Network authentication system, network authentication method, cloud server and network device

Abstract

The embodiments of the present application provide a network authentication system, a network authentication method, a cloud server and a network device. In the technical solution provided by the present application, the cloud server manages the first authentication information associated with the network device, and the network device interacts with the cloud server to synchronize the second authentication information stored locally with the first authentication information on the cloud server side; in this way, after the user terminal sends a network access request to the network device, the network device can directly use the second authentication information stored locally to authenticate the user's network access account, with low latency and good user experience. In addition, in the solution of the present application, the cloud server manages the authentication information of each network device, that is, a unified cloud management method, so that the management personnel can uniformly manage multiple network devices in the network through the management interface provided by the cloud server, without having to maintain and manage the authentication information of each network device one by one, thereby improving the management and maintenance efficiency of the local authentication information of the network device.

Description

Technical Field

[0001] The present application relates to the field of Internet technology, and in particular to a network authentication system, a network authentication method, a cloud server and a network device. Background Art

[0002] With the popularization of the Internet and smart phones, Wi-Fi is deployed in many scenarios for users and visitors to access the Internet, especially in university dormitories, large shopping malls or transportation hubs (where the number of Internet users is large and their Internet time is concentrated). Users have a great demand for Internet access and often need to pay to access the network.

[0003] For the above-mentioned relatively centralized Internet access scenario, Web authentication (Portal authentication) is usually more flexible and convenient. When the mobile phone is associated with Wi-Fi, an authentication page pops up, and the user can access the Internet by entering the user name, password or voucher. There are usually two types of Web authentication methods: cloud authentication and local authentication. Cloud authentication means that the authentication server is deployed in the cloud, the authentication device is located locally, and the user authentication process requires message interaction with the cloud authentication server. Local authentication means that the authentication is completed within the local area network of the customer's network site. The authentication process does not need to cross the public network, and the authentication is usually performed on the core or export device of the network. Both authentication methods have some problems in actual application. For example, the cloud authentication method depends on the quality of the Internet, and sometimes the user experience is poor due to large network latency and slow authentication response; the local authentication method requires management personnel to manage each network device, and the management volume is large when there are many network devices. Summary of the invention

[0004] The embodiments of the present application provide a network authentication system, a network authentication method, a cloud server and a network device that can solve or improve the problems of the prior art.

[0005] In one embodiment of the present application, a network authentication system is provided. The network authentication system includes:

[0006] A cloud server, configured to store and update first authentication information associated with the network device;

[0007] a network device, which is in communication connection with the cloud server and stores second authentication information, and is used to update the locally stored second authentication information according to the synchronization information sent by the cloud server when it is determined through interaction with the cloud server that the second authentication information is different from the first authentication information, so that the locally stored second authentication information is consistent with the first authentication information on the cloud server side;

[0008] The network device is further configured to obtain the to-be-authenticated information of the user corresponding to the terminal when receiving the network access request sent by the terminal; and authenticate the to-be-authenticated information based on the second authentication information.

[0009] In another embodiment of the present application, a network authentication method is provided. The method is applicable to a cloud server, and specifically includes:

[0010] updating first authentication information associated with the network device;

[0011] Generate synchronization information according to the updated content of the first authentication information;

[0012] Determining verification information based on the updated first authentication information;

[0013] Associating the synchronization information, the verification information, and an identifier of the network device;

[0014] If a first request from the network device is received, querying the corresponding verification information based on the identifier carried in the first request and sending the queried verification information to the network device, so that the network device determines whether the second authentication information stored locally is consistent with the first authentication information based on the verification information;

[0015] If a second request is received from the network device because the second authentication information is inconsistent with the first authentication information, the synchronization information is obtained based on the identifier carried in the second request, and the synchronization information is sent to the network device, so that the network device uses the synchronization information to update the second authentication information stored locally, and uses the updated second authentication information to perform terminal network access authentication.

[0016] In another embodiment of the present application, a network authentication method is provided. The method is applicable to a network device and specifically includes:

[0017] Based on the synchronization information sent by the cloud server, updating the second authentication information stored locally so that the second authentication information stored locally is consistent with the first authentication information on the cloud server side;

[0018] When receiving a network access request sent by a terminal, obtaining the to-be-authenticated information of the user corresponding to the terminal;

[0019] The information to be authenticated is authenticated according to the second authentication information.

[0020] In another embodiment of the present application, a cloud server is provided. The cloud server includes:

[0021] An authentication information module, used to store and update the first authentication information associated with the network device

[0022] An authentication synchronization module is used to generate synchronization information based on the updated content of the first authentication information; determine verification information based on the updated first authentication information; associate the synchronization information, the verification information and the identifier of the network device; and is also used to communicate with the network device. If a first request from the network device is received, the corresponding verification information is queried based on the identifier carried in the first request and the queried verification information is sent to the network device, so that the network device determines whether the locally stored second authentication information is consistent with the first authentication information based on the verification information; if a second request is received from the network device due to the inconsistency between the second authentication information and the first authentication information, the synchronization information is obtained based on the identifier carried in the second request, and the synchronization information is sent to the network device, so that the network device uses the synchronization information to update the locally stored second authentication information, and uses the updated second authentication information to perform terminal network access authentication.

[0023] In another embodiment of the present application, a network device is provided. The network device includes:

[0024] An authentication cloud management module, used to communicate with the cloud server, and update the second authentication information stored locally based on the synchronization information sent by the cloud server, so that the second authentication information stored locally is consistent with the first authentication information on the cloud server side;

[0025] The local authentication module is used to obtain the to-be-authenticated information of the user corresponding to the terminal when receiving the network access request sent by the terminal; and authenticate the to-be-authenticated information according to the second authentication information.

