Portal authentication method and system based on kernel

Abstract

The invention relates to a kernel-based Portal authentication method, which comprises the following steps of: capturing an internet access request message sent by a user, and determining to release, discard or redirect to an authentication page according to an interface type, a white list, an authenticated terminal table and a message protocol; and verifying the authentication information submitted by the user, and updating the authenticated terminal information through the procfs to allow the release of subsequent messages. According to the method, user mode copying is avoided through kernel mode message processing, and the throughput is remarkably improved; a large number of iptables rules are not needed, and the configuration complexity and the function conflict risk are reduced; the user mode authentication service ensures stability and security, and supports flexible connection with third-party authentication; the development and maintenance difficulty is reduced through the modular design, and the system stability is enhanced; the method is suitable for network equipment based on a Linux kernel, and high performance and universality are both considered.

Description

Technical Field

[0001] This invention belongs to the technical field of network security and access control, and particularly relates to a kernel-based Portal authentication method and system. Background Technology

[0002] Portal authentication is an access control technology that authenticates users through a web interface. It is widely used in enterprise networks, campus networks, and public Wi-Fi networks to prevent unauthorized users from accessing the internal network and to record authorized user information (such as time, IP, MAC, username, etc.) to improve network security and traceability. Existing Portal authentication implementations mainly fall into two categories: one is a user-space implementation based on the kernel protocol stack, which uses numerous iptables rules to implement whitelisting, discarding of unauthenticated users, and request redirection; the authentication function is performed by the user-space process. The other is a pure user-space implementation based on user-space network card drivers (such as DPDK, VPP), where all functions are performed in user space. The kernel-based user-space implementation utilizes existing kernel modules, resulting in low development and maintenance costs, high flexibility, and support for third-party authentication integration. However, the copying of packets from kernel space to user space significantly reduces throughput, and the large number of iptables rules increases configuration complexity and conflict risks, further impacting performance. While the pure user-space implementation based on user-space network card drivers offers excellent performance, it has high development and maintenance costs, is only applicable to specific user-space network card driver devices, and has limited versatility.

[0003] Currently, many network devices (such as embedded devices, CPEs, and VNFs) are still developed based on the Linux kernel, and there is an urgent need for a solution that balances performance and flexibility. This application proposes a kernel-based Portal authentication method to address the problems of low throughput, complex configuration, or insufficient versatility in existing technologies. Summary of the Invention

[0004] The purpose of this invention is to provide a kernel-based Portal authentication method and system to solve the problems of low message processing throughput, complex configuration, or high development and maintenance costs in existing Portal authentication methods.

[0005] To achieve one of the aforementioned objectives, one embodiment of the present invention provides a kernel-based Portal authentication method, the method comprising:

[0006] Capture user-sent Internet access request packets and decide whether to allow, discard, or redirect to the authentication page based on the interface type, whitelist, authenticated terminal table, and packet protocol;

[0007] Verify the authentication information submitted by the user and update the authenticated terminal information via procfs to allow subsequent messages to pass.

[0008] As a further improvement to one embodiment of the present invention, the method further includes, at system startup, initializing system resources, loading the kernel-mode processing environment, registering the netfilter HOOK function, and configuring blacklists / whitelists, procfs communication interfaces, and WAN and LAN interface attributes, specifically including,

[0009] Load the kernel-mode processing environment to support message processing;

[0010] Initialize the netfilter hook function to support the capture and processing of network packets;

[0011] Configure a whitelist table to store allowed terminal IP / MAC addresses, and initialize an authenticated terminal table to store information on authenticated terminals;

[0012] Create procfs nodes for configuration distribution and status retrieval between kernel mode and user mode;

[0013] Configure WAN and LAN interface properties to differentiate packet processing logic;

[0014] Start the user-mode authentication service process and initialize the authentication page service and the interface for connecting to the third-party authentication service.

