Patent ID: 12231888

DESCRIPTION

To make the objectives, technical solutions, and advantages of the disclosure clearer, the following describes one or more embodiments in detail with reference to the accompanying drawings. It is to be understood that the specific embodiments described herein are only used to describe example embodiments, and should not be construed as limiting the one or more embodiments of the disclosure.

In a related art, a guest terminal may establish a wireless network connection by using an application program. Using a Wi-Fi connection program as an example, the Wi-Fi connection program is a program used for connecting a password-type Wi-Fi hotspot. The Wi-Fi connection program obtains a Wi-Fi password by using a network, and fills a connection password field with the Wi-Fi password to connect to a wireless network.

FIG.1is a flowchart of implementing a wireless network connection method by a Wi-Fi connection program in a related art. The method includes the following steps:

Step101: Query a Wi-Fi password.

When a Wi-Fi module in an operating system (OS) of a guest terminal obtains a connectable Wi-Fi hotspot, a Wi-Fi connection program in the guest terminal transmits a Wi-Fi password query request to a network, to request the network to transmit a connection password of the Wi-Fi hotspot. The Wi-Fi password request carries a user account of the guest terminal and a Service Set Identifier (SSID) and a Basic Service Set Identifier (BSSID) of a router.

Step102: Return an encrypted Wi-Fi password.

After receiving the Wi-Fi password query request transmitted by the Wi-Fi connection program, the network transmits a Wi-Fi password corresponding to a Wi-Fi hotspot scanned by the guest terminal to the Wi-Fi connection program, and the network encrypts the returned Wi-Fi password.

Step103: Fill in the unencrypted Wi-Fi password.

The Wi-Fi connection program decrypts the received Wi-Fi password, and stores the decrypted Wi-Fi password in the operating system of the guest terminal. In addition, the guest terminal fills a connection password field with the decrypted Wi-Fi password.

Step104: Connect to the Wi-Fi hotspot.

After filling the connection password field with the Wi-Fi password, the operating system of the guest terminal connects to the Wi-Fi hotspot. The Wi-Fi hotspot is a hotspot provided by the router.

Step105: Connection to the Wi-Fi hotspot between the wireless access network and the guest terminal OS.

The router verifies that the Wi-Fi password filled in by the guest terminal has access permission and allows the guest terminal to access the Wi-Fi hotspot. The router transmits Wi-Fi connection success information to the operating system of the guest terminal.

Step106: Connection to the Wi-Fi hotspot between the guest terminal OS and the Wi-Fi connection program.

The operating system of the guest terminal receives the Wi-Fi connection success information, and the Wi-Fi connection program obtains the Wi-Fi connection success information from the operating system of the guest terminal.

In the foregoing process, the Wi-Fi password transmitted by the network is decrypted by the Wi-Fi connection program and then stored in the operating system of the guest terminal. Consequently, there is a risk that the Wi-Fi password is shared indirectly without authorization after being read by a third-party application program. For example, a hotspot owner may inform a guest the Wi-Fi password, and the guest may inform a third person unauthorized by the hotspot owner the Wi-Fi password. Alternatively, the Wi-Fi password is shared on the network by password sharing software installed on the guest terminal.

Embodiments of the disclosure provide a wireless network access method, apparatus, device, and system, to resolve the problem in the foregoing related art by improving security measures of the Wi-Fi connection.

FIG.2is a diagram of a wireless network access system according to an embodiment. The wireless network access system includes a wireless access point220, a first guest terminal241, a second guest terminal242, a server260, and an authorizer terminal280.

The wireless access point220may be a general term for devices providing a wireless network access service, for example, a router, a Wi-Fi hotspot, and a wireless gateway. In this embodiment, for example, the wireless access point220is a wireless router, that is, the wireless router220provides a wireless network access service. The wireless access point220is controlled by the authorizer terminal280. The wireless access point220is connected to the authorizer terminal280by using a wireless network, the wireless access point220is connected to the first guest terminal241and the second guest terminal242by using a wireless network, and the wireless access point220is connected to the server260by using a wired network.

In addition, the wireless access point220is connected to the first guest terminal241and the second guest terminal242by using a Wi-Fi network.

The authorizer terminal280is a terminal corresponding to first identification information of the wireless access point220, that is, a person (e.g., an authorizer) possessing the authorizer terminal280is an owner of the wireless access point220. The authorizer terminal280is configured to authorize the first guest terminal241or the second guest terminal242that requests to access a wireless network, so as to allow the first guest terminal241and/or the second guest terminal242to access a Wi-Fi hotspot. The authorizer terminal280runs a second application program. The authorizer terminal280is connected to the server260by using a wireless network.

The first guest terminal241and the second guest terminal242each may be a mobile phone, a tablet computer, an e-book reader, a laptop, a desktop computer, or the like. The first guest terminal240is connected to the server260by using a wireless network, and the second guest terminal242is connected to the server260by using a wireless network.

The first guest terminal241may be connected to the server260by using a mobile communications network, the second guest terminal242may be connected to the server260by using a mobile communications network, and the mobile communications network includes a 4G network or a 5G network.

Both the first guest terminal241and the second guest terminal242may be installed with a first application program used for connecting to a Wi-Fi hotspot, for example, QQ and WeChat. For example, whileFIG.2only shows two guest terminals, in an actual use scenario, a quantity of guest terminals is not limited thereto, and there may be one or more guest terminals. This embodiment sets no limitation on the quantity of guest terminals.

The server260stores an authorization library, and the authorization library stores a correspondence among first identification information of a wireless access point, a user account and a Media Access Control (MAC) address that are authorized by the authorizer terminal. The server260is configured to verify, according to information stored in the authorization library, a guest terminal that requests to access a Wi-Fi hotspot. The server260may be one server, a server cluster formed by multiple servers, or a cloud computing center.

The authorizer terminal280may replace the server260, that is, the authorizer terminal280implements a function implemented by the server260, or the server260is integrated in the authorizer terminal280. Therefore, the authorizer terminal280may store an authorization library, and the authorization library stores the correspondence among first identification information of a wireless access point, a user account and a MAC address that are authorized by the authorizer terminal. The authorizer terminal280is configured to verify, according to the information stored in the authorization library, a guest terminal that requests to access a Wi-Fi hotspot.

In an embodiment, a first terminal21may be any one of the first guest terminal241, the second guest terminal242, and the authorizer terminal280, and the first terminal21includes an application program211and an operating system212.

The application program211may be any one of the first application program and the second application program. When the first terminal21is the first guest terminal241or the second guest terminal242, the application program211is used for performing an operation of accessing a wireless network. When the first terminal21is the guest terminal280, the application program211is used for performing an operation of authorizing a guest terminal to access a wireless network.

The operating system212is used for providing storage space and user account security measures for running the application program211.

In an embodiment, a second terminal23may be any one of the first guest terminal241and the second guest terminal242, the second terminal23includes a parent application program231and an operating system232, and the parent application program231includes a sub-application program2311.

The parent application program231is an application program used for carrying the sub-application program2311, and provides an environment for implementing the sub-application program. The parent application231is a native application. The native application is an application that may be directly run on the OS. The parent application program231may be a social application program, a dedicated application program specially supporting the sub-application program, a file management application program, an email application program, a game application program, or the like. The social application includes an instant messaging application, a social network service (SNS), a live broadcast application, or the like.

The sub-application program2311is an application program that depends on the parent application program231to run. The child application2311may be specifically a social application, a file management application, a mail application, a game application, or the like. The sub-application program may be referred to as a mini program. A user may directly open the sub-application program2311by scanning a two-dimensional code corresponding to the sub-application program2311or searching for a name of the sub-application program2311. The sub-application program2311may be conveniently obtained and propagated in the parent application program231.

The operating system232is used for providing storage space and user account security measures for running the parent application program231and the sub-application program2311.

In the implementation environment shown inFIG.2, and referring toFIG.3, for example, a wireless network is a Wi-Fi hotspot, and a server may be a cloud server or a plurality of servers in a cluster providing a cloud service. A first application program running on a guest terminal is an APP/mini program. An operating system of the guest terminal is used for obtaining, by using a Wi-Fi module, a Wi-Fi hotspot distributed around the guest terminal. The first application program is used for obtaining, by using an application programming interface (API), the Wi-Fi hotspot and first identification information of a wireless access point that are obtained by the Wi-Fi module in the operating system of the guest terminal, and fill a connection password field of the Wi-Fi hotspot with a dynamic key by using the API.

The guest terminal is configured to transmit a request for accessing the Wi-Fi hotspot to the wireless access point. After filling the connection password field with the dynamic key, the operating system of the guest terminal establishes a connection to the wireless access point according to Wi-Fi Protected Access (WPA) 2. The wireless access point and the cloud service verify, according to the Hyper Text Transfer Protocol over Secure Socket Layer (HTTPS), whether the guest terminal has connection permission. If the guest terminal has the connection permission, the guest terminal is allowed to access the Wi-Fi hotspot. If the guest terminal does not have the connection permission, the guest terminal is not allowed to access the Wi-Fi hotspot.

In the implementation environment of the wireless access point system shown inFIG.2toFIG.4, the one or more embodiments show a secure connection product architecture based on the wireless access point system and provided based on the implementation environment. The secure connection product architecture includes a Wi-Fi connection program and a secure router. The secure router is a router that supports a secure connection technology, the Wi-Fi connection program is a first application program, the Wi-Fi connection program is a mini program that depends on an instant messaging program (such as WeChat) to run, and the router is a wireless access point.

A guest terminal requests to connect to the secure router by using the Wi-Fi connection program, and the Wi-Fi connection program verifies, at a server (not shown in the figure) corresponding to the instant messaging program and a server (not shown in the figure) corresponding to the Wi-Fi connection program, whether the guest terminal has connection permission by using a secure router. If the guest does not have the connection permission, the guest needs to query, by using the Wi-Fi connection program, an authorizer requesting to authorize the guest to connect to the secure router. After the authorizer agrees to authorize the guest, the guest can connect to the secure router, and after the guest successfully connects to the secure router, the secure connection product transmits a connection notification of the guest to the authorizer. If the guest has the connection permission, the secure connection product transmits the connection notification of the guest to the authorizer.

A scenario in which the secure connection product architecture shown inFIG.4is used includes: a house, an office, a public place, and the like. In addition, the Wi-Fi connection program in the secure connection product architecture may be capable of obtaining identification of a securely controlled hotspot, an access request/authorization, hotspot configuration management, hotspot sharing and propagation, hotspot marketing, and the like.

FIG.5is a flowchart of a wireless network access method according to an embodiment. The method may be applied to the implementation environment shown inFIG.2and/orFIG.3. The method may alternatively be applied to the secure connection product architecture shown inFIG.4. The method includes the following steps:

Step501: A first application program obtains identification information of at least one wireless access point around a guest terminal.

The first application program runs on the guest terminal, and the first application program includes an application program used for connecting to a wireless network.

The first application program obtains, by using a wireless network module in an operating system of the guest terminal, identification information of at least one wireless access point around the guest terminal. The wireless access point is a device that provides a wireless network service, and the identification information of the wireless access point includes a service set identifier (SSID) and a basic service set identifier (BSSID).

The first application program further obtains a user account, and the user account is an account that a guest logs in to on the first application program.

Step502: The first application program transmits the user account and the identification information of the wireless access point to a server.

The first application program transmits the obtained user account and identification information of the wireless access point to the server.

The identification information of the wireless access point includes first identification information and second identification information. The first identification information includes an SSID and a BSSID, and the first identification information is identification information corresponding to a secure wireless network. The second identification information includes an SSID and a BSSID, and the second identification information is identification information corresponding to a common wireless network.

Step503: The server receives the user account and the identification information of the wireless access point that are transmitted by the guest terminal.

The server receives the user account, the SSID, and the BSSID that are transmitted by the guest terminal.

Step504: The server generates a dynamic key key1according to the user account and the first identification information, and transmits the dynamic key key1to the guest terminal.

The server generates the dynamic key key1according to the user account, the SSID, and the BSSID. Therefore, the dynamic key key1is generated by the server according to the user account of the guest terminal and the first identification information of the wireless access point. The server transmits the generated dynamic key key1to the guest terminal.

Step505: The first application program receives the dynamic key key1transmitted by the server.

After receiving the dynamic key key1, the first application program on the guest terminal fills a connection password field in a first access request with the dynamic key key1.

Step506: The first application program determines identification information that includes the dynamic key key1as the first identification information, and determines identification information that does not include the dynamic key key1as the second identification information.

Step507: The first application program displays a wireless network access interface.

The first application program displays the wireless network access interface according to the obtained first identification information and second identification information. The wireless network access interface includes a classified secure wireless network area and a common wireless network area. The secure wireless network area is used for displaying the first identification information and a first connection control, and the common wireless network area is used for displaying the second identification information and a second connection control. The first connection control is a connection control used for triggering connection to the secure wireless network. The second connection control is a connection control used for triggering connection to the common wireless network.

The wireless network access interface displays names of several wireless access points obtained by the guest terminal, and each name and an area in which each name is located include a connection control of a wireless access point. A connection control is used for generating a trigger signal according to a location triggered by a guest on the wireless network access interface. Therefore, the first connection control is used for generating a trigger signal based on the guest terminal triggering the secure wireless network in the secure wireless network area, and the second connection control is used for generating a trigger signal based on the guest terminal triggering the common wireless network in the common wireless network area.

