present disclosure provide enhanced neighbor authentication procedures in the network for authenticating the AP that is requesting to join the network. Therefore, the network may be managed in a safe and reliable way, and thus the security level of the network may be improved.

DETAILED DESCRIPTION

In a network infrastructure, there may be multiple APs such as a router, a switch, a Wi-Fi hotspot device and the like. Here, the Wi-Fi hotspot device may provide a Wi-Fi hotspot for terminal devices such as a notebook, a cellphone and the like. After connected to the AP, the terminal devices may access resources in the network via the AP. Due to an area limitation of the AP, more APs may be added into the network to cover more area and provide more bandwidth to the terminal devices.

Reference will be made toFIG.1for a working environment of the network.FIG.1illustrates an example environment100in which embodiments of the present disclosure may be implemented. InFIG.1, a network110may include multiple devices: a controller120for controlling operations of the network110and multiple APs for providing access services in the network110. For example, the AP may include an AP130-1with a router type, an AP130-2with a Wi-Fi hotspot type, and an AP130-3with a switch type. Further, terminal devices such as a notebook140-1, . . . , and a cellphone140-2may connect to the AP130-2for accessing resources in the network110.

In order to improve performance of the network110, more APs may be added into the network110. Usually, if an AP (such as a Wi-Fi hotspot device) requests to join the network110, the AP should be authenticated by the controller120of the network110first. According to one authentication solution, a certification may be stored in the AP, and the controller120may authenticate the AP based on the certification. If the certification is a valid one, the AP may be accepted to join the network; otherwise the AP may be rejected. Here, the controller120works as the only authentication device for accepting/rejecting the AP. However, the AP itself or the certification in the AP may be attacked, for example, the certification in the AP may be stolen. Then, a malicious AP may pretend as a normal AP and join the network110with the stolen certification, and thus the network110may become weak and vulnerable. Therefore, how to provide an enhanced authentication procedure becomes a focus.

In view of the above drawbacks, embodiments of the present disclosure provide a more effective way for authenticating an AP to join the network. Specifically, after a normal authentication procedure by the controller120, the AP is subjected to a neighbor authentication procedure by a neighbor AP that is connected in the network. Reference will be made toFIG.2for a brief description of the neighbor authentication procedure.FIG.2illustrates a block diagram of an example procedure200for authenticating an AP to join a network based on a neighbor AP in the network according to embodiments of the present disclosure.

As illustrated inFIG.2, an AP210may request to join the network110. If a certification in the AP210is verified by the controller120, the controller120may trigger the neighbor authentication procedure by a neighbor AP (such as the AP130-1). The controller120may send a neighbor authentication command to the neighbor AP130-1for generating an authentication code. Further, the controller120may instruct the AP210to obtain the authentication code generated by the neighbor AP and to send the obtained authentication code to the controller120. If the authentication code is determined as valid by the controller120, the AP210is allowed to join the network110; otherwise the AP210is rejected.

With the above embodiment, after the normal authentication procedure by the controller210, the neighbor AP130-1may provide a second authentication procedure to the AP210. Therefore, the security level of the network110may be increased effectively. AlthoughFIG.2illustrates that the AP130-1is selected as the neighbor AP, in other embodiments, another AP may be selected from the APs130-1, . . . , and130-3. Alternatively, more than one neighbor AP may be selected for provide multiple neighbor authentication procedures.

Hereinafter, reference will be made toFIG.3for more details about the authentication procedure among the AP210, the controller120and a neighbor AP340.FIG.3illustrates a signaling chart300of an example procedure for authenticating an AP to join a network based on a neighbor AP in the network according to embodiments of the present disclosure. InFIG.3, the authentication procedure relates to three devices: the AP210that requests to join the network110, the controller120of the network110, and the neighbor AP340connected in the network110.

The signaling chart300illustrates interactions among the AP210, the controller120and the neighbor AP340. Once the AP210is connected in the network110, the AP210may request310the controller120for an authentication. Here, the requesting step may be implemented in a similar manner as normal. The controller120may authenticate312the AP210in a normal way. For example, the AP210may pass the normal authentication if the certification in the AP210is valid. Then, the neighbor authentication may start.