[0015] As a further improvement to one embodiment of the present invention, the method further includes, in which the step of determining whether to allow, discard, or redirect to the authentication page based on the interface type, whitelist, authenticated terminal table, and message protocol, includes,

[0016] For LAN interfaces, resolve the source MAC address and IP address of the packet; for WAN interfaces, resolve the destination MAC address and IP address of the packet.

[0017] The whitelist is queried using the resolved MAC address or IP address. If a match is found, the packet is allowed and the processing ends.

[0018] If the whitelist does not match, use the resolved MAC address or IP address to query the authenticated terminal table. If a match is found, allow the packet and end the processing.

[0019] If the authenticated terminal table does not match, redirection or discarding will be performed based on the interface type and message protocol.

[0020] As a further improvement to one embodiment of the present invention, the method further includes, in which the step of performing redirection or dropping based on the interface type and message protocol includes,

[0021] For LAN interfaces, if the packet is TCP and the port is 80 or 8080, it will impersonate the target device to complete the TCP three-way handshake and reply with an HTTP 302 redirect packet to the authentication page;

[0022] For LAN interfaces, if the packet is TCP and the port is 443 or 8443, it impersonates the target device to complete the TCP three-way handshake and TLS handshake, and replies with a refresh redirect packet to the authentication page to adapt to browser security restrictions;

[0023] For LAN interfaces, if the packet is not a TCP protocol or the port is not 80, 8080, 443, or 8443, the packet will be discarded or logged according to the preset policy.

[0024] For WAN interfaces, if neither the whitelist nor the authenticated terminal table matches, the packet is discarded or a security alarm is triggered according to the preset policy.

[0025] As a further improvement to one embodiment of the present invention, the method further includes, in that the authentication information submitted by the user is verified,

[0026] Users submit authentication information, including account, password, or mobile phone number, through the authentication page;

[0027] The user-state authentication service process verifies authentication information and confirms user identity by comparing it with the local database or using encryption algorithms;

[0028] If the verification is successful, an authentication result containing the terminal's IP address and MAC address is generated and sent to the kernel-mode access control module via the procfs node to update the authenticated terminal table.

[0029] As a further improvement to one embodiment of the present invention, the method further includes, in which the step of updating the authenticated terminal information via procfs to allow subsequent packet passage includes,

[0030] The authentication information submitted by the user is sent to a third-party authentication service for verification.

[0031] Receive authentication results returned by third-party authentication services to the user space;

[0032] The user-mode authentication service process receives the authentication result and sends the successfully authenticated terminal IP address and MAC address to the kernel-mode access control module through the procfs node, updating the authenticated terminal table.

[0033] To achieve one of the above-mentioned objectives, an embodiment of the present invention also provides a kernel-based Portal authentication system, the system including a message capture module and an authentication processing module;

[0034] The message capture module is used to capture Internet access request messages sent by users, and decide whether to allow, discard, or redirect to the authentication page based on the interface type, whitelist, authenticated terminal table, and message protocol.

[0035] The authentication processing module is used to verify the authentication information submitted by the user and update the authenticated terminal information through procfs to allow subsequent messages to pass.

[0036] To achieve one of the above-mentioned objectives, an embodiment of the present invention also provides an electronic device, including a memory and a processor, characterized in that the memory stores a computer program that can run on the processor, and when the program is executed on the processor, it implements the steps in the kernel-based Portal authentication method described above.

[0037] To achieve one of the above-mentioned objectives, an embodiment of the present invention also provides a storage medium storing a computer program, characterized in that the computer program, when executed by a processor, implements the steps in the kernel-based Portal authentication method described above.

[0038] Compared with existing technologies, this invention provides a kernel-based Portal authentication method and system that avoids user-space copying through kernel-mode packet processing, significantly improving throughput; it eliminates the need for a large number of iptables rules, reducing configuration complexity and the risk of functional conflicts; the user-mode authentication service ensures stability and security, and supports flexible integration with third-party authentication; the modular design reduces development and maintenance difficulty and enhances system stability; it is applicable to Linux kernel-based network devices, balancing high performance and versatility. Attached Figure Description

[0039] Figure 1 This is an overall flowchart of the kernel-based Portal authentication method described in this invention.