The secure wireless network area is an area displayed on the wireless network access interface according to the dynamic key key1.

Step508: When receiving the trigger signal for the first connection control, the first application program generates a first message integrity check (MIC) according to the dynamic key key1and the first identification information.

The first application program determines, according to the trigger signal generated for the first connection control, a wireless access point to which the guest is connecting, and fills, with the dynamic key key1, a connection password field corresponding to the wireless access point to which the guest needs to connect. The first application program generates the first MIC according to the dynamic key key1and the first identification information. The dynamic key key1is used for filling the connection password field in the first access request. The first MIC is generated by the guest terminal according to the dynamic key key1and the first identification information.

Step509: The first application program transmits the first access request to the wireless access point, the first access request carrying the first MIC and a MAC address.

The first application program transmits the first access request to the wireless access point. The first access request includes a MAC packet, and the MAC packet includes a MAC header and a payload. The MAC header stores a real MAC address of the guest terminal, and the payload stores the first MIC generated by the guest terminal.

Step510: The wireless access point receives the first access request transmitted by the guest terminal.

The first access request includes the MAC address and the first MIC of the guest terminal, and the first MIC is generated by the guest terminal according to the dynamic key key1and the first identification information of the wireless access point.

Step511: The wireless access point transmits a first check request that includes the first MIC to the server.

The first check request includes a MAC packet, and the MAC packet includes a MAC header and a payload. The MAC header stores the real MAC address of the guest terminal, and the payload stores the first MIC generated by the guest terminal. The first check request further carries the first identification information of the wireless access point, and the first identification information of the wireless access point includes a serial number (Serial Number, SN), an SSID, and a BSSID.

Step512: The server receives the first check request transmitted by the wireless access point.

The first check request includes the MAC address of the guest terminal, the first identification information of the wireless access point, and the first MIC generated by the guest terminal.

Step513: The server verifies the first MIC according to the dynamic key key1found by using the MAC address, and generates a first authorization result according to a verification result of the first MIC.

The server stores an authorization library, and the authorization library is used for storing information corresponding to a guest terminal authorized by an authorizer terminal. The information includes a MAC address of the authorized guest terminal, a dynamic key key1corresponding to the guest terminal, and the first MIC.

The server extracts the MAC address in the first check request, queries, according to the MAC address, whether the MAC address is stored in the authorization library, and if the MAC address is stored, verifies the first MIC according to the dynamic key key1corresponding to the stored MAC address. The server generates the first authorization result according to the verification result of the first MIC. The first MIC is used for verifying information that is corresponding to the guest terminal and that is found by the server according to the MAC address.

The first authorization result may be “authorized” or “unauthorized”. The “Authorized” result is generated when the server successfully verifies the information, and the “unauthorized” result is generated when the server does not successfully verify the information.

Step514: The server transmits the first authorization result to the guest terminal by using the wireless access point.

The first authorization result is transmitted by the server to the wireless access point, and then the wireless access point transmits the first authorization result to the guest terminal.

Step515: Based on the first authorization result fed back by the server to the wireless access point, the wireless access point feeds back the first authorization result to the guest terminal.

Step516: The first application program receives the first authorization result transmitted by the wireless access point.

The first application program of the guest terminal receives the first authorization result, and determines whether the guest terminal is authorized by the authorizer terminal to connect to the wireless network.

Step517: When the first authorization result is “authorized”, the first application program displays a prompt text of the first authorization result on a wireless network connection interface.

The wireless network connection interface is used for displaying progress prompt information of a wireless network connection process, and the wireless network connection process is an authentication process performed based on the user account and the MAC address of the guest terminal, and the first identification information. The progress prompt information is used for prompting the progress of the wireless network connection process.

When the first authorization result is “authorized”, the wireless network connection process on the wireless network connection interface on the first application program is displayed to be gradually completed, and the first application program displays the prompt text of the first authorization result on the wireless network connection interface. The prompt text is used for prompting that the guest terminal is authenticated by the authorizer terminal.

Step518: The first application program displays a network connection result interface after the wireless network connection process is completed.

The network connection result interface is used for displaying a connection result of the wireless access point corresponding to the first identification information.

The first application program displays the network connection result interface according to a connection status of the guest terminal, and the network connection result interface displays the connection result of the wireless access point. The connection result includes connection success and connection failure.

According to the method provided in the one or more embodiments described above, the server authenticates, according to the user account and the MAC address of the guest terminal, and the first identification information of the wireless access point, the guest terminal that requests to access the wireless network. Even if information used by the guest terminal in the wireless network connection process is stolen by a third party terminal, because user accounts and/or MAC addresses of different terminals are different, the third party terminal cannot pass authentication at the server when attempting to establish a wireless network connection, thereby avoiding a risk that the wireless network is indirectly shared without authorization and improving the security of the wireless network.

FIG.6is a schematic diagram of a wireless network access interface according to an embodiment. A wireless network access interface600of the guest terminal is shown inFIG.6. The first application program displays, on the wireless network access interface600, names corresponding to one or more wireless networks obtained by the guest terminal. The wireless network access interface600includes a secure Wi-Fi area610and an unlocked Wi-Fi area620. The secure Wi-Fi area610is a secure wireless network area, and the unlocked Wi-Fi area620is a common wireless network area. Each name on the wireless network access interface and an area in which each name is located cover a connection control. Each name in the secure Wi-Fi area610covers the first connection control, and each name in the unlocked Wi-Fi area620covers the second connection control. For example, the secure connections A and B located in the secure Wi-Fi area610are controlled under the first connection control. The unlocked Wi-Fi connections C and D located in the unlocked Wi-Fi area620are controlled under the second connection control.

The secure Wi-Fi area610is used for displaying a name of a wireless access point that has been securely registered with the server, that is, a Wi-Fi name displayed in the secure Wi-Fi area610indicates a secure Wi-Fi hotspot (a bold rectangular block inFIG.6indicates a secure Wi-Fi hotspot). The unlocked Wi-Fi area620is used for displaying a name of a wireless access point that is not securely registered with the server, that is, a Wi-Fi name displayed in the unlocked Wi-Fi area620indicates a common Wi-Fi hotspot. Moreover, the secure Wi-Fi area610may be located above the unlocked Wi-Fi area620.

In addition, the secure Wi-Fi hotspot is identified by using a security identifier. The security identifier includes at least one of a text identifier612, an icon identifier611, a name of a highlighted secure Wi-Fi hotspot or an area in which a secure Wi-Fi hotspot is located, and a name of a secure Wi-Fi hotspot surrounded by a graphic frame or an area in which a secure Wi-Fi hotspot is located. For example, inFIG.6, the text identifier612and the icon identifier611are used. In addition, the common Wi-Fi hotspot also uses a text identifier622and an icon identifier621, but texts and icons of the two are different. The text identifier612of the secure Wi-Fi hotspot is “secure connection”, the icon identifier611includes a key pattern, the text identifier622of the common Wi-Fi hotspot is “recommended connection”, and the icon identifier621does not include a key pattern.

When receiving the trigger signal of the first connection control, the first application program displays the wireless network connection interface.

FIG.7is a schematic diagram of a wireless network connection interface according to an embodiment. Referring toFIG.7, a wireless network connection interface700displays progress prompt information710of a wireless network connection process. For example, the progress prompt information710shown inFIG.7includes connection authentication, connection establishment, IP address allocation, security detection, and network connection detection.

Connection authentication is used for prompting the first authorization result verified by the server. If the first authorization result is “authorized”, a connection authentication progress is completed, that is, the prompt text of the first authorization result is displayed on the wireless network connection interface700. Otherwise, the connection authentication progress is not completed. Connection establishment is used for prompting that the guest terminal is establishing a connection to the wireless access point. If the guest terminal establishes a connection to the wireless access point, a connection establishment progress is completed. Otherwise, the connection establishment progress is not completed. IP address allocation is used for prompting that the wireless connection point is allocating an IP address to the guest terminal. If the wireless access point has allocated an IP address to the guest terminal, an IP address allocation progress is completed. Otherwise, the IP address allocation progress is not completed. Security detection and network connection detection are used for prompting that a connection environment and signal quality of the wireless network are being detected. If detection is completed, security detection and network connection detection progresses are completed. Otherwise, the security detection and network connection detection progresses are not completed.

In addition, a change for prompting progress completion on the wireless network connection interface700includes at least one of dots changing to “√”, dots lightened one by one, and progress prompt information lightened one by one.

After receiving the first authorization result, the first application program displays the network connection result interface according to the first authorization result. The first authorization result includes “authorized” and “unauthorized”.

FIG.8is a schematic diagram of a network connection result interface according to an embodiment. In an embodiment, when the first authorization result is “authorized”, as shown inFIG.8, a connection result810of a wireless access point is displayed on a network connection result interface800, and the connection result810is displayed in at least one manner of text display and icon display. For example, a text is displayed as “Wi-Fi connected”, and an icon such as “√” may be displayed as shown inFIG.8. However, text and icon are not limited thereto, and may include any other forms to indicate that the Wi-Fi connection is established successfully. The network connection result interface800further displays a share Wi-Fi control820and a like control830. The share Wi-Fi control820is used by the guest terminal to share the wireless network with a third terminal other than the authorizer terminal and the guest terminal. The like control830is used by the guest terminal to like the authorizer terminal.

FIG.9is a schematic diagram of a network connection result interface according to another embodiment. In an embodiment, when the first authorization result is “unauthorized”, as shown inFIG.9, a connection result910of a wireless access point is displayed on a network connection result interface900, and the connection result910is displayed in at least one manner of text display and icon display. For example, a text is displayed as “connection request rejected”, and an icon is displayed as “x” inFIG.9. Also, the network connection result interface900may further display a continue connection control920. The continue connection control920is used by the guest terminal to continue to request authorization from the authorizer terminal to connect to the wireless access point.

In the embodiment shown inFIG.5, the authorizer terminal runs a second application program. When the first authorization result is “unauthorized”, the server transmits an authorization request to the authorizer terminal.

FIG.10is a schematic diagram of an authorization query interface according to an embodiment. As shown inFIG.10, the authorizer terminal displays an authorization query interface1000according to the authorization request. The authorization query interface1000includes an information area1010of the authorizer terminal, a list1020of network connection applications of users, and a connection record list1030of new users.

The information area1010of the authorizer terminal displays a name of a wireless network corresponding to the authorizer terminal and a share Wi-Fi control1011. The share Wi-Fi control1011is used for sharing a link to a wireless network with the guest terminal other than the authorizer terminal. In addition, the information area1010of the authorizer terminal further displays a connection password of the wireless network.

The list1020of network connection applications of users displays a name and a MAC address of a guest terminal that currently requests authorization from the authorizer terminal, and access authorized and unauthorized controls. For example, an agree to authorize control is “√”, and a disagree to authorize control is “x” inFIG.10. The connection record list1030of new users displays a name, a MAC address, and access time of an authorized guest terminal, and a control for rejecting continued access authorization. For example, the control for rejecting continued access authorization is “x” inFIG.10.

Both the authorizer terminal and the guest terminal are installed with the same application program, and the application program includes a social application program, a dedicated application program that specially supports a sub-application program, a file management application program, an email application program, a game application program, or the like. The social application program includes an instant messaging application, an SNS application, a live application, or the like. Furthermore, when the same parent application program is installed on both the authorizer terminal and the guest terminal, the parent application program is a social application program and supports running of a sub-application program.

After the authorizer terminal authorizes the guest terminal that requests to access the wireless network, the authorizer terminal receives a first access notification transmitted by the server. The parent application program establishes an association relationship with the second application program, that is, the first access notification is not only displayed in the second application program, but also displayed in the parent application program. As shown inFIG.10, the first access notification is displayed in the connection record list1030of new users in the second application program. Display manners of the first access notification in the parent application program include, but are not limited to the following manners.

FIG.11is a schematic diagram of a communication service notification interface according to an embodiment. In an embodiment, as shown inFIG.11, the first access notification is displayed on a communication service notification interface1100of the parent application program of the authorizer terminal. The communication service notification interface1100is used for displaying a communication service notification list. The communication service notification interface1100displays a communication service notification bar1110corresponding to the second application program, the communication service notification bar1100corresponding to the second application program displays the first access notification, and a display manner of the first access notification in the communication service notification bar1110includes at least one of highlighting the communication service notification bar1110corresponding to the second application program and a text notification. For example, a text notification is “B successfully connects to A” inFIG.11.

FIG.12is a schematic diagram of a setting interface according to an embodiment. In another embodiment, as shown inFIG.12, the first access notification is displayed on a dialog interface1200of the parent application program of the authorizer terminal. The dialog interface1200is used for displaying a message transmitted by the second application program, and the message includes a push message, a notification message, and the like. The dialog interface1200displays a first access notification1210. For example, the first access notification1210is “User B successfully connects to hotspot A” inFIG.12.

The authorizer terminal shares the wireless network by using the share Wi-Fi control1011inFIG.10.