In some embodiments, the neighbor AP340may be a predefined AP that has already been connected in the network110. Alternatively, the neighbor AP340may be selected by the controller120based on states of APs that are connected in the network110. Specifically, the controller120may select the neighbor AP340based on scanning history and/or a deployment map of the network110, such that a reliable and effective AP may be specified as the neighbor AP340.

In some embodiments, the controller120may obtain states of a plurality of APs that are connected in the network110. Reference will be made toFIG.4for details about the neighbor state, whereFIG.4illustrates a block diagram of an example data structure400of a neighbor state according to embodiments of the present disclosure. InFIG.4, the neighbor state may include a location412of the AP. Usually, the network110may cover a wide geography area, and locations of APs connected in the network110may be recorded in the network deployment map for network management. With the location412of the AP, the controller120may select an AP with a location near the AP210as the neighbor AP340. Usually, the AP210is scheduled to be deployed at a predefined deploy location, and then an AP having the shortest distant from the predefined location may be selected as the neighbor AP. Alternatively, the neighbor AP340may be selected based on a distance between the real location of the AP210and the location412. In this manner, the AP210and the neighbor AP340may communicate in an effective and easy way, for example, by the wireless communication.

In some embodiments, the neighbor state410may include an online time duration414of the AP. Here, the online time duration414refers to a time length since the AP has join in the network110, and the time length may be reset to zero if the AP is offline. The online time durations of APs in the network110may be recorded in a data log of the network110. Usually, the longer the online time duration414is, the more reliable the AP is. Therefore, the controller120may select an AP with a longer online time duration. Preferably, an AP having the longest online time duration may be selected as the neighbor AP340. In this manner, it may be ensured that the neighbor AP340is reliable and trustable, and then the neighbor authentication may be implemented in a safe and reliable way.

In some embodiments, the neighbor state410may include the previous authentication416of the AP. Here, the previous authentication416refers to the authentication(s) that the AP has passed previously. For example, when the first AP joined the network110at an initial stage of the network110, no neighbor AP exists in the network110and then the first AP may be authenticated by the normal authentication only. At this point, the previous authentication416may be set to “normal authentication.” In another example, the second AP that requested to join the network110may be authenticated by both of the normal and neighbor authentications, and thus the previous authentication416for the second AP may be set to “normal and neighbor authentications.”

Compared with the first AP that passed only the normal authentication, the second AP that passed both of the normal and neighbor authentications is more reliable and trustable. Therefore, the second AP may work as the neighbor AP to improve the security level of the neighbor authentication. In some embodiments, an AP with more previous authentications may be selected as the neighbor AR. In this manner, it may be ensured that the neighbor AP340is reliable and may be trusted, such that the neighbor authentication may be implemented in a safe and reliable way.

In some embodiments, the neighbor state410may include a health state418of the AP. Here, the health state418refers to an overall performance of the AP including any of a CPU workload, a memory workload, an available bandwidth, a response time, and the like. Usually, an AP with a better performance may quickly implement the neighbor authentication with less time delay, and then the controller120may select an AP with a better health state as the neighbor AP340. In this manner, it may be ensured that the neighbor AP340is in quick response, and then the neighbor authentication may be implemented in an effective and fast way.

In some embodiments, a neighbor infrastructure device such as a router device or a switch device may be selected for generating the authentication code. Therefore, the neighbor state410may include a device type420of the AP. Here, the device type420refers to a type of the AP including: a router device, a switch device, a Wi-Fi hotspot device, and the like. Usually, the router device and the switch device are deployed via wired connections in a data center of the network110, and thus the security level for these devices is higher. Therefore, an AP with the router or switch type may implement the neighbor authentication with a higher security and reliability level, and then the controller120may select these types of APs as the neighbor AP340. In this manner, it may be ensured that the neighbor AP340itself is trustable, and then the neighbor authentication implemented by the trustable neighbor AP340is also reliable.

In some embodiments, the above aspects of the neighbor state410may be combined for selecting the neighbor AP340. Specifically, weights may be assigned to aspects of the neighbor state410, and then a score may be determined for each AP in the networks110. Further, one or more neighbor APs may be selected from these APs for providing the neighbor authentication.