[0040] Figure 2 This is a schematic diagram of the LAN interface processing flow of the kernel-based Portal authentication method described in this invention.

[0041] Figure 3 This is a schematic diagram of the WAN interface processing flow of the kernel-based Portal authentication method described in this invention.

[0042] Figure 4 This is a schematic diagram of the architecture of the kernel-based Portal authentication system described in this invention. Detailed Implementation

[0043] The present invention will now be described in detail with reference to the specific embodiments shown in the accompanying drawings. However, these embodiments do not limit the present invention, and any structural, methodological, or functional modifications made by those skilled in the art based on these embodiments are included within the scope of protection of the present invention.

[0044] Embodiments of the present invention are described in detail below. Examples of these embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present invention, and should not be construed as limiting the present invention.

[0045] In Embodiment 1 of the present invention, the present invention provides a kernel-based Portal authentication method, such as... Figure 1 As shown, the method includes,

[0046] S1: Capture the Internet access request packets sent by the user, and decide whether to allow, discard, or redirect to the authentication page based on the interface type, whitelist, authenticated terminal table, and packet protocol;

[0047] S2: Verify the authentication information submitted by the user and update the authenticated terminal information via procfs to allow subsequent messages to pass.

[0048] In one specific embodiment of the present invention, during system startup, system resources are initialized, the kernel-mode processing environment is loaded, the netfilter hook function is registered, and blacklists / whitelists, procfs communication interfaces, and WAN and LAN interface attributes are configured. Specifically,

[0049] Load the kernel-mode processing environment to support message processing;

[0050] Initialize the netfilter hook function to support the capture and processing of network packets;

[0051] Configure a whitelist table to store allowed terminal IP / MAC addresses, and initialize an authenticated terminal table to store information on authenticated terminals;

[0052] Create procfs nodes for configuration distribution and status retrieval between kernel mode and user mode;

[0053] Configure WAN and LAN interface properties to differentiate packet processing logic;

[0054] Start the user-mode authentication service process and initialize the authentication page service and the interface for connecting to the third-party authentication service.

[0055] It should be noted that initializing system resources is used to configure the necessary processing environment and data structures to support subsequent message processing and user authentication functions.

[0056] Furthermore, by loading kernel modules, a kernel-mode runtime environment is established to ensure the system can efficiently process network packets. Kernel modules allocate memory and resources by calling the Linux kernel's initialization interface, providing support for subsequent packet capture, querying, and redirection operations. This step ensures that packet processing is completed in kernel mode, avoiding user-mode copying, improving system throughput, and meeting the performance requirements of kernel-based network devices (such as embedded devices, CPEs, and VNFs).

[0057] Furthermore, the initialization phase configures the netfilter framework and initializes hook functions to capture network packets and support subsequent processing logic. These hook functions are registered in the kernel network protocol stack to intercept TCP-related packets (such as HTTP / HTTPS requests) and perform allow, drop, or redirect operations based on whitelists, authentication status, and protocol type. This step leverages the versatility and flexibility of the netfilter framework to ensure efficient and stable packet processing, laying the foundation for subsequent LAN / WAN interface processing.

[0058] Furthermore, during initialization, a whitelist table and an authenticated terminal table are created to store terminal identifiers (including combinations of IP addresses and MAC addresses) that are allowed to pass directly, and information about authenticated terminals, respectively. The whitelist table stores statically configured IP and MAC address pairs for management terminals or specific devices to allow packets to pass without authentication; the authenticated terminal table dynamically stores information about successfully authenticated terminals and is updated via procfs during the authentication process. This step utilizes efficient data structures (such as hash tables) to enable fast lookups and supports terminal status matching during packet processing.