FIG.13is a schematic diagram of a first sharing interface according to an embodiment. In an embodiment, as shown inFIG.13, after the share Wi-Fi control1011on the authorizer terminal is triggered, a first sharing interface1300is displayed. A sub-application program of the authorizer terminal displays a graphic code1310, and the graphic code1310carries first identification information of the wireless access point and a shared key. For example, the graphic code1310may be a two-dimensional code (e.g., QR code or bar code). The guest terminal requests, from the authorizer terminal by scanning the two-dimensional code1310in the first sharing interface1300, to access the wireless network. The first sharing interface1300further includes a share with buddy control1320. A share with buddy control1320is used for sharing a link to the wireless network with the guest terminal other than the authorizer terminal.

The share with buddy control1320is used for sharing the link to the wireless network with a guest that has a buddy relationship with an authorizer, and the guest that has a buddy relationship with the authorizer is based on a buddy list in the parent application program of the authorizer terminal.

FIG.14is a schematic diagram of a second sharing interface according to an embodiment. In another embodiment, as shown inFIG.14, after detecting that the share with buddy control1320is triggered, the authorizer terminal displays a second sharing interface1400. The second sharing interface1400includes a card message1410, the card message1410includes a connect to Wi-Fi control1411. The connect to Wi-Fi control1411carries a link, and the link corresponds to the first identification information of the wireless access point and the shared key.

The authorizer terminal transmits the card message inFIG.14to a dialog interface corresponding to the guest terminal.

FIG.15is a schematic diagram of a dialog interface according to another embodiment. As shown inFIG.15, if authorizer A transmits a card message1510to guest B, and guest B is a buddy of the authorizer A in the parent application program, a dialog interface1500in the parent application program displays the card message1510transmitted by the authorizer terminal. The card message1510includes a connect to Wi-Fi control1511, the connect to Wi-Fi control1511carries a link, and the link corresponds to the first identification information of the wireless access point and the shared key.

FIG.16is a schematic diagram of a first management interface according to an embodiment. As shown inFIG.16, the second application program of the authorizer terminal further displays a first management interface1600. The first management interface1600includes a usage list1610of authorized guests, and the usage list1610of authorized guests includes a name and a MAC address of an authorized guest, and traffic used by each authorized guest. In addition, the usage list1610of authorized guests further includes a first permission change control1611. The first permission change control1611is used for changing an authorization permission of the authorized guest to “unauthorized”. For example, the first permission change control1611is “x” inFIG.16.

Moreover, the second application program of the authorizer terminal further displays a second management interface.

FIG.17is a schematic diagram of a second management interface according to an embodiment. As shown inFIG.17, the second management interface includes a list1700of unauthorized guests, and the list1700of unauthorized guests includes a name and a MAC address of an unauthorized guest. In addition, the list1700of unauthorized guests further includes a second permission change control1710, and the second permission change control1710is used for changing an authorization permission of the unauthorized guest to “authorized”. For example, the second permission change control1710is displayed as “√”.

FIG.18is a flowchart of a secure Wi-Fi connection procedure between a guest terminal and an authorizer terminal according to an embodiment. The flowchart uses an example in which a first application program runs on the guest terminal, the first application program is a sub-application program, and a second application program runs on the authorizer terminal. When the same parent application program is installed on both the authorizer terminal and the guest terminal, the parent application program may be a social application program, and supports running of a sub-application program. The procedure is as follows:

(1) The guest terminal obtains identification information of at least one wireless access point around the guest terminal; and the first application program displays a wireless network access interface according to the obtained identification information, the wireless network access interface including a classified secure wireless network area and common wireless network area, the secure wireless network area being used for displaying first identification information and a first connection control, and the common wireless network area being used for displaying second identification information and a second connection control.

InFIG.18, the wireless network access interface displays a secure Wi-Fi hotspot and a common Wi-Fi hotspot, a list in which the secure Wi-Fi hotspot is located is located above a list in which the common Wi-Fi hotspot is located, and a name of each Wi-Fi hotspot and a location of the name of the Wi-Fi hotspot are connection controls. The guest connects to a recommended secure Wi-Fi hotspot in the sub-application program, and the sub-application program requests, from the authorizer terminal by using a server, to access the recommended secure Wi-Fi hotspot.

(2) The second application program of the authorizer terminal displays a list of network connection applications of users, and the list of network connection applications of users displays a name and a MAC address of a guest terminal that requests authorization from the authorizer terminal. In addition, the list of network connection applications of users further includes an agree to authorize control and a disagree to authorize control. The authorizer terminal approves whether a guest can access the secure Wi-Fi hotspot by using the agree to authorize control and the disagree to authorize control.

(3) The first application program displays a wireless network connection interface in response to receiving a trigger signal for the first connection control, the wireless network connection interface being used for displaying progress prompt information of a wireless network connection process, and the wireless network connection process being an authentication process performed based on a user account and a MAC address of the guest terminal, and the first identification information.

InFIG.18, when the sub-application program receives the trigger signal for the first connection control on the wireless network access interface, the sub-application program switches from the wireless network access interface to the wireless network connection interface, and the wireless network connection interface displays the progress prompt information of the wireless network connection process. The guest determines, according to the progress prompt information, the progress of connecting to the secure Wi-Fi hotspot by the guest terminal.

(4) and (5) are for displaying a network connection result interface after the wireless network connection process is completed, the network connection result interface being used for displaying a connection result of a wireless access point corresponding to the first identification information.

(4) When the authorizer allows the guest to gain access, that is, after the authorizer terminal authorizes the guest terminal, the first application program displays the network connection result interface, and the connection result of the wireless access point displayed on the network connection result interface is that Wi-Fi is connected.

(5) When the guest is refused by the authorizer to gain access, that is, after the authorizer terminal does not authorize the guest terminal, the first application program displays the network connection result interface, and the connection result of the wireless access point displayed on the network connection result interface is that a connection application is rejected.

FIG.19is a flowchart of a secure Wi-Fi connection procedure between a guest terminal and an authorizer terminal according to another embodiment. The flowchart uses an example in which a first application program runs on the guest terminal, the first application program is a sub-application program, and a second application program runs on the authorizer terminal. When the same parent application program is installed on both the authorizer terminal and the guest terminal, the parent application program is a social application program, and supports running of a sub-application program. The procedure is as follows:

The guest terminal successfully connects to a secure Wi-Fi hotspot. After the guest terminal successfully connects to the secure Wi-Fi hotspot, a server transmits a first access notification to the second application program and the parent application program in the authorizer terminal.

(1) The second application program of the authorizer terminal displays an authorization query interface, and a connection record list of new users in the authorization query interface displays the first access notification, content of the first access notification including a name and a MAC address of an authorized guest terminal, an access authorized time, and a control for rejecting continued authorization.

(2) A communication service notification interface of the parent application program of the authorizer terminal displays the first access notification, the communication service notification interface displays a communication service notification bar corresponding to the second application program, the communication service notification bar corresponding to the second application program displays the first access notification, and a display manner of the first access notification in the communication service notification bar includes at least one of highlighting the communication service notification bar corresponding to the second application program and a text notification.

FIG.20is a flowchart of a secure Wi-Fi connection procedure between a guest terminal and an authorizer terminal according to another embodiment. The flowchart uses an example in which a first application program runs on the guest terminal, the first application program is a sub-application program, and a second application program runs on the authorizer terminal. When the same parent application program is installed on both the authorizer terminal and the guest terminal, the parent application program is a social application program, and supports running of a sub-application program. The procedure is as follows:

(1) The second application program of the authorizer terminal displays an authorization query interface, and the authorization query interface includes a share Wi-Fi control. The share Wi-Fi control is used for sharing a link to the wireless network with the guest terminal other than the authorizer terminal. The authorizer terminal shares a secure Wi-Fi hotspot by using the share Wi-Fi control.

(2) After receiving a trigger signal for the share Wi-Fi control, the authorizer terminal displays a first sharing interface, the first sharing interface displays a graphic code, and the graphic code carries first identification information of a wireless access point and a shared key. The first sharing interface further includes a share with buddy control, and the share with buddy control is used for sharing a link to the secure Wi-Fi hotspot with the guest terminal.

(3) The authorizer terminal displays a card message that carries the first identification information of the wireless access point and the shared key in a second sharing interface of the parent application program, and selects a guest terminal for sharing from the parent application program. The second sharing interface includes a card message, the card message includes a connect to Wi-Fi control, the connect to Wi-Fi control carries a link, and the link corresponds to the first identification information of the wireless access point and the shared key.

(4) The authorizer terminal transmits the card message of the secure Wi-Fi hotspot to the guest by using the parent application program. The card message is displayed in a dialog interface of the parent application program. The dialog interface displays the card message transmitted by the authorizer terminal. The card message includes the connect to Wi-Fi control, and the connect to Wi-Fi control carries the link. The link corresponds to the first identification information of the wireless access point and the shared key.

(5) After connecting to the Wi-Fi hotspot, the guest terminal may pull up the sub-application program. Here, the guest terminal may pull up the sub-application program according to an input by a user of the guest terminal or automatically by a predetermined configuration. The sub-application program displays a wireless network connection interface, and the wireless network connection interface displays progress prompt information of a wireless network connection process.

(6) Success information is displayed after the sub-application program completes the connection, that is, a network connection result interface is displayed after the sub-application program completes the connection, and success information is displayed on the network connection result interface. The success information includes that a connection result of the wireless access point is Wi-Fi connected.

There may be a usage time threshold on a secure Wi-Fi hotspot shared by the authorizer terminal. That is, starting from the time of access to the shared secure Wi-Fi hotspot by the guest terminal, an access to the secure Wi-Fi hotspot by the guest terminal for a specific time may not need authorization from the authorizer. When a connection time of the guest terminal reaches the usage time threshold, it is necessary to determine, according to an authorization permission of the guest terminal, whether the guest terminal can continue to connect to the secure Wi-Fi hotspot.

In addition, the usage time threshold may be set by the second application program itself, or may be set by the authorizer terminal by using the second application program.

FIG.21is a flowchart of a wireless network access method according to another embodiment. The method may be applied to the implementation environment shown inFIG.2and/orFIG.3. The method may alternatively be applied to the secure connection product architecture shown inFIG.4. The method includes the following steps:

Step2101: A first application program obtains identification information of at least one wireless access point around a guest terminal.

The first application program is an application program running on the guest terminal, and the first application program includes an application program used for connecting to a wireless network.

An operating system of the guest terminal includes a wireless network module. The wireless network module is configured to obtain a wireless network distributed around the guest terminal. That is, the wireless network module is configured to obtain identification information of a wireless access point corresponding to the wireless network. The wireless access point is a device that provides a wireless network service, and the identification information of the wireless access point includes an SSID and a BSSID. The first application program obtains the identification information of the wireless access point from the operating system of the guest terminal.

The first application program may further obtain a user account from the operating system of the guest terminal, the user account is an account that a guest uses to login to the first application program, and user accounts of guests are different.

Step2102: The first application program transmits the user account and the identification information to a server.

The first application program transmits the obtained user account and identification information of the wireless access point to the server.

Here, the identification information of the wireless access point includes first identification information and second identification information. The first identification information includes an SSID and a BSSID, and the first identification information is identification information corresponding to a secure wireless network. The second identification information includes an SSID and a BSSID, and the second identification information is identification information corresponding to a common wireless network.

Step2103: The server receives a query request transmitted by the guest terminal, the query request carrying the user account, the first identification information, and the second identification information.

The server receives the query request transmitted by the guest terminal, the query request carrying the user account, the first identification information, and the second identification information. The query request is used for requesting the server to generate a dynamic key key1according to the user account and the first identification information.

Step2104: The server extracts the user account and the first identification information from the query request.

The server extracts the user account and the SSID and the BSSID of the first identification information from the query request.

Step2105: The server generates a dynamic key key1according to the user account and the first identification information by using a dynamic key generation algorithm.

The server generates the dynamic key key1according to the user account, the SSID, and the BSSID that are extracted from the query request and by using the dynamic key generation algorithm. Therefore, the dynamic key key1is generated by the server according to the user account of the guest terminal, the SSID, and the BSSID.

Step2106: The server transmits the dynamic key key1to the guest terminal.

Step2107: The first application program receives the dynamic key key1transmitted by the server.

After receiving the dynamic key key1transmitted by the server, the first application program fills a connection password field with the dynamic key key1. The connection password field is used for being filled with a password for connecting to the wireless network. A first access request includes the connection password field.

Step2108: The first application program determines identification information that includes the dynamic key key1as the first identification information, and determines identification information that does not include the dynamic key key1as the second identification information.

Step2109: The first application program displays a wireless network access interface.

The first application program displays the wireless network access interface according to the obtained first identification information and second identification information. The wireless network access interface includes a classified secure wireless network area and common wireless network area. The secure wireless network area displays the first identification information and a first connection control, and the common wireless network area displays the second identification information and a second connection control. The first connection control is a connection control used for triggering connection to the secure wireless network. The second connection control is a connection control used for triggering connection to the common wireless network.

The wireless network access interface displays names of several wireless access points obtained by the guest terminal, and each name and an area in which each name is located include a connection control of a wireless access point. A connection control is used for generating a trigger signal according to a location triggered by a guest on the wireless network access interface. Therefore, the first connection control is used for generating a trigger signal when the guest triggers the secure wireless network in the secure wireless network area, and the second connection control is used for generating a trigger signal when the guest triggers the common wireless network in the common wireless network area.

