Method and system for securely accessing portable hotspot for intelligent mobile phones

1. A method for securely accessing a portable hotspot for intelligent mobile phones, which comprises an intelligent mobile phone used as an access point (AP) and another intelligent mobile phone used as a station (STA), the method comprising following steps of:

A. disposing near field communication (NFC) modules in the AP and the STA respectively;

B. enabling the AP and the STA to perform Wi-Fi Protected Access (WPA) security authentication in an NFC manner, wherein the step B specifically comprises following steps of interacting in the NFC manner:

B1. obtaining a pre-shared key (PSK) and a pairwise master key (PMK) by the AP according to a password, a service set identifier (SSID), an SSID length and 4096;

B2. broadcasting the SSID, a network equipment hardware address of the AP, and a first random number by the AP to the STA; and generating a second random number as well as the PSK and the PMK, obtaining a pairwise transient key (PTK) according to the PMK, the network equipment hardware address of the AP, a network equipment hardware address of the STA, the first random number and the second random number, forming a message integrity check keyword (MIC KEY) according to front 16 bytes of the PTK, and generating an MIC according to the MIC KEY and the 802.1x protocol data by the STA;

B3. transmitting the second random number, the network equipment hardware address of the STA, the 802.1x protocol data and the MIC by the STA to the AP; and obtaining the PTK according to the PMK, the network equipment hardware address of the AP, the network equipment hardware address of the STA, the first random number and the second random number, forming the MIC KEY according to the front 16 bytes of the FIXTK, and then calculating an MIC′ according to the MIC KEY and the 802.1x protocol data by the AP, wherein if MIC=MIC′, then the authentication is successful, and otherwise, the authentication fails;

C. disposing a first data transmission module and a second data transmission module in the AP and the STA respectively so that data encrypted transmission is performed between the AP and the STA via the first data transmission module and the second data transmission module.

2. The method of claim 1 , wherein the WPA security authentication is a WPA-PSK security authentication.

3. The method of claim 1 , wherein the step B2 specifically comprises: obtaining the PSK according to the password, the SSID, the SSID length and 4096 and obtaining the PMK according to the PSK by the STA.

4. A method for securely accessing a portable hotspot for intelligent mobile phones, which comprises an intelligent mobile phone used as an access point (AP) and another intelligent mobile phone used as a station (STA), the method comprising following steps of:

A. disposing NFC modules in the AP and the STA respectively;

B. enabling the AP and the STA to perform WPA security authentication in an NFC manner, wherein the step B specifically comprises following steps of interacting in the NFC manner:

B1. obtaining a PSK and a PMK by the AP according to a password, an SSID, an SSID length and 4096;

B2. broadcasting the SSID, a network equipment hardware address of the AP, and a first random number by the AP to the STA; and generating a second random number as well as the PSK and the PMK, obtaining a FIX according to the PMK, the network equipment hardware address of the AP, a network equipment hardware address of the STA, the first random number and the second random number, forming an MIC KEY according to front 16 bytes of the PTK, and generating an MIC according to the MIC KEY and the 802.1x protocol data by the STA;

B3. transmitting the second random number, the network equipment hardware address of the STA, the 802.1x protocol data and the MIC by the STA to the AP; and obtaining the PTK according to the PMK, the network equipment hardware address of the AP, the network equipment hardware address of the STA, the first random number and the second random number, forming the MIC KEY according to the front 16 bytes of the PTK, and then calculating an MIC′ according to the MIC KEY and the 802.1x protocol data by the AP, wherein if MIC=MIC′, then the authentication is successful, and otherwise, the authentication fails.

5. The method of claim 4 , further comprising following step of:

C. disposing a first data transmission module and a second data transmission module in the AP and the STA respectively so that data encrypted transmission is performed between the AP and the STA via the first data transmission module and the second data transmission module.

6. The method of claim 4 , wherein the WPA security authentication is a WPA-PSK security authentication.

7. The method of claim 4 , wherein the step B2 specifically comprises: obtaining the PSK according to the password, the SSID, the SSID length and 4096 and obtaining the PMK according to the PSK by the STA.

8. A system for securely accessing a portable hotspot for intelligent mobile phones, comprising an intelligent mobile phone used as an AP and another intelligent mobile phone used as an STA, wherein:

the AP comprises an AP NFC module and a first data transmission module;

the STA comprises an STA NFC module and a second data transmission module; and

the AP employs the AP NFC module to perform a WPA security authentication with the STA NFC module of the STA, and employs the first data transmission module to perform data encrypted transmission with the second data transmission module;

wherein the AP NFC module comprises an AP initialization module and a first calculation module; the STA NFC module comprises an STA initialization module and a second calculation module; the AP initialization module calculates a PSK and a PMK according to a password, an SSID, an SSID length and 4096, and generates a first random number, the STA initialization module calculates the PSK and the PMK according to the password, the SSID, the SSID length and 4096, and generates a second random number, the first calculation module obtains a PTK according to the PMK, a network equipment hardware address of the AP, a network equipment hardware address of the STA, the first random number and the second random number, forms an MIC KEY according to front 16 bytes of the PTK, and then calculates an MIC′ according to the MIC KEY and the 802.1x protocol data; and the second calculation module obtains the PTK according to the PMK, the network equipment hardware address of the AP, the network equipment hardware address of the STA, the first random number and the second random number, forms the MIC KEY according to the front 16 bytes of the PTK, and then calculates an MIC according to the MIC KEY and the 802.1x protocol data; and

the AP further comprises an authentication determining module, which is configured to determine whether the MIC′ and the MIC calculated by the first calculation module and the second calculation module respectively are equal to each other.