In some embodiments, an administrator of the network110may decide whether the neighbor authentication is enabled of not. For example, at the initial stage for building the network110, no AP is connected in the network110. When a new AP request to join the network110, the new AP is usually deployed in the data center of the network110or another place with a high security level. At this point, the normal authentication procedure may provide sufficient protections and thus the neighbor authentication may be disabled. With the expansion of the network110, more and more APs may be deployed at various locations with lower security levels, and then the neighbor authentication may be enabled for providing authentication enhancement.

As the AP210has pass the normal authentication, the AP210is considered to be trustworthy to a certain extent, and thus communication channels may be built among the AP210, the controller120and the neighbor AP340. Here, the communication channels may be based on a wired mode or a wired mode, and data may be transmitted on the communication channels in a secure way. For example, encryption operations may be implemented for the data communication.

The above paragraphs have described details for selecting the neighbor AP340, hereinafter reference will be made back toFIG.3for further steps after the selection of neighbor AP340. The controller120may send314a neighbor authentication command to the neighbor AP340. Here, the neighbor authentication command may be send in a secure way to instruct the neighbor AP340to generate an authentication code. Hereinafter, reference will be made toFIG.5for more details about the neighbor authentication command, whereFIG.5illustrates a block diagram of an example data structure500of a neighbor authentication command according to embodiments of the present disclosure.

InFIG.5, the neighbor authentication command510may comprise a target AP512for which the authentication code is generated. In other words, the neighbor authentication command510may include an identification of the AP210and inform the neighbor340to generate an authentication code for the AP210. With these embodiments, the neighbor AP340may generate the authentication code only for the AP210that has passed the normal authentication by the controller120.

In some embodiments, the neighbor authentication command510may include an algorithm514based on which the authentication code may be generated. Here, the authentication code may be in a form of OTP (one time password), and thus the algorithm514may include various algorithms for generating a dynamic password. For example, the algorithm514may be implemented based on a symmetric encryption algorithm, a HMAC (Hash-based Message Authentication Code), and the like. Further, the neighbor authentication command510may include a seed518for generating the authentication code with the algorithm514. With these embodiments, the neighbor AP340may generate the authentication code in a safe and effective way.

In some embodiments, the neighbor authentication command510may further comprise an expiration time duration for indicating a validity of the authentication code. For example, the expiration time duration may be set to one minute (or another value), once the expiration time duration is reached, the neighbor AP340may refresh the authentication code. With these embodiments, the OTP authentication code may enhance the security level of the neighbor authentication and then improve the overall security level of the network110.

AlthoughFIG.3illustrates that the controller120sends the neighbor authentication command for notifying the neighbor AP340, this step may be omitted if the neighbor AP340is a predetermined AP for generating the authentication code. For example, the neighbor AP340is configured to directly generate the authentication code based on a predetermined algorithm and seed in response to a request from the AP210.

Referring back toFIG.3, the controller120may send316a neighbor authentication notification to the AP210. Here, the neighbor authentication notification may instruct the AP210to obtain the authentication code from the neighbor AP340. AlthoughFIG.3illustrates that the controller120sends the neighbor authentication command and the neighbor authentication notification in a sequence manner, the controller120may implement the above sending steps in a different order or concurrently.

The AP210may request318the authentication code from the neighbor AP340, and then the neighbor AP340may generate320the authentication code based on the algorithm514and the seed516in the neighbor authentication command510. For example, the neighbor AP340may generate the authentication code based on the HMAC algorithm and the specified seed. AlthoughFIG.3illustrates that the controller120receives the request from the AP210and then generates the authentication code in a sequence manner, the controller120may generate the authentication code before receiving the request or at the time point when receiving the request. Afterwards, the neighbor AP340may return322the authentication code to the AP210.

The AP210may send324the received authentication code to the controller120for the neighbor authentication, and the controller120may implement326the neighbor authenticating to verify the authentication code received from the AP210. Specifically, the controller120may generate a local authentication code based on the algorithm514and the seed516shared with the neighbor AP340. Further, if the authentication code received from the AP210matches the local authentication code, the AP210may be accepted to join the network110; otherwise the AP210may be rejected. Next, the controller120may accept/reject328the AP210based on the above result of the neighbor authentication.