After receiving the dynamic key key1, the first application program displays the first identification information in the secure wireless network area of the wireless network access interface according to the dynamic key key1.

Step2110: When receiving the trigger signal for the first connection control, the first application program generates a first MIC according to the dynamic key key1and the first identification information.

When the guest triggers the first connection control, the first connection control generates a trigger signal. When receiving the trigger signal for the first connection control, the first application program determines, according to the trigger signal generated for the first connection control, that the guest chooses to connect to the secure wireless network, and the first application program fills, with the dynamic key key1, a connection password field corresponding to the wireless network selected for connecting. The first application program generates the first MIC according to the dynamic key key1and the first identification information by using an MIC generation algorithm. The dynamic key key1is used for filling the connection password field in the first access request. The first MIC is generated by the guest terminal according to the dynamic key key1and the first identification information by using the MIC generation algorithm.

In addition, the first MIC is generated according to the dynamic key key1, the first identification information, and an authentication parameter by using the MIC generation algorithm. The authentication parameter is a random parameter obtained through message interaction between the guest terminal and the wireless access point.

Step2111: The first application program transmits the first access request to the wireless access point, the first access request carrying the first MIC and a MAC address.

The first application program transmits the first access request to the wireless access point. The first access request includes a MAC packet, and the MAC packet includes a MAC header and a payload. The MAC header stores a real MAC address of the guest terminal, and the payload stores the first MIC generated by the guest terminal.

FIG.22is a schematic diagram of a media access control header according to an embodiment. As shown inFIG.22, an SA location2210in a MAC header carries a real MAC address2220of the guest terminal.FIG.22shows a method for reading a MAC address of a guest terminal from a required field in a header of a standard 802.11 protocol. This can effectively avoid a problem of “using a forged MAC address in a hotspot scanning phase” of an iOS device and some versions of Android devices.

Here, the guest terminal encrypts the MAC packet in a standard WPA2 encryption manner, and transmits the encrypted MAC packet to the wireless access point.

Furthermore, the first access request carries the first MIC, the MAC address, and the authentication parameter.

Step2112: The wireless access point receives the first access request transmitted by the guest terminal in the standard WPA2 encryption manner.

The wireless access point receives the first access request, and the first access request includes the MAC packet encrypted in the standard WPA2 encryption manner. The wireless access point extracts the MAC address of the guest terminal and the first MIC from the encrypted MAC packet, and the first MIC is generated by the guest terminal according to the dynamic key key1and the first identification information.

The wireless access point generates a first check request according to the first MIC, the MAC address, and the first identification information of the wireless access point. The first identification information of the wireless access point includes the SSID, the BSSID, and an SN. Therefore, the wireless access point generates the first check request according to the first MIC, the MAC address, the SSID, the BSSID, and the SN.

Step2113: The wireless access point transmits an encrypted first check request to the server, the first check request carrying the first MIC, the MAC address, and the first identification information of the wireless access point.

The first check request carries the first MIC, the MAC address, the SSID, the BSSID, and the SN.

The first check request includes a MAC packet, and the MAC packet includes a MAC header and a payload. The MAC header carries the real MAC address of the guest terminal, and the payload stores the first MIC generated by the guest terminal. The first check request further carries the SN, the SSID, and the BSSID.

The first check request carries the first MIC, the MAC address, the first identification information, and the authentication parameter.

Step2114: The server receives the first check request transmitted by the wireless access point.

Step2115: The server queries whether an authorization library stores the MAC address.

The server stores the authorization library, and the authorization library is used for storing information corresponding to a guest terminal authorized by an authorizer terminal. The information includes a MAC address of the authorized guest terminal, a dynamic key key1corresponding to the guest terminal, and the first MIC.

The first check request carries a MAC packet, and the server extracts a MAC address from a header of the MAC packet. The server queries, according to the MAC address, whether the extracted MAC address is stored in the authorization library.

Step2116: When determining whether the authorization library stores the MAC address, the server queries, in the authorization library, the first identification information and the dynamic key key1that are corresponding to the MAC address.

When determining whether the authorization library stores the extracted MAC address, the server queries, in the authorization library, the SSID, the BSSID, and the dynamic key key1that are corresponding to the MAC address.

Step2117: The server generates a second MIC according to the MAC address, the dynamic key key1, and the first identification information by using the MIC generation algorithm.

The server generates the second MIC according to the MAC address, the dynamic key key1, the SSID, and the BSSID by using the MIC generation algorithm.

Step2118: The server verifies whether the first MIC and the second MIC are the same.

The server verifies whether the first MIC and the second MIC are the same. If a verification result obtained after the verification is that they are the same, the server determines that the guest terminal corresponding to the MAC address is an authorized guest terminal. If the verification result obtained after the verification is that they are different, the server determines that the guest terminal corresponding to the MAC address is an unauthorized guest terminal.

Step2119: The server transmits a first access notification of the guest terminal to an authorizer terminal when a first authorization result is “authorized”.

The authorizer terminal runs a second application program and a parent application program. The second application program includes an application program used for authorizing a guest terminal that requests to access the wireless access point. The parent application program is the same social application program installed on both the authorizer terminal and the guest terminal, and the parent application program supports a sub-application program.

When the first authorization result is “authorized”, the server transmits the first access notification to the second application program and the parent application program of the authorizer terminal.

Step2120: The server transmits the first authorization result to the guest terminal by using the wireless access point.

The server transmits the first authorization result to the wireless access point, and the first authorization result is transmitted to the guest terminal by using the wireless access point.

Step2121: Based on the first authorization result fed back by the server, the wireless access point transmits the first authorization result to the guest terminal.

Step2122: The first application program receives the first authorization result transmitted by the wireless access point.

The first application program of the guest terminal determines, according to the received first authorization result, whether the authorizer terminal has authorized the guest terminal.

Step2123: When the first authorization result is “authorized”, the first application program displays a prompt text of the first authorization result on a wireless network connection interface.

The wireless network connection interface is used for displaying progress prompt information of a wireless network connection process, and the wireless network connection process is an authentication process performed based on the user account and the MAC address of the guest terminal, and the first identification information. The progress prompt information is used for prompting the progress of the wireless network connection process.

When the first authorization result is “authorized”, the wireless network connection process of the first application program on the wireless network connection interface is displayed to be gradually completed, and the first application program displays the prompt text of the first authorization result on the wireless network connection interface. The prompt text is used for prompting that the guest terminal is authenticated by the authorizer terminal.

Step2124: The first application program displays a network connection result interface after the wireless network connection process is completed.

The network connection result interface is used for displaying a connection result of the wireless access point corresponding to the first identification information.

The first application program displays the network connection result interface, and the network connection result interface is a user interface displayed according to a connection status of the guest terminal. The network connection result interface displays a connection result of the wireless access point. The connection result includes connection success and connection failure.

According to the methods provided in the one or more embodiments described above, the server authenticates, according to the user account and the MAC address of the guest terminal, and the first identification information of the wireless access point, the guest terminal that requests to access the wireless network. Even if information used by the guest terminal in the wireless network connection process is stolen or breached to a third party terminal, because user accounts and/or MAC addresses of different terminals are different, the third party terminal cannot pass authentication at the server when establishing a wireless network connection, thereby avoiding a risk that the wireless network is indirectly shared without authorization and improving the security of the wireless network.

According to this embodiment, the first access request is transmitted in the WPA2 encryption manner, and the first access request is transmitted between the guest terminal and the wireless access point in the WPA2 encryption manner, thereby ensuring privacy of the first access request and avoiding a risk that the real MAC address of the guest terminal is intercepted by a third party due to the first access request.

According to this embodiment, the server queries, according to a received MAC address, whether the MAC address exists in the authorization library. If the MAC address is stored in the authorization library, the server queries first identification information and a dynamic key key1that are corresponding to the MAC address according to the MAC address, and generates a second MIC according to the MAC address, the dynamic key key1, and the first identification information, so as to verify whether the first MIC matches the second MIC. If the first MIC matches the second MIC, the server determines that the guest terminal is an authorized guest terminal; otherwise, the server determines that the guest terminal is an unauthorized guest terminal. Whether the first MIC matches the second MIC is verified, so that the server does not need to perform a reverse operation on the first MIC, that is, accuracy of an authentication result is ensured, and a calculation amount during authentication is reduced.

In the embodiment provided inFIG.21, after step2118, the server may verify whether the first MIC and the second MIC are the same. When the server verifies that the two MICs are different, that is, the first authorization result is “unauthorized”, the server queries the authorizer terminal whether to provide authorization.FIG.23is a flowchart of a method for querying, by a server, an authorizer terminal according to an embodiment. The method may be applied to the implementation environment shown inFIG.2and/orFIG.3. The method may alternatively be applied to the secure connection product architecture shown inFIG.4. The method includes the following steps:

Step21181: The server transmits an authorization request to an authorizer terminal corresponding to the first identification information when the first authorization result is “unauthorized”.

The server queries the authorization library according to the MAC address. If the MAC address is not found or the MAC address is found, but the first MIC and the second MIC are different, the first authorization result outputted by the server is “unauthorized”. The server transmits the authorization request to the authorizer terminal corresponding to the first identification information of the wireless access point, and requests the authorizer terminal to authorize the unauthorized guest terminal.

The authorization request is used by the server to request the authorizer terminal to authorize the unauthorized guest terminal, that is, the server requests, according to the authorization request, the authorizer terminal to allow the unauthorized guest terminal to access the wireless network.

Step21182: The authorizer terminal receives the authorization request transmitted by the server.

The authorization request is a request for authorization transmitted by the server to the authorizer terminal according to a guest terminal that is not in the authorization library. The authorization request carries the user account of the guest terminal.

Step21183: The authorizer terminal displays an authorization query interface according to the authorization request, the authorization query interface displaying the user account, the MAC address, and an authorization control.

The authorizer terminal extracts the user account of the guest terminal from the authorization request, and displays the authorization query interface according to the authorization request. The authorization query interface displays the user account of the guest terminal. The authorization query interface also displays the MAC address of the guest terminal requesting authorization, and the authorization control. The authorization control includes an agree to authorize control and a disagree to authorize control. A schematic diagram of the authorization query interface is shown inFIG.10, and details are not described herein again.

Step21184: When a trigger signal on the authorization control is received, the authorizer terminal transmits an agree to authorize response to the server.

When a trigger signal on the disagree to authorize control is received, an authorization response transmitted by the authorizer terminal to the server is a disagree to authorize response, and the authorizer terminal does not allow the guest terminal to access the wireless network.

When a trigger signal on the agree to authorize control is received, an authorization response transmitted by the authorizer terminal to the server is an agree to authorize response, and the authorizer terminal allows the guest terminal to access the wireless network.

Step21185: The server receives the authorization response transmitted by the authorizer terminal.

The authorization response includes the disagree to authorize response and the agree to authorize response. The disagree to authorize response is an authorization response transmitted by the authorizer terminal to the server according to a received trigger signal on the disagree to authorize control. The agree to authorize response is an authorization response transmitted by the authorizer terminal to the server according to a received trigger signal on the agree to authorize control.

Step21186: When the authorization response is an agree to authorize response, the server updates the authorization library according to a correspondence between the user account and the first identification information.

The server stores the authorization library, and the authorization library is used for storing information corresponding to a guest terminal authorized by the authorizer terminal. The information includes a MAC address of the authorized guest terminal, a dynamic key key1corresponding to the guest terminal, and the first MIC.

When the received authorization response is an agree to authorize response, the server updates the authorization library according to the correspondence between the user account and the first identification information, and transmits an authorized notification to the guest terminal.

The agree to authorize response is used for triggering the server to update the authorization library according to the correspondence between the user account and the first identification information.

According to this embodiment by transmitting the authorization request to the authorizer terminal, the server requests authorization for the unauthorized guest terminal, and by using the authorization response fed back by the authorizer terminal, the server determines whether the authorizer terminal has authorized the unauthorized guest terminal, so as to determine whether to update the authorization library. By using the authorizer terminal, selectivity of the guest terminal accessing the wireless network is implemented, security of the guest terminal accessing the wireless network is ensured, and security of information of the authorizer terminal is avoided.

In the embodiments provided inFIG.21andFIG.23, a method for verifying a first MIC and a second MIC by a server is shown inFIG.24. The method includes the following steps:

Step2401: Receive a check request.

The server receives a first check request transmitted by a wireless access point. The first check request carries a MAC address of a guest terminal, the first MIC, and first identification information of the wireless access point, and the first identification information of the wireless access point includes an SN, an SSID, and a BSSID.

The first check request further includes an authentication parameter, and the authentication parameter is a random parameter generated when the guest terminal and the wireless access point perform transmission in a standard WPA2 encryption manner.

Step2402: Perform decryption to obtain a dynamic key key1and the first identification information of the wireless access point.

The server decrypts the first check request to obtain the MAC address, the first MIC, and the first identification information of the wireless access point in the first check request. The server further obtains the dynamic key key1of the guest terminal according to the first check request.

Step2403: Match the dynamic key key1, the MAC address, the first identification information, and the authentication parameter in an authorization library.

The server matches the dynamic key key1, the MAC address, the first identification information, and the authentication parameter in the authorization library according to the MAC address carried in the first check request.