[0059] Furthermore, virtual nodes are created using the Linux procfs file system to serve as the communication interface between kernel space and user space. These nodes support the sending of configuration information (such as whitelist updates and authentication results) from user space to kernel space and the sending of status information (such as the list of authenticated terminals) from kernel space to user space. The implementation of the procfs node is based on standard file operation interfaces, ensuring reliable communication and low overhead, and providing support for dynamic updates of authentication results and adjustments to message processing rules.

[0060] Furthermore, during the initialization phase, the WAN and LAN interfaces of network devices are identified, and corresponding attribute parameters are configured to differentiate packet processing logic. LAN interfaces handle terminal requests from the internal network, requiring the execution of authentication-related redirection operations (such as HTTP / HTTPS redirection); WAN interfaces handle packets from the external network, primarily performing allow or drop operations. This step is accomplished through the kernel's network interface management function, ensuring that packet processing can employ different rules based on interface type, enhancing the system's flexibility and targeted approach.

[0061] Furthermore, the authentication service process initializes the authentication page service by loading the web server module, ensuring that unauthenticated users can access the web authentication interface after being redirected. The authentication page allows users to enter their username, password, or mobile phone number and transmits authentication information via HTTP / HTTPS protocols. Simultaneously, it configures a third-party authentication service interface to support sending authentication information to an external authentication server for verification. This step ensures that the authentication service can run stably in user space and collaborates efficiently with the kernel-level access control module through procfs, supporting flexible local and third-party authentication scenarios and is suitable for Linux kernel-based network devices.

[0062] In one specific embodiment of the present invention, the decision to allow, discard, or redirect to the authentication page is made based on the interface type, whitelist, authenticated terminal table, and message protocol. Specifically,

[0063] For LAN interfaces, resolve the source MAC address and IP address of the packet; for WAN interfaces, resolve the destination MAC address and IP address of the packet.

[0064] The whitelist is queried using the resolved MAC address or IP address. If a match is found, the packet is allowed and the processing ends.

[0065] If the whitelist does not match, use the resolved MAC address or IP address to query the authenticated terminal table. If a match is found, allow the packet and end the processing.

[0066] If the authenticated terminal table does not match, redirection or discarding will be performed based on the interface type and message protocol.

[0067] It should be noted that, as Figure 2 , 3 As shown, the system determines whether to allow, discard, or redirect to the authentication page based on the interface type, whitelist, authenticated terminal table, and message protocol. This aims to ensure access control for unauthorized users and normal access for authorized users by processing network packets in kernel space through the netfilter framework.

[0068] Furthermore, for packets received via the LAN interface, the system uses the netfilter framework to parse the source MAC address and IP address of the packet to identify the requesting terminal user; for packets received via the WAN interface, the system parses the destination MAC address and IP address to determine the target terminal. This step utilizes the packet parsing function of the kernel network protocol stack to extract the MAC and IP addresses as terminal identifiers, supporting subsequent whitelist and authenticated terminal table queries, ensuring that the processing logic can accurately distinguish terminal users based on the interface type.

[0069] Furthermore, the resolved MAC address or IP address is used to query the whitelist table, which stores the identifiers of terminals allowed to pass directly (including combinations of IP addresses and MAC addresses). The whitelist table contains identification information for pre-configured management terminals or specific devices. If the MAC address or IP address of the packet matches any record in the whitelist table, the packet is allowed to pass directly, ending the processing flow for the current packet. This step supports flexible matching logic through an efficient query mechanism (such as hash table lookup), allowing queries to be performed using either the MAC address or IP address alone, reducing unnecessary authentication processing and improving system performance.

[0070] Furthermore, if the packet's MAC address or IP address does not match the whitelist, the system further queries the authenticated terminal table, which stores information about authenticated terminals (including IP addresses and MAC addresses). The authenticated terminal table is dynamically updated by the authentication process via procfs. If the packet's MAC address or IP address matches a record in the authenticated terminal table, it indicates that the terminal has been authenticated, the packet is allowed to pass, and the current processing flow ends. This step supports individual queries for MAC addresses or IP addresses, ensuring that successfully authenticated terminals can access network resources normally while maintaining query efficiency.