[0026] In the technical solution provided in the embodiment of the present application, the cloud server manages the first authentication information associated with the network device, and the network device interacts with the cloud server to synchronize the second authentication information stored locally with the first authentication information on the cloud server side; in this way, after the user terminal sends a network access request to the network device, the network device can directly use the second authentication information stored locally to authenticate the user's network access account, with low authentication latency and good user experience. In addition, because the authentication information of each network device is managed by the cloud server in the embodiment of the present application, that is, a unified cloud management method, the management personnel can uniformly manage the authentication information of multiple network devices in the network through the management interface provided by the cloud server, without having to maintain and manage the authentication information of each network device one by one, thereby improving the management and maintenance efficiency of the local authentication information of the network device. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following is a brief introduction to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0028] Figure 1 It is a schematic diagram of the principle of the existing cloud authentication scheme;

[0029] Figure 2 A schematic diagram of a local authentication scheme is shown;

[0030] Figure 3 A schematic diagram of the structure of a network authentication system provided by an embodiment of the present application is shown;

[0031] Figure 4 A schematic diagram of a flow chart of a network authentication method provided by an embodiment of the present application is shown;

[0032] Figure 5 A schematic diagram showing a flow chart of a network authentication method provided by another embodiment of the present application is shown;

[0033] Figure 6 A schematic diagram of the process of synchronizing account information in a network authentication method provided in an embodiment of the present application is shown;

[0034] Figure 7 A schematic diagram of a method for synchronizing page information in a network authentication method provided in an embodiment of the present application is shown;

[0035] Figure 8 A schematic diagram of the process of authenticating and reporting account status in a network authentication method provided in an embodiment of the present application is shown. DETAILED DESCRIPTION

[0036] Figure 1 The schematic diagram of the existing cloud authentication scheme is shown in FIG. Figure 1 As shown in the figure, the user terminal sends an authentication message to the cloud server through the network device. The cloud server authenticates the authentication account and other information carried in the authentication message, and feeds back the corresponding information to the network device after the authentication is passed. The cloud authentication scheme relies on the network latency of the Internet. The authentication of each user terminal needs to go to the cloud server. When the number of authentications is large, the latency will increase further, affecting the user experience. In addition, the cloud authentication scheme has higher requirements for the export bandwidth. When users centrally authenticate and access the Internet, the export bandwidth is likely to become a bottleneck. The service provider who provides network services to users needs to purchase a larger bandwidth, which increases the network cost.

[0037] When implementing a local authentication solution, either a dedicated authentication server is deployed locally, or the authentication function is integrated into the network device and the authentication is completed directly by the network device. Figure 2 A schematic diagram of a local authentication scheme is shown. Figure 2 As shown, the user terminal sends an authentication message to the network device, and the network device sends the authentication message to a locally deployed authentication server, which authenticates the authentication account and other information carried in the authentication message. Figure 2 The local authentication solution shown here has high cost for deploying authentication servers, and has a large workload for implementation and maintenance. Each customer site needs to deploy an authentication server. Another local authentication solution is to integrate authentication functions into network devices, without relying on authentication servers. A gateway device can support user authentication to access the Internet.

[0038] In the local authentication scheme, user authentication is performed directly through message interaction within the LAN. The authentication message response is very fast and the user experience is good. However, the authentication page and account management are troublesome. The administrator needs to log in to each network device network for management, such as creating new user accounts, modifying account passwords, resetting account Internet access time, deleting accounts and other daily operations. This greatly increases the workload and management costs of operation and maintenance personnel. In addition, in the local authentication scheme, the authentication page cannot be flexibly customized. A network device only provides a default authentication page that cannot be modified. For example, the logo and welcome statement of different network customers on the authentication page are different pages and cannot be customized. In addition, in the local authentication scheme, accounts cannot be centrally managed and monitored, and the usage of authentication user accounts under each network device cannot be quickly and conveniently viewed, and statistical reports cannot be generated. It cannot well support the management in making operational decisions.

[0039] Through the above analysis, it can be seen that the network authentication methods implemented by the existing solutions cannot well meet the needs of user centralized authentication scenarios. To this end, the present application provides the following embodiments to provide a new solution that combines the advantages of local authentication and cloud authentication, which not only solves the problem that the cloud authentication delay affects the user experience, but also solves some problems existing in local authentication.

[0040] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application.

[0041] In some processes described in the specification, claims and the above-mentioned figures of the present application, multiple operations appearing in a specific order are included, and these operations may not be executed or executed in parallel in the order in which they appear in this article. The serial numbers of the operations, such as 101, 102, etc., are only used to distinguish different operations, and the serial numbers themselves do not represent any execution order. In addition, these processes may include more or fewer operations, and these operations may be executed in sequence or in parallel. It should be noted that the descriptions of "first", "second", etc. in this article are used to distinguish different messages, devices, modules, etc., do not represent the order of precedence, and do not limit "first" and "second" to different types. In addition, the following embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without making creative work are within the scope of protection of this application.

[0042] Figure 3 FIG. 1 shows a schematic diagram of the structure of a network authentication system provided by an embodiment of the present application. Figure 3 As shown, the network authentication system includes: a cloud server 1 and a network device 2. The cloud server 1 is used to store and update the first authentication information associated with the network device. The network device 2 is connected to the cloud server 1 in communication and stores the second authentication information, and is used to determine through interaction with the cloud server 1 that the second authentication information is different from the first authentication information, and update the locally stored second authentication information according to the synchronization information sent by the cloud server 1, so that the locally stored second authentication information is consistent with the first authentication information on the cloud server 1 side. The network device 2 is also used to obtain the to-be-authenticated information of the user corresponding to the terminal when receiving a network access request sent by the terminal; and authenticate the to-be-authenticated information based on the second authentication information.