Step2404: Determine whether the match is successful.

If the server successfully matches the dynamic key key1, the MAC address, the first identification information, and the authentication parameter in the authorization library (Step2404: Yes), the server performs step2409. If the server fails to match the dynamic key key1, the MAC address, the first identification information, and the authentication parameter in the authorization library (Step2404: No), the server performs step2405.

Step2405: Determine whether MAC address matching is successful.

The server matches the MAC address in the first check request with a MAC address stored in the authorization library. If the MAC address in the first check request successfully matches the MAC address stored in the authorization library (Step2405: Yes), the server performs step2407. If the MAC address in the first check request fails to match the MAC address stored in the authorization library (Step2405: No), the server indicates that the guest terminal is an unauthorized guest terminal and then performs step2406.

Step2406: Notify an authorizer terminal that an unauthorized guest terminal requests to log in, and request to authorize the unauthorized guest terminal.

When the MAC address in the first check request does not match the MAC address stored in the authorization library, the server transmits an authorization request to the authorizer terminal to request the authorizer terminal to authorize the unauthorized guest terminal.

The authorization request is used for notify the authorizer terminal that the unauthorized guest terminal requests to log in, and requesting to authorize the unauthorized guest terminal.

Step2407: Determine whether the first MIC is the same as the second MIC.

When the MAC address in the first check request matches the MAC address stored in the authorization library (Step2405: Yes), the server queries, according to the MAC address stored in the authorization library, the dynamic key key1corresponding to the MAC address, the first identification information of the wireless access point, and the authentication parameter, and generates the second MIC according to a MIC generation algorithm.

The server verifies whether the first MIC and the second MIC are the same (Step2407). If the first MIC and the second MIC are the same (Step2407: Yes), the server performs step2409. If the first MIC is different from the second MIC (Step2407: No), the server indicates that the dynamic key key1of the guest terminal is changed; and then performs step2408.

The server sets default processing for matching failure. For a guest terminal that fails in matching, an authorizer makes adjustment appropriately according to a security requirement and a hotspot user. For example, when a Wi-Fi hotspot is a Wi-Fi hotspot in which a free Internet access service is provided in a public place, for a guest terminal that fails in matching, the server sets by default that authentication success is to be returned and the guest terminal is allowed to connect to the hotspot, but records a matching failure record for subsequent audit queries.

Step2408: Notify the authorizer terminal to change the dynamic key key1, and request to authorize the unauthorized guest terminal.

When the first MIC is different from the second MIC, the server notifies the authorizer terminal to change the dynamic key key1, and requests to authorize the unauthorized guest terminal.

Step2409: Return an authentication success message.

When the matching succeeds, the server returns authentication success to the guest terminal, that is, a returned first authorization result is “authorized”.

Step2410: Return an authentication failure message.

When the matching fails, the server returns authentication failure to the guest terminal, that is, the returned first authorization result is “unauthorized”.

In the embodiment provided inFIG.21, the wireless access point needs to first register with the server, and the registered wireless access point is a wireless access point that supports a secure connection technology.

FIG.25is a flowchart of a method for registering a wireless access point with a server according to an embodiment. The method may be applied to the implementation environment shown inFIG.2and/orFIG.3. The method may alternatively be applied to the secure connection product architecture shown inFIG.4. The method includes the following steps:

Step2501: The wireless access point registers first identification information of the wireless access point with the server by using a registration key.

The wireless access point transmits the registration key to the server, and the registration key is a key pre-allocated by the server for a registration process. The registration key is used by the wireless access point to register with the server.

The registration key carries the first identification information of the wireless access point, and the first identification information of the wireless access point includes an SN, an SSID, and a BSSID.

Step2502: The server receives a registration request transmitted by the wireless access point by using the registration key.

The registration request includes the registration key, and the registration key carries the first identification information of the wireless access point. The server extracts the first identification information of the wireless access point from the registration request.

Step2503: The server stores the first identification information of the wireless access point into a security device library.

The server stores the first identification information of the wireless access point extracted from the registration request into the security device library.

The security device library is a database of first identification information of wireless access points registered with the server by using registration keys. The security device library stores the first identification information of the wireless access point, and the first identification information of the wireless access point includes an SN, an SSID, and a BSSID.

In the embodiment provided inFIG.21, the authorizer terminal shares a link to the wireless network with the guest terminal.FIG.26is a flowchart of a method for sharing a link to a wireless network with a guest terminal by an authorizer terminal according to an embodiment. The method may be applied to the implementation environment shown inFIG.2and/orFIG.3. The method may alternatively be applied to the secure connection product architecture shown inFIG.4. The method includes the following steps:

Step2601: A second application program shares first identification information of the wireless access point and a shared key with the guest terminal.

When both the authorizer terminal and the guest terminal are installed with the same parent application program, the parent application program is a social application program, and the parent application program supports running of a sub-application program.

The second application program of the authorizer terminal shares the link with the guest terminal by using the parent application program, and the link includes the first identification information of the wireless access point and the shared key. The first identification information of the wireless access point includes an SSID and a BSSID.

In addition, there may be a buddy relationship between a user account of the guest terminal on the parent application program and a user account of the authorizer terminal on the parent application program.

The second application program may display a graphic code, and the graphic code carries the first identification information of the wireless access point and the shared key. Alternatively, the second application program transmits a card message to the guest terminal by using the parent application program, and the card message carries the first identification information of the wireless access point corresponding to the link, and the shared key.

Step2602: The second application program synchronizes the first identification information, the shared key, and an authorization range of the shared key to a server.

The second application program shares the first identification information of the wireless access point and the shared key with a guest terminal other than the authorizer terminal by using the parent application program, and a quantity of shared guest terminals is at least one.

For example, when the second application program shares the first identification information of the wireless access point and the shared key with one guest terminal by using the parent application program, the quantity of shared guest terminals is one, and therefore the authorization range of the shared key is this guest terminal.

For example, when the second application program shares the first identification information of the wireless access point and the shared key with one guest terminal group by using the parent application program, the quantity of shared guest terminals is several, and therefore, the authorization range of the shared key is terminals in the guest terminal group except the authorizer terminal.

After sharing the first identification information of the wireless access point and the shared key with the guest terminal other than the authorizer terminal by using the parent application program, the second application program synchronizes the first identification information, the shared key, and the authorization range of the shared key with the server. The authorization range includes at least one user account.

Step2603: The sub-application program obtains, by using the parent application program, the first identification information of the wireless access point and the shared key that are shared by the authorizer terminal.

A first application program of the guest terminal is a sub-application program, and the sub-application program is an application program that depends on the parent application program to run. The sub-application program of the guest terminal obtains, by using the parent application program, the first identification information of the wireless access point and the shared key that are shared by the authorizer terminal.

In addition, the parent application program scans a graphic code shared by the authorizer terminal. The parent application program invokes the sub-application program to extract the first identification information of the wireless access point and the shared key from the graphic code. Alternatively, the parent application program receives a card message shared by the authorizer terminal, and the card message corresponds to a link. When receiving a trigger signal for the card message, the parent application program extracts an identifier of the wireless access point and the shared key from the card message by invoking the sub-application program according to the link.

Step2604: The sub-application program transmits a second access request to the wireless access point according to the first identification information of the wireless access point and the shared key.

The sub-application program transmits the second access request to the wireless access point according to the first identification information of the wireless access point and the shared key that are shared by the authorizer terminal. The second access request is generated by the guest terminal according to the first identification information of the wireless access point and the shared key.

Step2605: The wireless access point receives the second access request transmitted by the guest terminal.

The second access request includes a MAC packet. The MAC packet includes a MAC header and a payload, the MAC header includes a MAC address of the guest terminal, and the payload includes the shared key. The second access request carries the MAC address of the guest terminal, the first identification information of the wireless access point, and the shared key.

Step2606: The wireless access point generates a second check request according to the user account, the first identification information, and the shared key, and transmits the second check request to the server.

The wireless access point generates the second check request according to the user account of the guest terminal, the first identification information, and the shared key. The second check request includes a MAC packet, and the MAC packet includes a MAC header and a payload. The MAC header stores a real MAC address of the guest terminal, and the payload stores the shared key generated by the guest terminal. The second check request further carries the first identification information of the wireless access point, and the first identification information of the wireless access point includes an SN, an SSID, and a BSSID.

The second check request is used for checking, according to the user account, the first identification information of the wireless access point, and the shared key, the authorization range received by the server.

Step2607: The server receives the second check request transmitted by the wireless access point.

Step2608: The server verifies, according to the second check request, whether the user account falls within the authorization range of the shared key, and generates a second authorization result according to a verification result.

The server extracts the user account from the second check request, verifies whether the user account falls within the authorization range of the shared key, and generates the second authorization result according to the verification result.

In addition, an authorization policy of the server includes: allowing everyone to share for propagation, allowing only an owner to share for propagation, allowing propagation but requiring an owner's acknowledgment, and allowing propagation with an owner notified. Allowing everyone to share for propagation means that anyone who obtains a link to a wireless network can share the link to another person. Allowing only an owner to share for propagation means that a link to a wireless network can be shared only by an authorizer and cannot be shared by other guests. Allowing propagation but requiring an owner's acknowledgment means that a link to a wireless network can be repeatedly shared by other guests, but repeatedly shared guests need to be authorized by an authorizer when accessing the wireless network. Allowing propagation with an owner notified means that a link to a wireless network can be repeatedly shared by other guests, and an authorizer terminal receives a notification message after repeatedly shared guests access the wireless network.

In addition, the second authorization result includes “falling within the authorization range” and “not falling within the authorization range”. For example, it may be determined whether the guest terminal falls within an authorization range based on a predetermined distance from the wireless access point.

Moreover, the server obtains, in a secure manner by using an encryption and decryption mechanism, a user account of a guest terminal that requests to gain access, the guest terminal, first identification information, an authorization range, and a shared key. The server traces a relationship chain between the wireless access point and the authorizer terminal according to whether the user account of the guest terminal falls within the authorization range, so that sharing of the authorizer terminal is controlled sharing.

Step2609: The server transmits the second authorization result to the guest terminal by using the wireless access point.

The second authorization result is transmitted by the server to the wireless access point, and then the wireless access point transmits the second authorization result to the guest terminal.

Step2610: Based on the second authorization result fed back by the server, the wireless access point transmits the second authorization result to the guest terminal.

Step2611: The sub-application program receives the second authorization result transmitted by the wireless access point.

The sub-application program of the guest terminal receives the second authorization result, and determines whether the guest terminal belongs to the authorization range, so as to determine whether the wireless network can be connected.

When the second authorization result is “falling within the authorization range”, the guest terminal belongs to the authorization range, and the guest terminal can connect to the wireless network.

When the second authorization result is “not falling within the authorization range”, the guest terminal does not belong to the authorization range, and the guest terminal cannot connect to the wireless network.

Step2612: The second application program displays an access notification interface, and the access notification interface displays a notification message indicating that the guest terminal successfully accesses the wireless access point.

When a guest terminal accesses the wireless network by using the shared key, the second application program displays the access notification interface, and the access notification interface displays a notification message indicating that the guest terminal successfully accesses the wireless access point. The schematic diagram of the access notification interface is shown inFIG.10. The connection record list of new users inFIG.10is used for displaying a notification message indicating that a guest terminal successfully accesses a wireless access point. The connection record list of new users further displays a name, a MAC address, and access time of an authorized guest terminal, and a control for rejecting continued access authorization.

According to this embodiment, the wireless network shared by the authorizer terminal is a controllable wireless network. The server feeds back, to the authorizer terminal, a user account and a MAC address of a guest terminal that accesses the wireless network, and the authorizer terminal performs manual or automatic authorization processing according to the user account and the MAC address.

According to this embodiment, the authorizer terminal shares the first identification information of the wireless access point and the shared key with a guest terminal other than the authorizer terminal by using the parent application program, so that the wireless network of the authorizer terminal can be shared with a guest terminal that has a buddy relationship with a user account of the authorizer terminal in the parent application program. In addition, a link for sharing the wireless network carries the shared key. The server can ensure, according to the shared key and the authorization range, that a guest connected to the wireless network conform to an idea of the authorizer, so as to prevent the wireless network from being repeatedly shared by the shared guest.

For example, the wireless access point may be a router, and the server may be a cloud server providing a cloud service. This example is taken to describe a procedure in which the guest terminal requests to access a secure Wi-Fi hotspot from the wireless access point, and a procedure in which the authorizer terminal authorizes sharing for the guest terminal.

FIG.27is a flowchart of a method for identifying a secure Wi-Fi hotspot by a guest terminal according to an embodiment. The method may be applied to the implementation environment shown inFIG.2and/orFIG.3. The method may alternatively be applied to the secure connection product architecture shown inFIG.4. The method includes the following steps:

Step2701: A router registers an SSID/BSSID/SN with a cloud service.

The router transmits first identification information of the router to the cloud server, and registers with the cloud service as a router that supports a secure connection technology. The first identification information of the router includes an SN/SSID/BSSID, and both the SSID and the BSSID need to exist to indicate the router.

When registering with the cloud service, the router transmits the SN and/or the SSID and the BSSID to the cloud service, and the SN and/or the SSID and the BSSID are used for identifying the router requesting to register.