[0071] Furthermore, if the MAC address and IP address of the packet do not match either the whitelist or the authenticated terminal list, the packet's Layer 4 protocol (such as TCP) and port number are further parsed, and differentiated processing is performed based on the interface type (LAN or WAN). For LAN interfaces, a redirection operation is triggered based on the packet protocol and port, guiding unauthenticated users to the authentication page; for WAN interfaces, the packet is directly discarded to prevent unauthorized access. This step achieves accurate packet classification through joint judgment of interface type and protocol, ensuring that unauthenticated users are guided to the authentication process or blocked from access, thus protecting the security of network resources.

[0072] In one specific embodiment of the present invention, redirection or discarding is performed based on the interface type and message protocol, specifically as follows:

[0073] For LAN interfaces, if the packet is TCP and the port is 80 or 8080, it will impersonate the target device to complete the TCP three-way handshake and reply with an HTTP 302 redirect packet to the authentication page;

[0074] For LAN interfaces, if the packet is TCP and the port is 443 or 8443, it impersonates the target device to complete the TCP three-way handshake and TLS handshake, and replies with a refresh redirect packet to the authentication page to adapt to browser security restrictions;

[0075] For LAN interfaces, if the packet is not a TCP protocol or the port is not 80, 8080, 443, or 8443, the packet will be discarded or logged according to the preset policy.

[0076] For WAN interfaces, if neither the whitelist nor the authenticated terminal table matches, the packet is discarded or a security alarm is triggered according to the preset policy.

[0077] It should be noted that the steps of redirecting or dropping messages based on interface type and message protocol are designed to classify and process messages from unauthenticated users in kernel space using the netfilter framework. This ensures that unauthenticated users are redirected to the authentication page or prevented from accessing network resources, while also supporting logging and security alerts to enhance system security.

[0078] Furthermore, for TCP protocol packets received through the LAN interface, if their destination port is 80 or 8080 (corresponding to HTTP requests), the system uses the netfilter framework to impersonate the target device and complete a TCP three-way handshake with the end user to establish a connection. Subsequently, the system receives the end user's HTTP request and generates an HTTP 302 redirect response, instructing the browser to redirect to the web authentication page provided by the user-space authentication service process. This step utilizes the standard HTTP redirection mechanism to ensure that unauthenticated users are effectively guided to the authentication process while maintaining connection stability.

[0079] Furthermore, for TCP packets received through the LAN interface, if the destination port is 443 or 8443 (corresponding to HTTPS requests), the system uses the netfilter framework to impersonate the target device, first completing a TCP three-way handshake to establish a connection, and then completing a TLS handshake to meet the security requirements of the HTTPS protocol. Since browsers do not accept HTTPS 302 redirect responses for security reasons, the system generates a response message containing a refresh instruction, guiding the browser to automatically redirect to the authentication page. This step adapts to the browser's security restrictions on HTTPS through the refresh mechanism, ensuring that unauthenticated users can be effectively guided to the authentication page while maintaining protocol compatibility and user experience.

[0080] Furthermore, for packets received through the LAN interface, if the protocol is not TCP or the port is not 80, 8080, 443, or 8443, the system directly discards the packets via the netfilter framework to prevent unauthorized users from accessing network resources. According to preset policies, the system can record information about unauthorized access packets (such as source MAC address, IP address, protocol type, port number, and timestamp) in the kernel log or transmit it to user space via procfs for storage and analysis. This logging function is an optional policy that allows network administrators to monitor unauthorized access behavior, enhancing system security and traceability while maintaining low-overhead processing efficiency, making it suitable for network environments requiring high security.