[0043] Furthermore, the network device 2 in this embodiment is also used to determine the authentication account of the user corresponding to the terminal after the information to be authenticated passes the authentication, generate a log corresponding to the network connection event of the authentication account, and monitor the network disconnection event corresponding to the authentication account; when the network disconnection event is monitored, generate a log corresponding to the network disconnection event of the authentication account; when the log sending condition is met, send the generated log to the cloud server 1. The cloud server 1 is also used to update the network status information of the corresponding authentication account according to the received log.

[0044] Furthermore, when the log sending condition is met, the network device 2 sends the generated log to the cloud server 1, specifically for:

[0045] When the number of accumulated logs corresponding to the authentication account reaches a threshold, the accumulated number of logs is sent to the cloud server 1; or

[0046] When the sending cycle is met, the logs generated by the network device within the cycle are sent to the cloud server 1.

[0047] The accumulated logs corresponding to the authentication accounts may include logs corresponding to multiple authentication accounts, or multiple logs corresponding to one authentication account.

[0048] In addition, the cloud server 1 described in this embodiment can also be used to generate statistical reports corresponding to the network device according to the network status information of all authentication accounts on the network device 2 within a historical period.

[0049] The first authentication information in this embodiment may include authentication account information associated with the network device, and / or authentication page information associated with the network device. Similarly, the second authentication information may include authentication account information, and / or authentication page information. It should be supplemented that: when synchronizing information with the cloud server 1, the authentication account information and the authentication page information can be synchronized separately. That is, when the authentication account information is updated, only the authentication account information is synchronized with the cloud server 1; when the authentication page information is updated, only the authentication page information is synchronized with the cloud server 1. Of course, when both the authentication account information and the authentication page information associated with the network device are updated, the authentication account information and the authentication page information to be synchronized can also be updated simultaneously in one synchronization process with the cloud server 1.

[0050] For example, in the network authentication system provided in this embodiment, when the network device 2 interacts with the cloud server 1, it is specifically used to:

[0051] Obtaining, from the cloud server 1, first verification information corresponding to the authentication account information in the first authentication information, and second verification information corresponding to the authentication page information in the first authentication information;

[0052] If it is determined by using the first verification information that the authentication account information in the second authentication information is different from the authentication account information in the first authentication information, and if it is determined by using the second verification information that the authentication page information in the second authentication information is different from the authentication page information in the first authentication information, a first acquisition request is sent to the cloud server 1 to acquire first synchronization information corresponding to the authentication account information and second synchronization information corresponding to the authentication page information;

[0053] If it is determined by using the first verification information that the authentication account information in the second authentication information is different from the authentication account information in the first authentication information, and if it is determined by using the second verification information that the authentication page information in the second authentication information is consistent with the authentication page information in the first authentication information, a second acquisition request is sent to the cloud server 1 to acquire the first synchronization information corresponding to the authentication account information;

[0054] If the first verification information is used to determine that the authentication account information in the second authentication information is consistent with the authentication account information in the first authentication information, and the second verification information is used to determine that the authentication page information in the second authentication information is different from the authentication page information in the first authentication information, a third acquisition request is sent to the cloud server 1 to obtain second synchronization information corresponding to the authentication page information;

[0055] updating the authentication account information in the second authentication information according to the acquired first synchronization information;

[0056] According to the acquired second synchronization information, the authentication page information in the second authentication information is updated.

[0057] Further, when the network device 2 authenticates the information to be authenticated (such as an authentication message) of the terminal user, it uses the authentication account information in the second authentication information to complete the authentication. The network device 2 verifies the information to be authenticated (such as an account number, password, etc.) input by the user terminal according to the preset authentication policy and using the authentication account information in the second authentication information. Among them, this embodiment does not specifically limit the authentication policy, and can refer to web authentication, such as Portal authentication, and the contents recorded in the relevant documents, which will not be repeated in this article.

[0058] The network device 2 in this embodiment can be a switch or a router, and this embodiment is not limited to this. In addition, the more detailed implementation structure of the cloud server 1 and the network device 2 and the method steps involved in the authentication process will be described in detail in the corresponding embodiments below, please refer to the corresponding content below.

[0059] An embodiment of the present application provides a cloud server. Figure 3As shown, the cloud server 1 may include: an authentication information module 11 and an authentication synchronization module 12. The authentication information module 11 is used to store and update the first authentication information associated with the network device 2. The authentication synchronization module 12 is used to generate synchronization information according to the updated content of the first authentication information; determine the verification information based on the updated first authentication information; associate the synchronization information, the verification information and the identifier of the network device 2; and communicate with the network device 2. If a first request from the network device 2 is received, the corresponding verification information is queried based on the identifier carried in the first request and the queried verification information is sent to the network device 2, so that the network device 2 determines whether the second authentication information stored locally is consistent with the first authentication information based on the verification information; if a second request is received from the network device 2 because the second authentication information is inconsistent with the first authentication information, the synchronization information is obtained based on the identifier carried in the second request, and the synchronization information is sent to the network device 2, so that the network device 2 uses the synchronization information to update the second authentication information stored locally, and uses the updated second authentication information to perform terminal network access authentication.

[0060] In an achievable technical solution, the authentication information module 11 in this embodiment may include an authentication account management unit 111 and an authentication page management unit 112. Among them, the authentication account management unit 111 is used to provide authentication account management functions, including adding, modifying, deleting accounts, and controlling the authentication account status; it can also provide an API interface for the front-end management interface (UI) to call. For example, managers can call the API interface through the terminal to implement management operations on authentication accounts (such as adding, deleting, modifying, etc.) and / or view the managed authentication accounts. The authentication page management unit 112 provides an authentication page customization interface to save user-defined authentication page content. That is, managers can use this customization interface to customize or design authentication pages corresponding to different network devices 2.