After the router registers with the cloud service, the cloud service stores the first identification information of the router in a security device library. The security device library is stored in the cloud service, and the security device library includes first identification information of a router registered with the cloud service. The router corresponding to the first identification information stored in the security device library is a router that supports the secure connection technology.

Step2702: An APP/mini program queries an operating system of a guest terminal for SSID/BSSID list information.

After the APP/mini program on the guest terminal is started, the APP/mini program queries the operating system of the guest terminal for first identification information that is of a router of a secure Wi-Fi hotspot located around the guest terminal and that is stored in the operating system of the guest terminal. The first identification information includes an SSID/BSSID.

Step2703: The operating system of the guest terminal returns an SSID/BSSID list.

The operating system of the guest terminal obtains the secure Wi-Fi hotspot around the guest terminal by using a Wi-Fi module, and obtains the first identification information of the router corresponding to the secure Wi-Fi hotspot. The first identification information includes the SSID/BSSID.

The operating system of the guest terminal generates the SSID/BSSID list according to the SSID/BSSID of the router obtained by the Wi-Fi module, and returns the SSID/BSSID list to the APP/mini program.

Step2704: The APP/mini program transmits the SSID/BSSID list to the cloud service to request to identify whether security authentication controlled sharing is supported.

The APP/mini program transmits the SSID/BSSID list to the cloud service. The cloud service receives the SSID/BSSID list, identifies the SSID/BSSID in the SSID/BSSID list, matches the SSID/BSSID that is the same as the SSID/BSSID stored in the security device library, and determines that a router corresponding to the SSID/BSSID that can be matched is a router that supports the secure connection technology. In addition, the router supports security authentication controlled sharing.

Step2705: The cloud service returns SSID/BSSID identification mark information, including a dynamic key key1, to the APP/mini program.

After determining the matched SSID/BSSID, the cloud service generates the dynamic key key1according to a MAC address of the guest terminal, the SSID/BSSID, and a user account corresponding to the APP/mini program. The cloud service transmits the matched SSID/BSSID and the dynamic key key1to the APP/mini program.

Step2706: The APP/mini program detects a hotspot that supports security authentication controlled sharing.

The APP/mini program receives the matched SSID/BSSID and the dynamic key key1, and detects the secure Wi-Fi hotspot corresponding to the matched SSID/BSSID according to the matched SSID/BSSID. The detected secure Wi-Fi hotspot is a hotspot that supports security authentication controlled sharing.

FIG.28is a flowchart of a method for connecting to a secure Wi-Fi hotspot by a guest terminal according to another embodiment. The method may be applied to the implementation environment shown inFIG.2and/orFIG.3. The method may alternatively be applied to the secure connection product architecture shown inFIG.4. The method includes the following steps:

Step2801: An APP/mini program obtains a dynamic key key1delivered by a cloud service.

The APP/mini program transmits a user account and an SSID/BSSID of a router to the cloud service. The cloud service generates the dynamic key key1according to the user account and the SSID/BSSID of the router. The cloud service delivers the dynamic key key1to the APP/mini program, and the APP/mini program obtains the dynamic key key1delivered by the cloud service.

Step2802: The APP/mini program fills in a Wi-Fi password by using the dynamic key key1as a key.

The APP/mini program fills, with the dynamic key key1, a connection password field of a Wi-Fi password in an operating system of a guest terminal.

Step2803: The operating system of the guest terminal connects to a secure Wi-Fi hotspot in a WPA2 manner.

The operating system of the guest terminal establishes, according to a WPA2 encryption manner, a connection to a router that can provide a secure Wi-Fi hotspot. That is, the operating system of the guest terminal transmits a first access request to the router, and the first access request is generated in a standard WPA2 encryption manner. The first access request carries a MAC address of the guest terminal.

The first access request carries an authentication parameter, and the authentication parameter is a random parameter generated when the guest terminal and a wireless access point perform transmission in the standard WPA2 encryption manner.

Step2804: The router reads the MAC address, and encodes and encrypts, as key2, the MAC address, an SN/SSID/BSSID of the router, the authentication parameter, and the like.

The router receives the first access request and reads the MAC address of the guest terminal, the SN/SSID/BSSID of the router, and the authentication parameter. The router encodes and encrypts the first access request as key2.

Step2805: The router transmits key2to the cloud service for authentication.

Here, key2may include the MAC address, the SN/SSID/BSSID of the router, and the authentication parameter.

Step2806: A server performs decryption and verifies whether the MAC address, the SN/SSID/BSSID of the router, the user account, and the dynamic key key1match an authorization database and an authorization logic.

After receiving key2, the server decrypts key2to obtain the MAC address, and determines, according to the MAC address, whether the authorization library stores the MAC address in key2. If the authorization library stores the MAC address in key2, the server determines, according to the MAC address, whether the SN/SSID/BSSID of the router, the user account, and the dynamic key key1that are in the authorization library and that are corresponding to the MAC address match key2. The server obtains a first authorization result according to a matching result.

Moreover, the first authorization result includes “authorized” and “unauthorized”. “Authorized” is generated when the verification result is that the server successfully verifies the information, and “unauthorized” is generated when the verification result is that the server does not successfully verify the information.

Step2807: The server returns an authentication result to the router.

Step2808: The router returns the authentication result to the operating system of the guest terminal.

Step2809: The operating system of the guest terminal returns the authentication result to the APP/mini program.

FIG.29is a flowchart of a method for requesting to access a secure Wi-Fi hotspot by an unauthorized guest terminal according to another embodiment. The method may be applied to the implementation environment shown inFIG.2and/orFIG.3. The method may alternatively be applied to the secure connection product architecture shown inFIG.4. The method includes the following steps:

Step2901: Initiate security authentication by using a guest ID1.

The guest ID1is a user account of a parent application program running on a guest terminal, and an APP/mini program depends on the parent application program to run. The parent application program is a social application program installed on both the guest terminal and an authorizer terminal.

The APP/mini program initiates security authentication to a cloud service by using the guest ID1.

Step2902: Query an authorization library.

After receiving a request, transmitted by the guest ID1, for requesting to access a wireless network, the cloud service extracts a MAC address transmitted by the guest ID1with the access request, and queries the authorization library in the cloud service according to the MAC address. If the authorization library stores the MAC address, the cloud service determines that the guest ID1is an authorized ID, and the guest terminal corresponding to the guest ID1can directly connect to the wireless network. If the authorization library does not store the MAC address, the cloud service determines that the guest ID1is an unauthorized ID and performs step2903.

Step2903: Transmit a message indicating “Authentication fails; please wait for authorization”.

If the authorization library does not store the MAC address, the cloud service determines that the guest ID1is an unauthorized ID, and transmits a message or information indicating “Authentication fails; please wait for authorization” to the guest terminal corresponding to the guest ID1.

Step2904: Forward authentication to an authorizer ID to request authorization.

The authorizer ID is a user account of the parent application program running on the authorizer terminal, and the user account of the parent application program and a user account of a second application program are the same user account.

If the authorization library does not store the MAC address, the cloud service determines that the guest ID1is an unauthorized ID, and forwards authentication to the authorizer ID to request the authorizer ID to authorize the guest ID1to allow the guest ID1to access the wireless network.

Step2905: Authorize the guest ID1to allow the guest ID1to connect to the wireless network.

The authorizer authorizes the guest ID1by using the second application program, so that the guest ID1is allowed to connect to the wireless network. The authorizer terminal transmits an authorization response to the cloud service by using the second application program.

Step2906: Update the authorization library.

The cloud service receives the agree to authorize response, and stores, according to the agree to authorize response, information such as the MAC address and the user account that are corresponding to the guest ID1into the authorization library, so as to update the authorization library.

Step2907: Notify that the guest ID1has been authorized.

The cloud service transmits a first authorization result to the APP/mini program, and the first authorization result is “authorized”, that is, the cloud service notifies that the guest ID1has been authorized.

Step2908: Initiate security authentication by using the guest ID1.

After the APP/mini program receives the first authorization result, the APP/mini program initiates security authentication again to the cloud service by using the guest ID1.

Step2909: Authentication succeeds, and access is authorized.

According to the request for requesting to access the wireless network, the cloud service finds, according to the MAC address, that the guest ID1is an authorized guest ID, and transmits a message “Authentication succeeds, and access is authorized” to the APP/mini program.

Step2910: Notify the authorizer ID that the guest ID1has gained access.

When the guest ID1accesses the wireless network, the cloud service transmits an access notification to the second application program, to notify the authorizer ID that the guest ID1has gained access.

In the embodiment shown inFIG.29, a flowchart of accessing a wireless network by an unauthorized guest is shown.FIG.30is a flowchart of a method for requesting to access a secure Wi-Fi hotspot by an authorized guest terminal according to another embodiment. In this flowchart, when a cloud service stores a MAC address in an authorization library, the cloud service determines that a guest ID1is an authorized ID, and a guest terminal corresponding to the guest ID1can directly connect to a wireless network. Then, an alternative step of step2904to step2910is step3004. The alternative step is as follows:

Step3004: Notify the authorizer ID that the guest ID1has gained access.

When the authorized guest ID1directly accesses the wireless network, the cloud service transmits an access notification to the second application program, to notify the authorizer ID that the guest ID1has gained access.

FIG.31is a flowchart of a method for sharing a secure Wi-Fi hotspot by an authorizer terminal according to an exemplary embodiment of this application. The method may be applied to the implementation environment shown inFIG.2and/orFIG.3. The method may alternatively be applied to the secure connection product architecture shown inFIG.4. The method is applied to a guest terminal running an APP/mini program, and an authorizer terminal running a second application program. The method includes the following steps:

Step3101: Transmit hotspot information and an authorization information code to a guest.

The hotspot information refers to first identification information of a wireless access point, and the first identification information includes an SSID/BSSID. The authorization information code refers to a shared key, and the shared key is obtained through encoding according to an authorizer ID, an authorization policy, and the first identification information of the wireless access point.

The authorization policy includes: allowing everyone to share for propagation, allowing only an owner to share for propagation, allowing propagation but requiring an owner's acknowledgment, and allowing propagation with an owner notified. Allowing everyone to share for propagation means that anyone who obtains a link to a wireless network can share the link to another person. Allowing only an owner to share for propagation means that a link to a wireless network can be shared only by an authorizer and cannot be shared by other guests. Allowing propagation but requiring an owner's acknowledgment means that a link to a wireless network can be repeatedly shared by other guests, but repeatedly shared guests need to be authorized by an authorizer when accessing the wireless network. Allowing propagation with an owner notified means that a link to a wireless network can be repeatedly shared by other guests, and an authorizer terminal receives a notification message after repeatedly shared guests access the wireless network.

The second application program transmits the first identification information of the wireless access point and the shared key to the guest by using the parent application program.

Step3102: Synchronize authorization information to the cloud service.

The second application program synchronizes the authorization information to the cloud service at the same time, the authorization information includes the first identification information, the shared key, and an authorization range, and the authorization range includes a user account of at least one guest on the parent application program.

Step3103: Obtain the hotspot information and the authorization information through decoding.

The APP/mini program decodes the received first identification information and shared key.

Step3104: Initiate an authentication request to the cloud service by using the guest ID1to carry the authorization information.

The APP/mini program initiates, according to the decoded first identification information and shared key, the authentication request to the cloud service by using the guest ID1to carry the shared key, to request to access the wireless network.

Step3105: Authorization check matches.

The cloud service determines, according to the shared key and the guest ID1, whether the guest ID1belongs to the authorization range. When determining that the guest ID1belongs to the authorization range, the cloud service determines that authorization check matches.

Step3106: Authentication succeeds, and access is authorized.

The cloud service transmits a message “Authentication succeeds, and access is authorized” to the APP/mini program.

Step3107: Notify the authorizer ID that the guest ID1has gained access.

When the authorized guest ID1directly accesses the wireless network, the cloud service transmits an access notification to the second application program, to notify the authorizer ID that the guest ID1has gained access.

FIG.1,FIG.5,FIG.21, andFIG.23toFIG.31are schematic flowcharts of a wireless network access method according to various embodiments. It is to be understood that steps in flowcharts ofFIG.1,FIG.5,FIG.21andFIG.23toFIG.31are displayed in sequence based on indication of arrows, but the steps are not necessarily performed in sequence based on a sequence indicated by the arrows. Unless otherwise specified, execution of the steps is not strictly limited, and the steps may be performed in other sequences. In addition, at least some steps inFIG.1,FIG.5,FIG.21andFIG.23toFIG.31may include a plurality of sub-steps or a plurality of stages. The sub-steps or the stages are not necessarily performed at the same moment, but may be performed at different moments. The substeps or the stages are not necessarily performed in sequence, but may be performed in turn or alternately with another step or at least some of substeps or stages of the another step.

The following describes apparatus embodiments, which can be used for executing the method embodiments. For details not disclosed in the apparatus embodiments, refer to the method embodiments of the disclosure.