[0081] Furthermore, for packets received through the WAN interface, if their destination MAC address and IP address do not match the whitelist or authenticated terminal list, it indicates that the packet originated from an unauthenticated terminal. The system directly discards the packet via the netfilter framework to prevent unauthorized external access. According to preset policies, the system can trigger security alarms, recording detailed information about unauthorized access (such as destination MAC address, IP address, protocol type, and timestamp) in the kernel log, or notifying the user-space authentication service process via procfs to send a warning to the network administrator. This alarm function enhances the system's security capabilities and is suitable for enterprise networks or public Wi-Fi scenarios, ensuring that unauthorized access is detected and handled promptly.

[0082] In one specific embodiment of the present invention, verifying the authentication information submitted by the user specifically involves:

[0083] Users submit authentication information, including account, password, or mobile phone number, through the authentication page;

[0084] The user-state authentication service process verifies authentication information and confirms user identity by comparing it with the local database or using encryption algorithms;

[0085] If the verification is successful, an authentication result containing the terminal's IP address and MAC address is generated and sent to the kernel-mode access control module via the procfs node to update the authenticated terminal table.

[0086] It should be noted that the purpose of verifying the authentication information submitted by the user is to complete the verification of the authentication information through the user-mode authentication service process, and to pass the authentication result to the kernel-mode access control module through procfs to update the authenticated terminal table, thereby allowing successfully authenticated terminals to access network resources.

[0087] Furthermore, when an unauthenticated user's message is redirected to the authentication page, the user accesses the web authentication page provided by the user-state authentication service process through a browser and enters authentication information, such as username, password, or mobile phone number. This information is submitted to the user-state authentication service process in form format via HTTP or HTTPS protocol. The authentication page is generated by a lightweight web server module (such as an embedded HTTP server), supports a secure user interface, and ensures that users can complete authentication in a convenient way. This step supports multiple authentication information formats to adapt to the needs of different network environments.

[0088] Furthermore, after receiving the authentication information submitted by the user, the user-mode authentication service process verifies the legitimacy of the user's identity by comparing it with the local database or using encryption algorithms. The local database stores pre-configured user credentials, such as hash values ​​of usernames and passwords, and mobile phone numbers. The authentication information entered by the user is verified through direct comparison or hash verification. Encryption algorithms are used to process the encrypted authentication information, ensuring the security and reliability of the verification process. If the authentication information passes verification, indicating that the user's identity is legitimate, the user-mode authentication service process generates an authentication result containing the terminal's IP address and MAC address. The IP address and MAC address are extracted from the user request message and serve as the unique identifier of the terminal, ensuring that the authentication result can match the terminal in subsequent message processing. This step, through a flexible verification mechanism, ensures that only legitimate users gain network access permissions.

[0089] Furthermore, if user authentication is successful, the user-space authentication service process generates an authentication result containing the terminal's IP address and MAC address, and sends the result to the kernel-space access control module via the procfs file system. The procfs node is implemented based on the Linux file system interface, supporting user-space data transfer to the kernel via standard write operations. After receiving the authentication result, the kernel-space access control module updates the authenticated terminal table, recording the successfully authenticated terminal's IP address and MAC address as an allowable identifier. This step, through the efficient procfs communication mechanism, ensures that the authentication result is reflected in the message processing flow in a timely manner, allowing successfully authenticated terminals to access network resources normally, while maintaining low system overhead and high performance.

[0090] In one specific embodiment of the present invention, the authenticated terminal information is updated via procfs to allow subsequent packets to pass. Specifically,

[0091] The authentication information submitted by the user is sent to a third-party authentication service for verification.

[0092] Receive authentication results returned by third-party authentication services to the user space;

[0093] The user-mode authentication service process receives the authentication result and sends the successfully authenticated terminal IP address and MAC address to the kernel-mode access control module through the procfs node, updating the authenticated terminal table.

[0094] It should be noted that updating the authenticated terminal information via procfs to allow subsequent packets to pass is intended to verify the user's identity through interaction between the user-space authentication service process and the third-party authentication service, and to pass the authentication result to the kernel-space access control module to update the authenticated terminal table, thereby realizing network access control for successfully authenticated terminals.