[0061] The authentication synchronization module 12 in this embodiment provides an interface for data synchronization with the network device 2, and the network device 2 can apply for data synchronization through the authentication synchronization module.

[0062] The verification information can be calculated by using the MD5 message digest algorithm (also called hash algorithm) to operate on the updated first authentication information, and the result is a 128-bit message digest. The network device 2 requesting data synchronization determines whether the local second authentication information is consistent with the first authentication information on the cloud server 1 side by comparing the MD5 value of the local second authentication information (i.e., verification information) and the MD5 value of the updated first authentication information obtained from the cloud server 1. Specifically, if the MD5 value of the local second authentication information is the same as the MD5 value of the updated first authentication information obtained from the cloud server 1, it is determined that the local second authentication information is consistent with the first authentication information on the cloud server 1 side; if the MD5 value of the local second authentication information is different from the MD5 value of the updated first authentication information obtained from the cloud server 1, it is determined that the local second authentication information is inconsistent with the first authentication information on the cloud server 1 side.

[0063] Furthermore, the cloud server 1 described in this embodiment may also include: an authentication log module 13. Accordingly, the authentication log module 13 is used to receive the log sent by the network device 2 and send a message to the authentication information module 11. The authentication information module 11 is also used to obtain the log after receiving the message, and update the network status information corresponding to the authentication account based on the authentication account and event identifier contained in the log.

[0064] Furthermore, the cloud server 1 described in this embodiment may also include a report module 14. The report module 14 is used to generate a statistical report corresponding to the network device 2 according to the network status information of all authentication accounts on the network device 2 in a historical period.

[0065] In this solution, the network status information corresponding to the authentication account on the network device 2 is synchronized to the cloud server 1 on a regular or batch basis through the above process. The report module 14 of the cloud server 1 can then conveniently query the network usage corresponding to a certain authentication account under a certain network device 2. For example, it can also support statistics on the number of authentication accounts in the last day, the last week, the last month, and a flexible custom time range, and present a trend chart, which can help administrators understand the trend of authentication users on the network, and can also notify administrators of an alarm when the number of authenticated users exceeds a certain threshold, thereby improving the usability of unified cloud management of authentication.

[0066] An embodiment of the present application provides a network device. Figure 3As shown, the network device 2 includes an authentication cloud management module 22 and a local authentication module 21. The authentication cloud management module 22 is used to communicate with the cloud server 1, and based on the synchronization information sent by the cloud server 1, update the second authentication information stored locally, so that the second authentication information stored locally is consistent with the first authentication information on the cloud server 1 side. The local authentication module 21 is used to obtain the to-be-authenticated information of the user corresponding to the terminal when receiving the network access request sent by the terminal; and authenticate the to-be-authenticated information according to the second authentication information.

[0067] Further, the local authentication module 21 is further configured to determine the authentication account of the user corresponding to the terminal after the information to be authenticated passes the authentication, and send a notification of the authentication account network connection event to the authentication cloud management module 22; monitor the network disconnection event corresponding to the authentication account; and when the network disconnection event is monitored, send a notification of the authentication account network disconnection event to the authentication cloud management module 22;

[0068] The authentication cloud management module 22 is also used to generate a log corresponding to the authentication account network connection event after receiving the authentication account network connection event notification; generate a log corresponding to the authentication account network disconnection event after receiving the authentication account network disconnection event; and send the generated log to the cloud server 1 when the log sending conditions are met.

[0069] Figure 4 The flowchart of the network authentication method provided by an embodiment of the present application is shown. The execution subject of the method provided by this embodiment can be a cloud server in the above network authentication system. Specifically, the network authentication method includes:

[0070] 101. Update first authentication information associated with a network device;

[0071] 102. Generate synchronization information according to the updated content of the first authentication information;

[0072] 103. Determine verification information based on the updated first authentication information;

[0073] 104. Associating the synchronization information, the verification information, and the identifier of the network device;

[0074] 105. If the first request from the network device is received, query the corresponding verification information based on the identifier carried in the first request and send the queried verification information to the network device, so that the network device determines whether the second authentication information stored locally is consistent with the first authentication information according to the verification information;

[0075] 106. If a second request is received from the network device because the second authentication information is inconsistent with the first authentication information, the synchronization information is obtained based on the identifier carried in the second request, and the synchronization information is sent to the network device, so that the network device uses the synchronization information to update the second authentication information stored locally.

[0076] The above-mentioned first authentication information may include authentication account information and / or authentication page information. Correspondingly, the second authentication information may include authentication account information and / or authentication page information. If the first authentication information only includes one of the authentication account information and the authentication page information, then the first authentication information corresponding to each step in the above-mentioned embodiment is replaced with the authentication account information or the authentication page information to obtain a method embodiment for synchronizing the authentication account and a method embodiment for synchronizing the authentication page.

[0077] Furthermore, the method provided in this embodiment may also include the following steps:

[0078] 107. Receive logs sent by network devices;

[0079] 108. Based on the authentication account and event identifier contained in the log, update the network status information corresponding to the authentication account.

[0080] Figure 5 A flow chart of a network authentication method provided by another embodiment of the present application is shown. The execution subject of the method provided herein may be a network device in the above-mentioned network authentication system. Specifically, the network authentication method includes:

[0081] 201. Based on the synchronization information sent by the cloud server, update the second authentication information stored locally so that the second authentication information stored locally is consistent with the first authentication information on the cloud server side;

[0082] 202. When receiving a network access request sent by a terminal, obtaining to-be-authenticated information of a user corresponding to the terminal;

[0083] 203. Authenticate the information to be authenticated according to the second authentication information.