FIG.32is a schematic structural diagram of a wireless network access apparatus according to an embodiment. The apparatus is applied to a server3300, and the apparatus includes: a second receiving module3310configured to receive a user account and identification information of a wireless access point that are transmitted by a guest terminal, the identification information including first identification information and second identification information; a generation module3330configured to: generate a dynamic key key1according to the user account and the first identification information, and transmit the dynamic key key1to the guest terminal; the second receiving module3310being configured to receive a first check request transmitted by the wireless access point, the first check request carrying a MAC address, the first identification information, and a first MIC; a verification module3360configured to verify the first MIC according to the dynamic key key1found by using the MAC address, and generate a first authorization result according to a verification result of the first MIC; and a second transmission module3370configured to transmit the first authorization result to the guest terminal by using the wireless access point.

The verification module3360includes: a querying unit3361configured to query whether an authorization library stores the MAC address; the querying unit3361being configured to: when determining that the authorization library stores the MAC address, query, in the authorization library, the first identification information and the dynamic key key1that are corresponding to the MAC address; a second generation unit3362configured to generate a second MIC according to the MAC address, the dynamic key key1, and the first identification information by using a MIC generation algorithm; and a verification unit3363configured to verify whether the first MIC and the second MIC are the same.

The apparatus further includes: the second transmission module3370configured to: transmit an authorization request to an authorizer terminal corresponding to the first identification information when the first authorization result is “unauthorized”; the second receiving module3310configured to receive an authorization response transmitted by the authorizer terminal; and an update module3340configured to: when the authorization response is an agree to authorize response, update the authorization library according to a correspondence between the user account and the first identification information; the second transmission module3370being configured to transmit an authorized notification to the guest terminal.

The apparatus further includes: the second transmission module3370configured to transmit a first access notification of the guest terminal to an authorizer terminal when a first authorization result is “authorized”.

The second transmission module3370is configured to: separately transmit the first access notification of the guest terminal to a parent application program and a second application program in the authorizer terminal in the case that the first authorization result is “authorized”.

The apparatus further includes: the second receiving module3310configured to receive a registration request transmitted by the wireless access point by using a registration key, the registration request carrying the first identification information of the wireless access point; a storage module3320configured to store the first identification information of the wireless access point into a security device library; and the generation module3330configured to: generate the dynamic key key1according to the user account and the first identification information when the first identification information is first identification information that belongs to the security device library.

The second receiving module3310is configured to receive a query request transmitted by the guest terminal, the query request carrying the user account, the first identification information, and the second identification information; and the generation module3330includes: an extraction unit3331configured to extract the user account and the first identification information from the query request; and a third generation module3332, configured to generate the dynamic key key1according to the user account and the first identification information by using a dynamic key generation algorithm.

The apparatus further includes: a first synchronization module3350configured to synchronize the first identification information, a shared key, and an authorization range of the shared key with the authorizer terminal corresponding to the wireless access point, the authorization range including at least one user account; the second receiving module3310configured to receive a second check request transmitted by the wireless access point, the second check request being generated based on the user account of the guest terminal, the first identification information, and the shared key; the verification module3360configured to: verify, according to the second check request, whether the user account falls within the authorization range of the shared key, and generate a second authorization result according to a verification result; and the second transmission module3370configured to transmit the second authorization result to the guest terminal by using the wireless access point.

FIG.33is a schematic structural diagram of a wireless network access apparatus according to an exemplary embodiment. The apparatus may be applied to a guest terminal3200that runs a first application program. The apparatus includes: an obtaining module3220configured to obtain identification information of at least one wireless access point around the guest terminal; and a first display module3210configured to display a wireless network access interface, the wireless network access interface including a classified secure wireless network area and common wireless network area, the secure wireless network area being used for displaying first identification information and a first connection control, and the common wireless network area being used for displaying second identification information and a second connection control; the first display module3210being configured to: display a wireless network connection interface in response to receiving a trigger signal for the first connection control, the wireless network connection interface being used for displaying progress prompt information of a wireless network connection process, and the wireless network connection process being an authentication process performed based on a user account and a media access control address of the guest terminal, and the first identification information; and the first display module3210being configured to display a network connection result interface after the wireless network connection process is completed, the network connection result interface being used for displaying a connection result of a wireless access point corresponding to the first identification information.

The apparatus further includes: a first transmission module3230configured to transmit the user account and the identification information to a server; a first receiving module3240configured to receive a dynamic key key1transmitted by the server, the dynamic key key1being generated by the server according to the user account and the first identification information; and a determining module3250configured to: determine identification information that feeds back the dynamic key key1as the first identification information, and determine identification information that does not include the dynamic key key1as the second identification information.

The first display module3210includes: a first generation unit3214configured to generate a first MIC according to the dynamic key key1and the first identification information; a transmission unit3211configured to transmit a first access request to the wireless access point, the first access request carrying the first MIC and a MAC address; a receiving unit3212configured to receive a first authorization result transmitted by the wireless access point, the first authorization result being generated by the server after verifying the first MIC by using the dynamic key key1found according to the MAC address; and a display unit3213configured to display a prompt text of the first authorization result on the wireless network connection interface when the first authorization result is “authorized”.

The first generation unit3214includes: a filling subunit32141configured to fill a connection password field with the dynamic key key1; and a generation subunit32142configured to generate the first MIC according to the dynamic key key1and the first identification information by using a MIC generation algorithm.

In addition, the transmission unit3211is configured to transmit the first access request by the first application program in a standard WPA2 encryption manner, the first access request carrying the first MIC and the MAC address.

Further, the first application program is a sub-application program, and the sub-application program may depend on the parent application program to run.

The apparatus further includes: the obtaining module3220configured to obtain, by using the parent application program, first identification information of a wireless access point and a shared key that are shared by an authorizer terminal; the first transmission module3230configured to transmit a second access request to the wireless access point according to the first identification information of the wireless access point and the shared key; and the first receiving module3240configured to receive a second authorization result transmitted by the wireless access point, the second authorization result being determined by the server according to whether the user account falls within an authorization range of the shared key.

The obtaining module3220is configured to scan a graphic code shared by the authorizer terminal; and the parent application program invokes the sub-application program to extract the first identification information of the wireless access point and the shared key from the graphic code; or the obtaining module3220is configured to receive a card message shared by the authorizer terminal, the card message corresponding to a link; and when receiving a trigger signal for the card message, the parent application program extracts the first identification information of the wireless access point and the shared key from the card message by invoking the sub-application program according to the link.

FIG.34is a schematic structural diagram of a wireless network access apparatus according to an embodiment. The apparatus may be applied to an authorizer terminal3400that runs a second application program. The apparatus includes: a third receiving module3410configured to receive an authorization request transmitted by a server, the authorization request being a request of a guest terminal for requesting to access a wireless access point, and the authorization request carrying a user account of the guest terminal; a second display module3420configured to display an authorization query interface according to the authorization request, the authorization query interface displaying the user account, a MAC address, and an authorization control; and a third transmission module3430configured to: transmit an agree to authorize response to the server in response to receiving a trigger signal on the authorization control, the agree to authorize response being used for triggering the server to update an authorization library according to a correspondence among the user account, the MAC address, and first identification information.

In addition, the second display module3420is configured to display the authorization query interface on a program interface of the second application program according to the authorization request.

The apparatus further includes: a sharing module3450configured to share first identification information of the wireless access point and a shared key with the guest terminal; a second synchronization module3460configured to synchronize the first identification information, the shared key, and an authorization range of the shared key to the server, the authorization range including at least one user account; and the second display module3420configured to display an access notification interface, the access notification interface displaying a notification message indicating that the guest terminal successfully accesses the wireless access point, the notification message being transmitted by the server based on the server verifying, according to a second check request, that the user account of the guest terminal falls within the authorization range of the shared key, and the second check request being generated by the guest terminal according to the user account, the first identification information, and the shared key.

In addition, the sharing module3450is configured to display a graphic code, the graphic code carrying the first identification information of the wireless access point and the shared key; or the sharing module3450is configured to transmit a card message to the guest terminal by using a parent application program, the card message carrying a link, and the link corresponding to the first identification information of the wireless access point and the shared key; and the parent application program including an application program installed on both the authorizer terminal and the guest terminal.

FIG.35is a schematic structural diagram of a wireless network access apparatus according to an embodiment. The apparatus may be applied to a wireless access point3500, and the apparatus includes: a fourth receiving module3510configured to receive a first access request transmitted by a guest terminal, the first access request carrying a MAC address and a first MIC of the guest terminal, and the first MIC being generated by the guest terminal according to a dynamic key key1and first identification information; and a fourth transmission module3520configured to transmit, to a server, a first check request that carries the first MIC;

The fourth transmission module3520may be further configured to: feedback a first authorization result to the guest terminal in response to receiving the first authorization result fed back by the server, the first authorization result being generated by the server according to a verification result of the first MIC.

The fourth transmission module3520may be further configured to transmit an encrypted first check request to the server, the first check request carrying the first MIC, the MAC address, and the first identification information of the wireless access point.

The fourth receiving module3510is configured to receive the first access request transmitted by the guest terminal in a standard WPA2 encryption manner.

The apparatus further includes: a registration module3530configured to register the first identification information of the wireless access point with the server by using a registration key, the registration key being a key pre-allocated by the server for a registration process.

The apparatus further includes: the fourth receiving module3510configured to receive a second access request transmitted by the guest terminal, the second access request being generated by the guest terminal according to a graphic code or a card message shared by an authorizer terminal, and the second access request carrying a user account of the guest terminal, the first identification information, and a shared key; and the fourth transmission module3520configured to: generate a second check request according to the user account, the first identification information, and the shared key, and transmit the second check request to the server;

The fourth transmission module3520may be further configured to: feedback a second authorization result to the guest terminal in response to receiving the second authorization result fed back by the server, the second authorization result being generated by the server by verifying, according to the second check request, whether the user account falls within an authorization range corresponding to the shared key.

The wireless network access apparatus provided in the foregoing embodiments is illustrated with an example of division of the foregoing function modules. In practical application, the foregoing functions may be allocated to and completed by different function modules according to requirements, that is, the structure of the apparatus is divided into different function modules, so as to describe all or part of the functions of the apparatus. In addition, the wireless network access apparatus provided by the foregoing embodiments are based on the same concept as the wireless network access method in the foregoing method embodiments. For the specific implementation process, refer to the method embodiments, and the details are not described herein again.

FIG.36is a structural block diagram of a terminal3600according to an embodiment. The terminal3600may be a guest terminal or an authorizer terminal. The terminal3600may be a smartphone, a tablet computer, a Moving Picture Experts Group Audio Layer III (MP3) player, a Moving Picture Experts Group Audio Layer IV (MP4) player, a laptop computer, or a desktop computer. The terminal3600may also be referred to as another name such as user equipment, a portable terminal, a laptop terminal, or a desktop terminal.

The terminal3600includes a processor3601and a memory3602.

The processor3601may include one or more processors including, for example, a 4-core processor or an 8-core processor. The processor3601may be implemented in at least one hardware form of a digital signal processor (DSP), a field-programmable gate array (FPGA), and a programmable logic array (PLA). The processor3601may also include a main processor and a coprocessor. The main processor is a processor configured to process data in an awake state, and is also referred to as a central processing unit (CPU). The coprocessor is a low power consumption processor configured to process the data in a standby state. In some embodiments, the processor3601may be integrated with a graphics processing unit (GPU). The GPU is configured to render and draw content that needs to be displayed on a display screen. In some embodiments, the processor3601may further include an artificial intelligence (AI) processor. The AI processor is configured to process computing operations related to machine learning.

The memory3602may include one or more computer-readable storage media. The computer-readable storage medium may be non-transient. The memory3602may further include a high-speed random access memory and a nonvolatile memory, for example, one or more disk storage devices or flash storage devices. In some embodiments, the non-transitory computer-readable storage medium in the memory3602is configured to store at least one instruction, and the at least one instruction being configured to be executed by the processor3601to implement the method for observing a virtual environment provided in the method embodiments.

In some embodiments, the terminal3600may alternatively include: a peripheral device interface3603and at least one peripheral device. The processor3601, the memory3602, and the peripheral device interface3603may be connected by a bus or a signal line. Each peripheral device may be connected to the peripheral device interface3603by using a bus, a signal cable, or a circuit board. Specifically, the peripheral device includes at least one of a radio frequency circuit3604, a touch display screen3605, a camera3606, an audio circuit3607, a positioning component3608, and a power supply3609.

The peripheral interface3603may be configured to connect the at least one peripheral related to input/output (I/O) to the processor3601and the memory3602. In some embodiments, the processor3601, the memory3602and the peripheral device interface3603are integrated on a same chip or circuit board. In some embodiments, any one or two of the processor3601, the memory3602, and the peripheral device interface3603may be implemented on a single chip or circuit board. However, the peripheral interface3603is not limited thereto.

The RF circuit3604is configured to receive and transmit an RF signal, also referred to as an electromagnetic signal. The RF circuit3604communicates with a communication network and other communication devices through the electromagnetic signal. The RF circuit3604converts an electrical signal into an electromagnetic signal for transmission, or converts a received electromagnetic signal into an electrical signal. The RF circuit3604includes: an antenna system, an RF transceiver, one or more amplifiers, a tuner, an oscillator, a digital signal processor, a codec chip set, a subscriber identity module card, and the like. The RF circuit3604may communicate with other terminals by using at least one wireless communication protocol. The wireless communication protocol includes, but is not limited to, a world wide web, a metropolitan area network, an intranet, generations of mobile communication networks (2G, 3G, 4G, and 5G), a wireless local area network and/or a wireless fidelity (Wi-Fi) network. In some embodiments, the RF3604may further include a circuit related to NFC, which is not limited in this application.

