Security service control method and wireless local area network terminal

1. A security service control method, comprising:

stopping a WLAN Privacy Infrastructure (WPI) service between a Wireless Local Area Network (WLAN) terminal and an Access Point (AP) when the WLAN terminal creates a security service of an Internet Protocol (IP) layer and/or a layer above the IP layer in TCP/IP model with the AP, wherein

the WPI service comprises: encrypting a data link layer message to be transmitted, and decrypting a received data link layer message;

and wherein executing the operation of stopping the WPI service when a security control module of the WLAN terminal receives a request of creating the security service of the IP layer and/or the layer above the IP layer transmitted by an application layer module of the WLAN terminal; and

creating and initiating, by the security control module, the security service of the IP layer and/or the layer above the IP layer for the application layer module according to the request of creating the security service of the IP layer and/or the layer above the IP layer after the WPI service is stopped.

2. The method according to claim 1 , after the WPI service is stopped, the method further comprising: when the WLAN terminal cancels the security service of the IP layer and/or the layer above the IP layer, completing, by the WLAN terminal, a disassociation procedure with the AP, a re-association procedure with the AP, a user authentication procedure with the AP and a key negotiation procedure with the AP in turn, and using a session key obtained through the key negotiation procedure to recover the WPI service.

3. The method according to claim 1 , wherein the step of stopping the WPI service comprises:

performing, by the WLAN terminal, a disassociation procedure with the WLAN AP, and performing a re-association procedure between the WLAN terminal and the AP after the disassociation procedure succeeds;

performing a user authentication procedure between the WLAN terminal and the AP after the re-association procedure succeeds;

after the user authentication procedure is completed and a unicast key negotiation request transmitted by the AP is received by the WLAN terminal, returning, by the WLAN terminal, a unicast key negotiation failure response to the AP; and

stopping, by the WLAN terminal and the AP, the encryption and decryption of the data link layer message transmitted between the WLAN terminal and the AP.

4. The method according to claim 1 , wherein

only when an application of creating the security service of the IP layer and/or the layer above the IP layer is the application uniquely using WLAN for communication in the WLAN terminal, or besides the application of creating the security service of the IP layer and/or the layer above the IP layer, all other applications using the WLAN for communication in the WLAN terminal have initiated the security service of the IP layer and/or the layer above the IP layer, stopping the WPI service by the WLAN terminal.

5. A WLAN terminal, comprising: an application layer module, a WLAN Authentication Infrastructure (WAI) module and a WPI module, further comprising:

a security control module, configured to receive a request of creating a security service of an IP layer and/or a layer above the IP layer in TCP/IP model transmitted by the application layer module, and stopping a WPI service between the WLAN terminal and a WLAN AP after receiving the request, wherein

the WPI service comprises: encrypting a data link layer message to be transmitted, and decrypting a received data link layer message;

and wherein the security control module is further configured to, after receiving the request of creating the security service of the IP layer and/or the layer above the IP layer, cache the request and transmitting an instruction of stopping the WPI service to the WAI module;

the WAI module is configured to, after receiving the instruction of stopping the WPI service, stop the WPI service between the WLAN terminal and the AP and notify the security control module that the WPI service has been stopped after the WPI service is stopped; and

the security control module is further configured to create and initiate the security service of the IP layer and/or the layer above the IP layer for the application layer module according to the cached request after receiving the notification.

6. The terminal according to claim 5 , wherein

the WAI module is further configured to, after receiving the instruction of stopping the WPI service, complete a disassociation procedure with the WLAN AP, a re-association procedure with the WLAN AP and a user authentication procedure with the WLAN AP in turn; and after receiving a unicast key negotiation request transmitted by the AP, returning a unicast key negotiation failure response to the AP and instructing the WPI module to stop encrypting and decrypting the data link layer message so as to stop the WPI service between the WLAN terminal and the AP.

7. The terminal according to claim 5 , wherein

the security control module is further configured to receive a request of canceling the security service of the IP layer and/or the layer above the IP layer transmitted by the application layer module after the WPI service is stopped, and transmitting an instruction of recovering the WPI service to the WAI module after receiving the request; and

the WAI module is configured to, after receiving the instruction of recovering the WPI service, complete the disassociation procedure with the WLAN AP, the re-association procedure with the WLAN AP, the user authentication procedure with the WLAN AP and the key negotiation with the WLAN AP in turn; and after the key negotiation procedure is completed, transmit a session key obtained through the key negotiation procedure to the WPI module.

8. The terminal according to claim 6 , wherein

the security control module is further configured to, after receiving the request of creating the security service of the IP layer and/or the layer above the IP layer, determine whether there is an application layer module in the WLAN terminal using WLAN for communication but not initiating the security service of the IP layer and/or the layer above the IP layer besides the application layer module transmitting the request of creating the security service of the IP layer and/or the layer above the IP layer, and transmit the instruction of stopping the WPI service only when there is no such application layer module.

9. The terminal according to claim 6 , wherein

the WAI module is configured to instruct the WPI module to stop encrypting and decrypting the data link layer message by transmitting a null key to the WPI module.

10. The terminal according to claim 6 , wherein

the security control module is further configured to receive a request of canceling the security service of the IP layer and/or the layer above the IP layer transmitted by the application layer module after the WPI service is stopped, and transmit an instruction of recovering the WPI service to the WAI module after receiving the request; and

the WAI module is configured to, after receiving the instruction of recovering the WPI service, complete the disassociation procedure with the WLAN AP, the re-association procedure with the WLAN AP, the user authentication procedure with the WLAN AP and the key negotiation with the WLAN AP in turn; and after the key negotiation procedure is completed, transmit a session key obtained through the key negotiation procedure to the WPI module.