[0084] Furthermore, the method provided in this embodiment may also include the following steps:

[0085] 204. After the information to be authenticated passes authentication, determine the authentication account of the user corresponding to the terminal, and generate a log corresponding to the network connection event of the authentication account;

[0086] 205. Monitoring a network disconnection event corresponding to the authentication account;

[0087] 206. When the network disconnection event is monitored, generate a log corresponding to the authentication account network disconnection event;

[0088] 207. When the log sending condition is met, the generated log is sent to the cloud server.

[0089] The above step 207 "when the log sending condition is met, sending the generated log to the cloud server" may include:

[0090] When the number of accumulated logs corresponding to the authentication account reaches a threshold, the accumulated number of logs is sent to the cloud server; or

[0091] When the sending cycle is met, the logs generated by the network device within the cycle are sent to the cloud server.

[0092] The following will combine the interactions between the modules in the cloud server and the modules in the network device to explain the process of synchronizing accounts between the cloud server and the network device, the process of synchronizing pages, and the process of authenticating and reporting account status.

[0093] 1. Account synchronization process

[0094] In combination with the module structure embodiments corresponding to the above-mentioned cloud servers and network devices, respectively, in the technical solution provided by the present application, an authentication synchronization module is added to the cloud server, and an authentication cloud management module is added to the network device; the synchronization of account information is completed through the interaction of the authentication synchronization module and the authentication cloud management module. The account information synchronization process can be simply summarized as follows: When the administrator enters the client management interface through the API interface provided by the cloud server to perform management operations on the account information corresponding to one or some network devices, the authentication synchronization module generates data for the network device to be synchronized after learning of the data changes. The network device side periodically checks the data changes on the cloud server through the authentication cloud management module. When it is judged that it is inconsistent with the local data (indicating that the data on the cloud server side has been updated), the authentication cloud management module of the network device will request to synchronize data from the cloud server and update it to the local authentication module on the network device. Specifically, if Figure 6 As shown, the account information synchronization method includes:

[0095] S11. The authentication account management unit updates the first authentication account information associated with the operation for the network device in response to the account management operation of the administrator, and sends an update message to the authentication synchronization module.

[0096] The account management operations performed by the administrator on the first authentication account information related to the network device on the cloud server through the terminal may include operations such as account addition, modification, and deletion. The authentication account management unit updates the first authentication account information associated with the corresponding network device based on the administrator's operation. The administrator can modify the first authentication account information corresponding to one or more different network devices at the same time. After the administrator completes the account management operation and confirms it, the authentication account management unit can also feedback a successful operation response to the administrator terminal.

[0097] S12. After receiving the update message, the authentication synchronization module generates synchronization information according to the updated content of the first authentication account information; determines verification information based on the updated first authentication account information; and associates the synchronization information, the verification information, and the identifier of the network device.

[0098] The generated synchronization information may include only the updated content in the first authentication account information, such as only the newly added account information, or the modified account information, or the deleted account information, etc., and the unchanged information may not be included. Further, the generated synchronization information may be compressed and encrypted. In this embodiment, the MD5 algorithm may be used to calculate the verification information (i.e., the MD5 value) corresponding to the updated first authentication account information.

[0099] S13. When the authentication cloud management module detects that the request time corresponding to the synchronization period arrives, it sends a first request to the authentication synchronization module, wherein the first request carries an identifier of the network device.

[0100] For example, the authentication cloud management module sends a first request to the authentication synchronization module every hour, and the last request time is 10:00. When the authentication cloud management module detects that the current time has reached the request time 11:00 corresponding to the 1-hour synchronization cycle, it sends the first request to the authentication synchronization module. It should be added here that this embodiment does not specifically limit the synchronization cycle, which can be the above-mentioned 1 hour, or 2 hours, 6 hours, longer or shorter.

[0101] S14. After receiving the first request, the authentication synchronization module queries the corresponding verification information based on the identifier carried in the first request, and sends the queried verification information to the authentication cloud management module.

[0102] S15. The authentication cloud management module uses the verification information to determine whether the second authentication information stored locally is consistent with the first authentication information. If they are consistent, the process ends; if they are inconsistent, the process proceeds to step S16.

[0103] S16. The authentication cloud management module sends a second request to the authentication synchronization module, wherein the second request carries an identifier of the network device.

[0104] S17. The authentication synchronization module obtains the synchronization information according to the identifier carried in the second request, and sends the synchronization information to the authentication cloud management module.

[0105] S18. The authentication cloud management module uses the synchronization information to update the second authentication account information stored locally.

[0106] 2. The process of syncing pages

[0107] In combination with the module structure embodiments corresponding to the above-mentioned cloud servers and network devices, respectively, in the technical solution provided by the present application, an authentication synchronization module is added to the cloud server, and an authentication cloud management module is added to the network device; the synchronization of page information is completed through the interaction of the authentication synchronization module and the authentication cloud management module. The page information synchronization process can be simply summarized as follows: When the administrator enters the client management interface through the API interface provided by the cloud server to perform customized operations on the authentication page corresponding to one or some network devices, the authentication synchronization module generates different page information corresponding to the network device to be synchronized after learning of the page changes. The network device end periodically detects page changes to the cloud server through the authentication cloud management module. When it is judged that it is inconsistent with the local data (indicating that the page on the cloud server side has been updated), the authentication cloud management module of the network device will request to synchronize the authentication page from the cloud server and update it to the local authentication module on the network device. Specifically, if Figure 7 As shown, the page information synchronization method includes:

[0108] S21. The authentication page management unit responds to the page customization operation of the administrator, updates the first authentication page associated with the operation for the network device based on the customization information of the administrator's operation, and sends an update message to the authentication synchronization module.