In some embodiments, the authentication code may have a timestamp for indicating a time point when the authentication code is generated by the neighbor AP340. If the timestamp is within the expiration time duration for the authentication code, the AP210may be accepted; otherwise the AP210may be rejected. In some embodiments, based on the expiration time duration, the neighbor AP340may periodically refresh the authentication code to a new version and then return the new version to the AP210. Further, the AP210may send the new version and request the controller120to implement the authentication based on the new version.

The above paragraphs have provided details about the enhanced authentication by one neighbor AP. In some embodiments, the AP210may be authenticated by more than one neighbor AP340. Specifically, the controller120may request the AP210to obtain authentication codes from more than one neighbor AP. At this point, the controller120may transmit to the AP210a further neighbor authentication notification for obtaining a further authentication code from a further neighbor AP (for example, the AP130-3inFIG.1) that is different from the previous neighbor AP. The controller120may receive from the AP210the further authentication code generated by AP130-3. If the authentication codes from all neighbor APs are valid, the AP210is allowed to join the network220; otherwise, if any authentication code is invalid, the AP210is rejected.

The above embodiments may provide an enhanced authentication procedure and may detect abnormal situations of the AP. In one example, if an AP that has already connected in the network110is stolen by an attacker for analyzing at the attacker's office. The attacker may try to connect the AP back to the network110from the office. At this point, even if the AP is connected to the network110, as the AP is far from its predefined deploy location, the AP cannot fetch the authentication code from the neighbor AP specified by the controller120according to the location. At this point, the AP cannot join the network110and thus the stolen AP may be detected.

In some embodiments, the neighbor selection is flexible and may be based on many factors such as a location, an online time duration, a previous authentication, a health state, and a device type of the plurality of APs in the network110. If more APs are stolen, the neighborhood of the above stolen AP may change greatly. For example, the online time duration of the stolen APs may change and thus the stolen APs may be excluded from candidate neighbor APs. At this point, a fixed AP such as a switch or a router in the data center may be selected as the neighbor AP. In a special situation where only two APs are connected in the network110and both of them are stolen, the neighbor authentication procedure may be disabled until at least one reliable AP is connected in the network110.

The above embodiments are especially useful for a network including a great number of APs. The number of AP may gradually grow as time goes, at the very beginning stage, the neighbor authentication may be disabled as there is no online AP in the network. During the expansion stage of the network, more APs may be powered on and request to join the network. At this point, the normal authentication procedures may be implemented for those APs, and the neighbor authentication procedures may be delayed until a reliable AP is specified as the neighbor AP.

With the above embodiments, the controller120may select one or more neighbor APs for generating authentication codes. Further, the controller120may verify validities of these authentication codes and decide whether to accept the AP requesting to join. Although the neighbor APs may be distributed in the network110, the controller120may provide a centralized solution for managing the neighbor APs and achieving enhanced authentications, such that the network110may be managed in an effective and easy way.

The above embodiments may provide protections to the network110even if certifications in the APs are attacked. Some types of APs have TPM (Trusted Platform Module) storage for storing the certification, while some types of cheap APs do not have TPM storage and thus the certification is stored in the normal flash storage. At this point, the certification in the flash storage tends to be attacked. If the attacker copies the certification from an AP to a malicious AP for replacing the original one, then the malicious AP will pass the normal authentication because the copied certification is real and valid. With the embodiments, the malicious AP should go through another round of neighbor authentication. As the neighbor AP is instructed to generate the authentication code only for the predefined target AP, the malicious AP cannot pass the neighbor authentication and thus the network110may be protected from attacks from the malicious AP.

Further, the above embodiments may also provide enhanced protections to the IoT (Internet of Thins) network. Due to cost and power constrains, most of APs in IoT are not equipped with TPM storages. Therefore, the neighbor authentication procedure may protect the safety of the IoT by the authentication code. Specifically, the neighbor AP is instructed to generate authentication codes for certain APs, even if a malicious AP has a correct certification, it cannot pass the neighbor authentication. Accordingly, the security level of the IoT may be greatly increased by adjusting software configurations in a controller of the IoT and existing APs in the IoT, without a need to deploy new hardware in the IoT.