The display screen3605is configured to display a user interface (UI). The UI may include a graph, text, an icon, a video, and any combination thereof. When the display screen3605is a touch display screen, the display screen3605also has the capability to collect a touch signal on or above a surface of the display screen3605. The touch signal may be inputted to the processor3601as a control signal for processing. In this case, the display screen3605may be further configured to provide a virtual button and/or a virtual keyboard, which is also referred to as a soft button and/or a soft keyboard. In some embodiments, there may be one display screen3605disposed on a front panel of the terminal3600. In some other embodiments, there may be at least two display screens3605respectively disposed on different surfaces of the terminal3600or designed in a foldable shape. In still some other embodiments, the display screen3605may be a flexible display screen disposed on a curved surface or a folded surface of the terminal3600. Even, the display screen3605may be further set in a non-rectangular irregular pattern, namely, a special-shaped screen. The display screen3605may be prepared by using materials such as a liquid crystal display (LCD), an organic light-emitting diode (OLED), or the like.

The camera component3606is configured to capture images or videos. The camera component3606includes a front-facing camera and a rear-facing camera. Generally, the front-facing camera is disposed on the front panel of the terminal, and the rear-facing camera is disposed on a back surface of the terminal. In some embodiments, there are at least two rear cameras, which are respectively any of a main camera, a depth-of-field camera, a wide-angle camera, and a telephoto camera, to render background blur through fusion of the main camera and the depth-of-field camera, panoramic photographing and virtual reality (VR) photographing through fusion of the main camera and the wide-angle camera, or other fusion photographing functions. In some embodiments, the camera component3606may further include a flash. The flash may be a monochrome temperature flash, or may be a double color temperature flash. The double color temperature flash refers to a combination of a warm light flash and a cold light flash, and may be used for light compensation under different color temperatures.

The audio circuit3607may include a microphone and a speaker. The microphone is configured to collect sound waves of a user and an environment, and convert the sound waves into an electrical signal to input to the processor3601for processing, or input to the radio frequency circuit3604for implementing voice communication. For a purpose of stereo collection or noise reduction, there may be a plurality of microphones disposed at different portions of the terminal3600respectively. The microphone may further be an array microphone or an omni-directional collection type microphone. The speaker is configured to convert an electrical signal from the processor3601or the radio frequency circuit3604into acoustic waves. The speaker may be a conventional film speaker, or may be a piezoelectric ceramic speaker. When the speaker is the piezoelectric ceramic speaker, the speaker not only can convert an electric signal into acoustic waves audible to a human being, but also can convert an electric signal into acoustic waves inaudible to a human being, for ranging and other purposes. In some embodiments, the audio circuit3607may also include an earphone jack.

The positioning component3608is configured to position a current geographic location of the terminal3600, to implement navigation or a location based service (LBS). The positioning component3608may be a positioning component based on the global positioning system (GPS) of the United States, the BeiDou System of China, and the GALILEO System of Russia.

The power supply3609is configured to supply power to components in the terminal3600. The power supply3609may be an alternating current, a direct current, a disposable battery, or a rechargeable battery. When the power supply3609includes a rechargeable battery, and the rechargeable battery may be a wired rechargeable battery or a wireless rechargeable battery. The wired rechargeable battery is a battery charged through a wired circuit, and the wireless rechargeable battery is a battery charged through a wireless coil. The rechargeable battery may be further configured to support a fast charging technology.

In some embodiments, the terminal3600may further include one or more sensors3610. The one or more sensors3610include, but are not limited to: an acceleration sensor3611, a gyroscope sensor3612, a pressure sensor3613, a fingerprint sensor3614, an optical sensor3615, and a proximity sensor3616.

The acceleration sensor3611may detect a magnitude of acceleration on three coordinate axes of a coordinate system established by the terminal3600. For example, the acceleration sensor3611may be configured to detect a component of gravity acceleration on the three coordinate axes. The processor3601may control, according to a gravity acceleration signal collected by the acceleration sensor3611, the touch display screen3605to display the user interface in a transverse view or a longitudinal view. The acceleration sensor3611may be further configured to collect data of a game or a user movement.

The gyroscope sensor3612may detect a body direction and a rotation angle of the terminal3600. The gyroscope sensor3612may cooperate with the acceleration sensor3611to collect a 3D action by the user on the terminal3600. The processor3601may implement the following functions according to the data collected by the gyro sensor3612: motion sensing (for example, changing the UI according to a tilt operation of the user), image stabilization during shooting, game control, and inertial navigation.

The pressure sensor3613may be disposed at a side frame of the terminal3600and/or a lower layer of the touchscreen3605. When the pressure sensor3613is disposed on the side frame of the terminal3600, a holding signal of the user on the terminal3600may be detected. The processor3601performs left and right hand recognition or a quick operation according to the holding signal collected by the pressure sensor3613. When the pressure sensor3613is disposed at the lower layer of the touch display screen3605, the processor3601controls an operable control on the UI interface according to a pressure operation performed by the user on the touch display screen3605. The operable control includes at least one of a button control, a scroll-bar control, an icon control, and a menu control.

The fingerprint sensor3614is configured to collect a user's fingerprint, and the processor3601identifies a user's identity according to the fingerprint collected by the fingerprint sensor3614, or the fingerprint sensor3614identifies a user's identity according to the collected fingerprint. When identifying that the user's identity is a trusted identity, the processor3601authorizes the user to perform related sensitive operations. The sensitive operations include: unlocking a screen, viewing encrypted information, downloading software, paying, changing a setting, and the like. The fingerprint sensor3614may be disposed on a front surface, a rear surface, or a side surface of the terminal3600. When a physical button or a vendor logo is disposed on the terminal3600, the fingerprint3614may be integrated with the physical button or the vendor logo.

The optical sensor3615is configured to collect ambient light intensity. In an embodiment, the processor3601may control the display brightness of the touch display screen3605according to the ambient light intensity collected by the optical sensor3615. Specifically, when the ambient light intensity is relatively high, the display brightness of the touch display screen3605is increased. When the ambient light intensity is relatively low, the display brightness of the touch display screen3605is decreased. In another embodiment, the processor3601may further dynamically adjust a camera parameter of the camera component3606according to the ambient light intensity collected by the optical sensor3615.

The proximity sensor3616, also referred to as a distance sensor, is usually disposed on the front panel of the terminal3600. The proximity sensor3616is configured to collect a distance between a front face of the user and the front face of the terminal3600. In an embodiment, when the proximity sensor3616detects that the distance between the front face of the user and the front face of the terminal3600is gradually decreased, the processor3601controls the display screen3605to switch from a screen-on state to a screen-off state. When the proximity sensor3616detects that the distance between the front face of the user and the front face of the terminal3600is gradually increased, the processor3601controls the display screen3605to switch from the screen-off state to the screen-on state.

A person skilled in the art may understand that the structure shown inFIG.36does not constitute a limitation to the terminal3600, and the terminal may include more components or fewer components than those shown in the figure, or some components may be combined, or a different component deployment may be used.

FIG.37is a schematic structural diagram of a server according to an embodiment. The server is configured to implement the wireless network access method in the foregoing embodiments.

The server3700includes a central processing unit (CPU)3701, a system memory3704including a random access memory (RAM)3702and a read-only memory (ROM)3703, and a system bus3705connecting the system memory3704and the CPU3701. The server3700further includes a basic I/O system3706for transmitting information between components in a computer, and a mass storage device3707used for storing an operating system3713, an application program3714, and another program module3715.

The basic I/O system3706includes a monitor3708configured to display information and an input device3709such as a mouse or a keyboard that is configured for information inputting by a user. The monitor3708and the input device3709are both connected to the CPU3701by using an I/O controller3710connected to the system bus3705. The basic I/O system3706may further include the I/O controller3710, to receive and process inputs from a plurality of other devices, such as the keyboard, the mouse, or an electronic stylus. Similarly, the input/output controller3710further provides an output to a display, a printer or another type of output device.

The large-capacity storage device3707is connected to the CPU3701by using a large-capacity storage controller (not shown) connected to the system bus3705. The large-capacity storage device3707and an associated computer readable medium provide non-volatile storage for the server3700. That is, the mass storage device3707may include a computer readable medium, such as a hard disk or a CD-ROM drive.

A person of ordinary skill in the art may understand that some or all procedures in the methods in the foregoing embodiments may be implemented in a computer-readable instruction instructing related hardware, the program may be stored in a non-volatile computer readable storage medium, and when the program is executed, the procedures in the foregoing method embodiments may be implemented. Any reference to a memory, a storage, a database, or another medium used in the embodiments provided in this application can include a non-volatile and/or volatile memory. The non-volatile memory may include a read-only memory (ROM), a programmable ROM (PROM), an electrically programmable ROM (EPROM), an electrically erasable programmable ROM (EEPROM) or a flash memory. The volatile memory may include a random access memory (RAM) or an external high-speed cache. For the purpose of description instead of limitation, the RAM is available in a plurality of forms, such as a static RAM (SRAM), a dynamic RAM (DRAM), a synchronous DRAM (SDRAM), a double data rate SDRAM (DDR SDRAM), an enhanced SDRAM (ESDRAM), a synchronous link (Synchlink) DRAM (SLDRAM), a RAM bus (Rambus) direct RAM (RDRAM), a direct Rambus dynamic RAM (DRDRAM), and a Rambus dynamic RAM (RDRAM). The system memory3704and the mass storage device3707may be collectively referred to as a memory.

According to various embodiments, the server3700may be connected, by using a network such as the Internet, to a remote computer on the network and run. That is, the server3700may be connected to a network3712by using a network interface unit3711connected to the system bus3705, or may be connected to another type of network or a remote computer system by using the network interface unit3711.

The memory further includes one or more programs. The one or more programs are stored in the memory and configured to be executed by one or more processors. The one or more programs include instructions for performing the following operations: receiving a user account and identification information of a wireless access point that are transmitted by a guest terminal; generating a dynamic key key1according to the user account and the identification information, and transmitting the dynamic key key1to the guest terminal; receiving a first check request transmitted by the wireless access point, the first check request carrying a MAC address, the identification information, and a first MIC; verifying the first MIC according to the dynamic key key1found by using the MAC address, and generating a first authorization result according to a verification result of the first MIC; and transmitting the first authorization result to the guest terminal by using the wireless access point.

FIG.38is a block diagram of a wireless network system3800according to an embodiment. As shown inFIG.38, the communications system3800includes a guest terminal3801, a wireless access point3802, an authorizer terminal3803, and a server3804.

The guest terminal3801, the wireless access point3802, the authorizer terminal3803, and the server3804are configured to perform the wireless network access methods performed in the embodiments shown inFIG.5andFIG.21toFIG.31.

In an embodiment, a computer readable storage medium is further provided. The computer readable storage medium is a non-volatile computer readable storage medium. A computer program is stored in the computer readable storage medium. When the stored computer program is executed by a processing component, the wireless network access method provided in the foregoing embodiments can be implemented.

A computer program product may be provided according to the one or more embodiments of the disclosure. The computer program product stores one or more instructions. When the one or more instructions run on a computer, the computer can perform the wireless network access method provided in the embodiments of the disclosure.

The term “plurality of” in the disclosure means two or more. The term “and/or” describes an association relationship for describing associated objects and represents that three relationships may exist. For example, A and/or B may represent the following cases: Only A, both A and B, and only B.

The term used in the one or more embodiments of the disclosure such as “unit” or “module” indicates a unit for processing at least one function or operation, and may be implemented in hardware (e.g., processor and/or memory), software (e.g., developed using a computer programming language), or in a combination of hardware and software. Each module or unit can be implemented using one or more processors (or processors and memory). Likewise, a processor (or processors and memory) can be used to implement one or more modules or units. Moreover, each module or unit can be part of an overall module or unit that includes the functionalities of the module or unit.

The term “unit” or “module” may be implemented by a program that is stored in an addressable storage medium and executable by a processor.

For example, the term “unit” or “module” may include software components, object-oriented software components, class components and task components, processes, functions, attributes, procedures, subroutines, segments of a program code, drivers, firmware, microcode, circuitry, data, databases, data structures, tables, arrays, and/or variables.

A person of ordinary skill in the art may understand that all or some of the foregoing embodiments may be implemented by using hardware, or may be implemented by a program instructing relevant hardware. The program may be stored in a non-transitory computer-readable storage medium. The storage medium may be a ROM, a magnetic disk, an optical disc, or the like.

The technical features in the foregoing embodiments may be combined or further divided in different manners. To make the description concise, not all possible combinations of the technical features in the foregoing embodiments are described. However, combinations of the technical features shall all be considered as falling within the scope of the disclosure to the extent that the combinations of the technical features do not conflict with each other.

The foregoing embodiments only show several implementations of the disclosure and are described in detail, but should not be construed as limiting the patent scope of the disclosure. A person of ordinary skill in the art may further make variations and improvements without departing from the scope of the disclosure, which all fall within the protection scope of the disclosure. Therefore, the protection scope of the disclosure is subject to the protection scope of the appended claims.