[0109] Among them, the administrator's page customization operations may include but are not limited to modifying the page title logo, selecting different authentication methods, modifying the welcome message, and other operations. The authentication account management unit updates the first authentication page information associated with the corresponding network device based on the administrator's operation. The administrator can modify the first authentication page information corresponding to one or more different network devices at the same time. After the administrator completes the page customization operation and confirms it, the authentication page management unit can also feedback a successful operation response to the administrator terminal.

[0110] S22. After receiving the update message, the authentication synchronization module generates synchronization information according to the updated content of the first authentication page; determines verification information based on the updated first authentication page; and associates the synchronization information, the verification information, and the identifier of the network device.

[0111] Furthermore, the synchronization content generated by the authentication synchronization module can be compressed and encrypted, and the content is generated in the template format of the local page of the corresponding network device, so that the network device can be easily replaced. Similarly, the MD5 algorithm can be used to calculate the verification information (i.e., MD5 value) corresponding to the updated first authentication page. The purpose of associating the synchronization information, the verification information, and the identification of the network device is for subsequent inquiries.

[0112] S23. When the authentication cloud management module detects that the request time corresponding to the synchronization period arrives, it sends a third request to the authentication synchronization module, wherein the third request carries the identifier of the network device.

[0113] S24. After receiving the third request, the authentication synchronization module queries the corresponding verification information based on the identifier carried in the third request, and sends the queried verification information to the authentication cloud management module.

[0114] S25. The authentication cloud management module uses the verification information to determine whether the second authentication page stored locally is consistent with the first authentication page. If they are consistent, the process ends; if they are inconsistent, the process proceeds to step S26.

[0115] S26. The authentication cloud management module sends a fourth request to the authentication synchronization module, wherein the fourth request carries an identifier of the network device.

[0116] S27. The authentication synchronization module obtains the synchronization information according to the identifier carried in the fourth request, and sends the synchronization information to the authentication cloud management module.

[0117] S28. The authentication cloud management module uses the synchronization information to update the second authentication page stored locally.

[0118] 3. Process of Authentication and Reporting Account Status

[0119] The local authentication module of the network device can provide network access authentication services for the terminal. After the authentication is passed, the terminal can access the network. In order to facilitate the viewing of account status and statistical account usage reports, the authentication log module of the cloud server in the solution provided in the embodiment of the present application receives the log sent by the authentication cloud management module of the network device, and the authentication information module also updates the network status information corresponding to the authentication account based on the log. Specifically, Figure 8 As shown, the process of authenticating and reporting account status includes:

[0120] S31. In response to a network access operation triggered by a user, the terminal sends a network access request to a local authentication module of a network device.

[0121] S32. After receiving the network access request, the local authentication module feeds back redirection information to the terminal so that the terminal is redirected to the authentication page and displayed.

[0122] When a terminal user accesses the network and Internet resources for the first time, the device redirects the terminal to a local authentication page (which is synchronized from the cloud), commonly known as a Web Portal authentication page, where the user can enter the information to be authenticated.

[0123] S33. The terminal sends the information to be authenticated to a local authentication module in response to the information to be authenticated input by the user on the authentication page.

[0124] S34. The local authentication module uses the second authentication account information stored locally to authenticate the received information to be authenticated. If the authentication fails, a failure message is fed back to the terminal. If the authentication passes, the process proceeds to step S35.

[0125] Furthermore, after the authentication is passed, authentication success information can be fed back to the interrupt.

[0126] S35. After the information to be authenticated passes authentication, the local authentication module determines the authentication account corresponding to the terminal user and sends a notification of the authentication account connection event to the authentication cloud management module.

[0127] S35. After receiving the notification of the authentication account networking event, the authentication cloud management module generates a log corresponding to the authentication account networking event and feeds back a corresponding notification response to the local authentication module.

[0128] S36. In response to a network disconnection operation triggered by the user for the authentication account, the terminal sends a network disconnection message of the authentication account to the local authentication module; or when the local authentication module detects that the authentication account has not consumed network traffic within a preset time (such as 10 minutes, 15 minutes or longer), it disconnects the network connected to the terminal and triggers a network disconnection event for the authentication account.

[0129] In actual applications, if the network disconnection operation is triggered by the terminal user, the local authentication module will feedback a successful offline message to the terminal.

[0130] S37. When the local authentication module monitors the network disconnection event of the authentication account, it sends a notification of the network disconnection event of the authentication account to the authentication cloud management module.

[0131] Specifically, the local authentication module can determine that a network disconnection event of the authentication account has been monitored after receiving a network disconnection message; or it can monitor the triggered network disconnection event after detecting that the authentication account has not consumed network traffic within a preset time period (such as 10 minutes, 15 minutes or longer) and then disconnecting the network to which the terminal is connected.

[0132] After receiving the notification of the disconnection event of the authentication account, the authentication cloud management module can also feedback corresponding response information to the local authentication module.

[0133] S38. After receiving the authentication account disconnection event, the authentication cloud management module generates a log corresponding to the authentication account disconnection event.

[0134] S39. When the log sending conditions are met, the authentication cloud management module sends the log generated by the local authentication module to the authentication log module of the cloud server.

[0135] The authentication cloud management module can determine that the log sending condition is met when the sending time corresponding to a sending cycle arrives or when the number of accumulated logs reaches a threshold value. The logs generated by the network device in a sending cycle are sent to the cloud server; or the accumulated number of logs are sent to the cloud server.