Having described communications between the AP210, the controller120and the neighbor AP340, hereinafter, reference will be made toFIG.6for steps implemented at the controller120.FIG.6illustrates a flowchart of an example method600for authenticating an AP at a controller in a network according to embodiments of the present disclosure. In some embodiments, the method600is implemented at a controller120of the network110, and the neighbor AP340comprises any of a router device, a switch device and a Wi-Fi hotspot device.

As illustrated inFIG.6, at block610, a request for joining a network is received from an AP. At block620, in accordance with a determination that the AP is verified, a neighbor authentication notification is transmitted to the AP for instructing the AP to obtain an authentication code from a neighbor AP that is connected in the network. In some embodiments, the neighbor AP may be specified in advance. Alternatively and/or in addition to, the neighbor AP may be selected by the controller. Specifically, states of a plurality of APs that are connected in the network are obtained. Here, a state in the states comprises any of: a location, an online time duration, a previous authentication, a health state, and a device type for an AP in the plurality of APs. Then, the neighbor AP is selected based on the states of the plurality of APs.

In some embodiments, a neighbor authentication command is transmitted to the neighbor AP for generating the authentication code by the neighbor AP. In these embodiments, the neighbor authentication command comprises: a target AP for which the authentication code is generated, an algorithm with which the authentication code is generated, and a seed for generating the authentication code with the algorithm. In some embodiments, the neighbor authentication command further comprises: an expiration time duration for instructing the neighbor AP to refresh the authentication code.

At a block630, the authentication code that is generated by the neighbor AP is received from the AP. Here, the authentication code may be verified to determine whether the AP is accepted to join the network. In some embodiments, at a block640, the AP is accepted to join the network in accordance with a determination that the authentication code is valid. Specifically, a local authentication code is generated based on the algorithm and the seed, and then the authentication code is compared with the local authentication code. The AP is accepted to join the network in accordance with a determination that the authentication code matches the local authentication code. In some embodiments, the AP is rejected to join the network in accordance with a determination that the authentication code is invalid. In other words, if the authentication code does not match the local authentication code, then the AP is rejected.

In some embodiments, the authentication code has a timestamp, and the AP is accepted to join the network in accordance with a determination that a timestamp of the authentication code is within an expiration time duration for the authentication code. In some embodiments, the AP is rejected if the timestamp exceeds the expiration time duration. In some embodiments, the method600may be implemented for multiple times and more neighbor APs may be selected for further neighbor authentication procedures. In some embodiments, a further neighbor authentication notification is transmitted to the AP for obtaining a further authentication code from a further neighbor AP that is connected in the network. The further authentication code generated by the further neighbor AP is received from the AP. The AP is accepted to join the network in accordance with a determination that the further authentication code is valid.

With these embodiments, the method600provides an enhanced authentication solution. Besides the normal authentication by the controller120, the controller120selects a neighbor AP340for generating an authentication code. The AP210may be further authenticated based the authentication code, therefore the security level of the network110may be increased.

FIG.7illustrates a block diagram700of an example controller in a network according to embodiments of the present disclosure. The controller120comprises a processor710and a memory720coupled to the processor710. The memory720stores instructions722,724,726, and728to cause the processor710to implement a method for authenticating an AP.

As illustrated inFIG.7, the memory720stores the instruction722to receive, from an AP, a request for joining the network. The memory720further stores the instruction724to, in accordance with a determination that the AP is verified, transmit to the AP a neighbor authentication notification for obtaining at least one authentication code from at least one neighbor AP that is connected in the network. In some embodiments, the memory720further stores the instruction to obtain states of a plurality of APs that are connected in the network, a state in the states comprising any of: a location, an online time duration, a previous authentication, a health state, and a device type for an AP in the plurality of APs. In some embodiments, the memory720further stores the instruction to select the at least one neighbor AP based on the states of the plurality of APs.

In some embodiments, the memory720further stores instruction to transmit to the at least one neighbor AP at least one neighbor authentication command for generating the at least one authentication code at the at least one neighbor AP. Here, a neighbor authentication command in the at least one neighbor authentication command comprises a target AP for which an authentication code in the at least one authentication code is generated, an algorithm with which the authentication code is generated, and a seed for generating the authentication code.