[0095] Furthermore, after a user submits authentication information through the authentication page, the user-state authentication service process sends this information to a third-party authentication service for verification using a standard protocol. Authentication information is extracted from the user request message and transmitted to the third-party service through a secure communication channel, ensuring data integrity and confidentiality.

[0096] Furthermore, after completing user authentication, the third-party authentication service returns the authentication result to the user-mode authentication service process. The authentication result includes whether the verification was successful and the identifier information of the successfully authenticated terminal. The user-mode authentication service process parses the returned data to confirm the terminal user's authentication status and extracts the IP address and MAC address of the successfully authenticated terminal. This step ensures that the verification result from the third-party authentication can be effectively received and processed by the local system, providing a reliable basis for subsequent status updates.

[0097] Furthermore, for successfully authenticated terminals, the user-space authentication service process sends the authentication result, including the terminal's IP address and MAC address, to the kernel-space access control module via the procfs file system. The procfs node is implemented based on the Linux file system interface, supporting user-space data transfer to the kernel via standard write operations. After receiving the authentication result, the kernel-space access control module updates the authenticated terminal table, recording the successfully authenticated terminal's IP address and MAC address as an identifier for allowing access. This step, through the efficient procfs communication mechanism, ensures that the authentication result is reflected in the message processing flow in a timely manner, allowing successfully authenticated terminals to access network resources normally.

[0098] In a second embodiment of the present invention, the present invention provides a kernel-based Portal authentication system, such as... Figure 4 As shown, the system includes a message capture module 1 and an authentication processing module 2;

[0099] The message capture module 1 is used to capture the Internet access request messages sent by the user, and decide whether to allow, discard or redirect to the authentication page based on the interface type, whitelist, authenticated terminal table and message protocol;

[0100] The authentication processing module 2 is used to verify the authentication information submitted by the user and update the authenticated terminal information through procfs to allow subsequent messages to pass.

[0101] In a third embodiment of the present invention, the present invention provides an electronic device, including a memory and a processor, characterized in that the memory stores a computer program that can run on the processor, and when the program is executed on the processor, it implements the steps in the kernel-based Portal authentication method as described above.

[0102] In a fourth embodiment of the present invention, the present invention provides a storage medium storing a computer program, characterized in that the computer program, when executed by a processor, implements the steps in the kernel-based Portal authentication method as described above.

[0103] In summary, the present invention provides a kernel-based Portal authentication method and system that avoids user-space copying through kernel-mode packet processing, significantly improving throughput; it eliminates the need for numerous iptables rules, reducing configuration complexity and the risk of functional conflicts; the user-mode authentication service ensures stability and security, and supports flexible integration with third-party authentication; the modular design reduces development and maintenance difficulty and enhances system stability; it is suitable for Linux kernel-based network devices, balancing high performance and versatility.

[0104] Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working process of the modules described above can be referred to the corresponding process in the aforementioned method implementation, and will not be repeated here.

[0105] The modules described as separate components may or may not be physically separate. Similarly, the components shown as modules may or may not be physical modules; they may be located in one place or distributed across multiple network modules. Some or all of the modules can be selected to achieve the purpose of this embodiment, depending on actual needs.

[0106] Furthermore, the functional modules in the various embodiments of this application can be integrated into one processing module, or each module can exist physically separately, or two or more modules can be integrated into one module. The integrated module can be implemented in hardware or in a combination of hardware and software functional modules.

[0107] The integrated modules implemented as software functional modules described above can be stored in a computer-readable storage medium. These software functional modules, stored in a storage medium, include several instructions to cause a computer system (which may be a personal computer, server, or network system, etc.) or processor to execute some steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0108] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application.

Claims

1. A kernel-based portal authentication method, characterized in that: include, Capture user-sent Internet access request packets and decide whether to allow, discard, or redirect to the authentication page based on the interface type, whitelist, authenticated terminal table, and packet protocol; Verify the authentication information submitted by the user and update the authenticated terminal information via procfs to allow subsequent messages to pass.