[0136] This embodiment does not specifically limit the sending period, and it can be 30 minutes, 1 hour, 2 hours, 6 hours, longer or shorter.

[0137] S40: The authentication log module sends the received log to the authentication information module.

[0138] More specifically, this step S40 may be as follows: Figure 3 The authentication account management unit 111 in the authentication information module 11 shown in FIG.

[0139] S41. The authentication information module updates the network status information of the corresponding authentication account based on the log sent by the authentication log module.

[0140] In summary, the technical solutions provided by the embodiments of the present application have the following characteristics:

[0141] 1. The technical solution provided in the embodiment of the present application adds an authentication cloud management module to the network device, which is used to connect with the cloud server to realize data synchronization processing of cloud authentication accounts and authentication pages, and synchronize the online and offline logs of the accounts locally authenticated by the network device to the cloud server.

[0142] 2. The technical solution provided in the embodiment of the present application adds a new authentication synchronization module on the cloud server, and the authentication cloud management module on the network device and the authentication synchronization module of the cloud server are linked and connected to complete the generation of authentication pages and account data synchronized from the cloud server to the network device, and provide an API interface for the network device to request data synchronization.

[0143] 3. The technical solution provided in the embodiment of the present application proposes to add an authentication log module on the cloud server to receive the online and offline logs corresponding to the authentication account reported by the network device, so as to update the network status corresponding to the authentication account of the cloud server.

[0144] 4. The technical solution provided in the embodiment of the present application proposes to support report viewing of local authentication of network devices on a cloud server, thereby realizing unified management of authentication accounts and report monitoring.

[0145] 5. The technical solution provided in the embodiments of the present application solves the problems of poor user experience and unstable user authentication in existing cloud-based authentication solutions, and provides an authentication solution that can ensure a good user experience even in a large number of user authentication scenarios.

[0146] 6. The technical solution provided by the embodiment of the present application solves the problems of difficult account management and maintenance and inability to customize pages in local authentication of network devices; realizes a unified cloud management method, improves account management efficiency, provides flexible and rich page customization methods, and improves the professionalism of authentication pages in different scenarios.

[0147] The technical solution provided by the embodiments of the present application provides a solution for realizing unified management of the cloud platform through local web authentication of network devices. Even if the network device has no public IP, the local authentication account of the device can be managed and the authentication page can be customized through the cloud platform, which improves the convenience of local authentication management and solves the problem that the local account management of the device is troublesome and the cloud authentication affects the user experience. The technical solution provided by each embodiment of the present application is applicable to all scenarios where the local authentication of the device is expanded or modified by a similar cloud management method.

[0148] The technical solution provided in the embodiment of the present application can be combined with the whole network equipment status monitoring and unified visualization of authentication reports in the actual usage environment, and can add interactions such as authentication data dashboards and abnormal authentication log message push, thereby improving ease of use and better user experience.

[0149] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit it. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A network authentication system, characterized in that: include: A cloud server, configured to store and update first authentication information associated with the network device; a network device, which is in communication connection with the cloud server and stores second authentication information, and is used to update the locally stored second authentication information according to the synchronization information sent by the cloud server when it is determined through interaction with the cloud server that the second authentication information is different from the first authentication information, so that the locally stored second authentication information is consistent with the first authentication information on the cloud server side; The network device is further configured to obtain the to-be-authenticated information of the user corresponding to the terminal when receiving a network access request sent by the terminal; authenticating the information to be authenticated based on the second authentication information; Wherein, the first authentication information includes: authentication page information associated with the network device, and the cloud server provides an authentication page customization interface, so that the user can adjust or design the authentication page information through the authentication page customization interface; The cloud server is further used to: respond to an account management operation of an administrator, update the first authentication account information associated with the account management operation for the network device; and / or In response to a page customization operation by an administrator, a first authentication page associated with the page customization operation for a network device is updated based on customization information of the administrator operation.

2. The network authentication system according to claim 1, characterized in that: The network device is further used to determine the authentication account of the user corresponding to the terminal after the information to be authenticated passes the authentication, generate a log corresponding to the network connection event of the authentication account, and monitor the network disconnection event corresponding to the authentication account; When the network disconnection event is monitored, a log corresponding to the authentication account network disconnection event is generated; when the log sending condition is met, the generated log is sent to the cloud server; The cloud server is also used to update the network status information of the corresponding authentication account according to the received log.

3. The network authentication system according to claim 2, characterized in that: When the log sending condition is met, the network device sends the generated log to the cloud server, specifically for: When the number of accumulated logs corresponding to the authentication account reaches a threshold, the accumulated number of logs is sent to the cloud server; or When the sending cycle is met, the logs generated by the network device within the cycle are sent to the cloud server.

4. The network authentication system according to claim 2, characterized in that: The cloud server is also used to generate a statistical report corresponding to the network device based on the network status information of all authentication accounts on the network device within a historical period.

5. A network authentication method, characterized in that: Applicable to a cloud server, the method includes: updating first authentication information associated with the network device; Generate synchronization information according to the updated content of the first authentication information; Determining verification information based on the updated first authentication information; Associating the synchronization information, the verification information, and an identifier of the network device; If a first request from the network device is received, querying the corresponding verification information based on the identifier carried in the first request, and sending the queried verification information to the network device, so that the network device determines whether the second authentication information stored locally is consistent with the first authentication information based on the verification information; If a second request is received from the network device because the second authentication information is inconsistent with the first authentication information, the synchronization information is obtained based on the identifier carried in the second request, and the synchronization information is sent to the network device, so that the network device updates the second authentication information stored locally by using the synchronization information; Wherein, the first authentication information includes: authentication page information associated with the network device; the cloud server provides an authentication page customization interface, so that the user can adjust or design the authentication page information through the authentication page customization interface; The first authentication information for updating and managing network equipment includes: In response to an account management operation by an administrator, updating first authentication account information associated with the account management operation for the network device; and / or In response to a page customization operation by an administrator, based on the customization information of the administrator's operation, a first authentication page for network device management related to the page customization operation is updated.