In some embodiments, the memory720further stores the instruction726to receive, from the AP, the at least one authentication code that is generated by the at least one neighbor AP. The memory720further stores the instruction728to reject the AP to join the network in accordance with a determination that any of the at least one authentication code is invalid. In some embodiments, the memory720further stores the instruction to generate a local authentication code based on the algorithm and the seed comprised in the neighbor authentication command. In some embodiments, the memory720further stores the instruction to reject the AP to join the network in accordance with a determination that an authentication code associated with the neighbor authentication command does not match the local authentication code. In some embodiments, the memory720further stores the instruction to reject the AP to join the network in accordance with a determination that a timestamp of the authentication code exceeds an expiration time duration specified by the neighbor authentication command. In some embodiments, the memory720further stores the instruction to accept the AP to join the network in accordance with a determination that all of the at least one authentication code is valid.

With these embodiments, besides the controller120, the neighbor AP340may works as a second authentication device in the network for providing a second authentication procedure. Based on the authentication code generated by the neighbor AP340, the AP210needs to pass the neighbor authentication before joining the network110, and thus the security level of the network110may be improved.

FIG.8illustrates a flowchart of an example method800for authenticating an AP at a neighbor AP in a network according to embodiments of the present disclosure. The method800may be implemented at a neighbor AP that is connected in the network. Here, the neighbor AP comprises any of a router device, a switch device and a Wi-Fi hotspot device. At a block810, a neighbor authentication command is received from a controller in a network for generating an authentication code for a target AP, the target AP being verified by the controller to join the network. In some embodiments, the neighbor authentication command comprises an algorithm with which the authentication code is generated, and a seed for generating the authentication code with the algorithm. In some embodiments, generating the authentication code comprises: generating the authentication code based on the algorithm and the seed. In some embodiments, the neighbor authentication command further comprises an expiration time duration, and generating the authentication code further comprises: refreshing the authentication code based on the expiration time duration. At a block820, a request is received from an AP for obtaining an authentication code. At a block830, the authentication code is generated based on the neighbor authentication command. In some embodiments, a timestamp is added to the authentication code based on a time point when the authentication code is generated. At a block840, the authentication code is transmitted to the AP in accordance with a determination that the AP matches the target AP.

With these embodiments, besides the normal authentication by the controller120, the neighbor AP340may provide a second authentication procedure. Based on the authentication code generated by the neighbor AP340, the AP210needs to pass the neighbor authentication before joining the network110, and thus the security level of the network110may be improved.

FIG.9illustrates a block diagram900of an example neighbor AP according to embodiments of the present disclosure. The controller120comprises a processor910and a memory920coupled to the processor910. The memory920stores instructions922,924,926, and928to cause the processor910to implement a method for authenticating an AP.

As illustrated inFIG.9, the memory920stores the instruction922to receive, from a controller in a network, a neighbor authentication command for generating an authentication code for a target AP, the target AP being verified by the controller to join the network. In some embodiments, the memory920further stores the instruction924to receive, from an AP, a request for obtaining an authentication code. In some embodiments, the neighbor authentication command comprises an algorithm with which the authentication code is generated, and a seed for generating the authentication code with the algorithm, and generating the authentication code comprises: generating the authentication code based on the algorithm and the seed. In some embodiments, the memory920further stores the instruction926to generate the authentication code based on the neighbor authentication command in accordance with a determination that the AP matches the target AP. In some embodiments, the memory920further stores the instruction to add a timestamp to the authentication code based on a time point when the authentication code is generated. In some embodiments, the neighbor authentication command further comprises an expiration time duration. In some embodiments, the memory920further stores the instruction to generate the authentication code further comprises: refreshing the authentication code based on the expiration time duration. In some embodiments, the memory920further stores the instruction928to transmit to the AP the authentication code. With these embodiments, besides the controller120, the neighbor AP may works as a second authentication device in the network110, and the security level of the network may be improved.

Further, while operations are depicted in a particular order, this should not be understood as requiring that such operations be performed in the particular order shown or in sequential order, or that all illustrated operations be performed, to achieve desirable results. In certain circumstances, multitasking and parallel processing may be advantageous. Certain features that are described in the context of separate embodiments may also be implemented in combination in a single embodiment. Conversely, various features that are described in the context of a single embodiment may also be implemented in multiple embodiments separately or in any suitable sub-combination.