2. The kernel-based Portal authentication method according to claim 1, characterized in that: During system startup, system resources are initialized, the kernel-mode processing environment is loaded, netfilter hook functions are registered, and blacklists / whitelists, procfs communication interfaces, and WAN and LAN interface attributes are configured. Specifically, this includes... Load the kernel-mode processing environment to support message processing; Initialize the netfilter hook function to support the capture and processing of network packets; Configure a whitelist table to store allowed terminal IP / MAC addresses, and initialize an authenticated terminal table to store information on authenticated terminals; Create procfs nodes for configuration distribution and status retrieval between kernel mode and user mode; Configure WAN and LAN interface properties to differentiate packet processing logic; Start the user-mode authentication service process and initialize the authentication page service and the interface for connecting to the third-party authentication service.

3. The kernel-based Portal authentication method according to claim 1, characterized in that: The step of deciding whether to allow, discard, or redirect to the authentication page based on interface type, whitelist, authenticated terminal table, and message protocol includes: For LAN interfaces, parse the source MAC address and IP address of the packet; For WAN interfaces, parse the destination MAC address and IP address of the packets; The whitelist is queried using the resolved MAC address or IP address. If a match is found, the packet is allowed and the processing ends. If the whitelist does not match, use the resolved MAC address or IP address to query the authenticated terminal table. If a match is found, allow the packet and end the processing. If the authenticated terminal table does not match, redirection or discarding will be performed based on the interface type and message protocol.

4. The kernel-based Portal authentication method according to claim 3, characterized in that: The step of performing redirection or discarding based on interface type and message protocol includes, For LAN interfaces, if the packet is TCP and the port is 80 or 8080, it will impersonate the target device to complete the TCP three-way handshake and reply with an HTTP 302 redirect packet to the authentication page; For LAN interfaces, if the packet is TCP and the port is 443 or 8443, it impersonates the target device to complete the TCP three-way handshake and TLS handshake, and replies with a refresh redirect packet to the authentication page to adapt to browser security restrictions; For LAN interfaces, if the packet is not a TCP protocol or the port is not 80, 8080, 443, or 8443, the packet will be discarded or logged according to the preset policy. For WAN interfaces, if neither the whitelist nor the authenticated terminal table matches, the packet is discarded or a security alarm is triggered according to the preset policy.

5. The kernel-based Portal authentication method according to claim 4, characterized in that: The authentication information submitted by the verified user includes, Users submit authentication information, including account, password, or mobile phone number, through the authentication page; The user-state authentication service process verifies authentication information and confirms user identity by comparing it with the local database or using encryption algorithms; If the verification is successful, an authentication result containing the terminal's IP address and MAC address is generated and sent to the kernel-mode access control module via the procfs node to update the authenticated terminal table.

6. The kernel-based Portal authentication method according to claim 5, characterized in that: The step of updating the authenticated terminal information via procfs to allow subsequent message passage includes, The authentication information submitted by the user is sent to a third-party authentication service for verification. Receive authentication results returned by third-party authentication services to the user space; The user-mode authentication service process receives the authentication result and sends the successfully authenticated terminal IP address and MAC address to the kernel-mode access control module through the procfs node, updating the authenticated terminal table.

7. A kernel-based portal authentication system, characterized in that: Includes a message capture module and an authentication processing module; The message capture module is used to capture Internet access request messages sent by users, and decide whether to allow, discard, or redirect to the authentication page based on the interface type, whitelist, authenticated terminal table, and message protocol. The authentication processing module is used to verify the authentication information submitted by the user and update the authenticated terminal information through procfs to allow subsequent messages to pass.

8. An electronic device, comprising a memory and a processor, characterized in that: The memory stores a computer program that can run on the processor, and when the program is executed on the processor, it implements the steps of the kernel-based Portal authentication method as described in any one of claims 1-6.

9. A storage medium storing a computer program, characterized in that: When the computer program is executed by the processor, it implements the steps in the kernel-based Portal authentication method as described in any one of claims 1-6.

Images