6. The method according to claim 5, characterized in that Also includes: Receive logs sent by network devices; Based on the authentication account and event identifier contained in the log, the network status information corresponding to the authentication account is updated.

7. A network authentication method, characterized in that: Applicable to a network device, the method comprises: Based on the synchronization information sent by the cloud server, updating the second authentication information stored locally so that the second authentication information stored locally is consistent with the first authentication information on the cloud server side; When receiving a network access request sent by a terminal, obtaining the to-be-authenticated information of the user corresponding to the terminal; authenticating the information to be authenticated according to the second authentication information; Wherein, the first authentication information includes: authentication page information associated with the network device; the cloud server provides an authentication page customization interface, so that the user can adjust or design the authentication page information through the authentication page customization interface; The synchronization information includes updated first account information and / or updated first authentication page, wherein the updated first account information is obtained by the cloud server in response to an account management operation of an administrator, by updating the first authentication account information associated with the account management operation for the network device; The updated first authentication page is obtained by the cloud server responding to the administrator's page customization operation and updating the first authentication page for network device management based on the customization information of the administrator's operation.

8. The method according to claim 7, characterized in that Also includes: After the information to be authenticated passes authentication, determining the authentication account of the user corresponding to the terminal, and generating a log corresponding to the network connection event of the authentication account; Monitor the network disconnection event corresponding to the authentication account; When the network disconnection event is monitored, a log corresponding to the authentication account network disconnection event is generated; When the log sending conditions are met, the generated log is sent to the cloud server.

9. The method according to claim 8, characterized in that When the log sending conditions are met, the generated log is sent to the cloud server, including: When the number of accumulated logs corresponding to the authentication account reaches a threshold, the accumulated number of logs is sent to the cloud server; or When the sending cycle is met, the logs generated by the network device within the cycle are sent to the cloud server.

10. A cloud server, characterized in that: include: An authentication information module, used to store and update first authentication information associated with the network device; an authentication synchronization module, configured to generate synchronization information according to the updated content of the first authentication information; determine verification information based on the updated first authentication information; associate the synchronization information, the verification information and the identifier of the network device; and further configured to communicate with the network device, and if a first request from the network device is received, query the corresponding verification information based on the identifier carried in the first request, and send the queried verification information to the network device, so that the network device determines whether the second authentication information stored locally is consistent with the first authentication information based on the verification information; If a second request sent by the network device is received because the second authentication information is inconsistent with the first authentication information, the synchronization information is obtained based on the identifier carried in the second request, and the synchronization information is sent to the network device, so that the network device updates the second authentication information stored locally by using the synchronization information, and performs terminal network access authentication by using the updated second authentication information; Wherein, the first authentication information includes: authentication page information associated with the network device, and the cloud server also provides an authentication page customization interface, so that the user can adjust or design the authentication page information through the authentication page customization interface; The first authentication information for updating and managing network equipment includes: In response to an account management operation by an administrator, updating first authentication account information associated with the account management operation for the network device; and / or In response to a page customization operation by an administrator, based on the customization information of the administrator's operation, a first authentication page for network device management related to the page customization operation is updated.

11. The cloud server according to claim 10, characterized in that: Also includes: An authentication log module, used to receive logs sent by network devices and send messages to the authentication information module; The authentication information module is further configured to obtain the log after receiving the message, and update the network status information corresponding to the authentication account based on the authentication account and event identifier contained in the log.

12. The cloud server according to claim 10, characterized in that: Also includes: A report module, used to collect network status information of all authenticated accounts on the network device within a historical period; Generate a statistical report corresponding to the network device.

13. A network device, characterized in that: include: The authentication cloud management module is used to communicate with the cloud server and update the second authentication information stored locally based on the synchronization information sent by the cloud server, so that the second authentication information stored locally is consistent with the first authentication information on the cloud server side; The local authentication module is used to obtain the to-be-authenticated information of the user corresponding to the terminal when receiving the network access request sent by the terminal; authenticating the information to be authenticated according to the second authentication information; Wherein, the first authentication information includes: authentication page information associated with the network device; the cloud server provides an authentication page customization interface, so that the user can adjust or design the authentication page information through the authentication page customization interface; The synchronization information includes the updated first account information and the updated first authentication page; The updated first account information is obtained by the cloud server responding to the account management operation of the administrator by updating the first authentication account information associated with the account management operation for the network device; The updated first authentication page is obtained by the cloud server responding to the administrator's page customization operation and updating the first authentication page for network device management based on the customization information of the administrator's operation.

14. The network device according to claim 13, characterized in that: The local authentication module is further configured to determine the authentication account of the user corresponding to the terminal after the information to be authenticated passes the authentication, send a notification of the authentication account connection event to the authentication cloud management module, and monitor the disconnection event corresponding to the authentication account; When the network disconnection event is monitored, sending the authentication account network disconnection event notification to the authentication cloud management module; The authentication cloud management module is also used to generate a log corresponding to the authentication account network connection event after receiving the authentication account network connection event notification; generate a log corresponding to the authentication account network disconnection event after receiving the authentication account network disconnection event; and send the generated log to the cloud server when the log sending conditions are met.

Images