Access authentication method and device

Abstract

The present application provides an access authentication method and device, which relates to the field of network communication technology. The method includes: receiving an Internet access request sent by a terminal device, the Internet access request includes: the address information of the terminal device; determining whether the terminal device has been authenticated according to the address information; if the terminal device has not been authenticated, sending a redirection request and an identifier of a portal server to the terminal device, so that the terminal device forwards the redirection request to the portal server, so that the portal server performs access authentication on the terminal device; receiving an access notification sent by the portal server, the access notification is a message sent by the portal server after the terminal device has passed the access authentication; controlling the terminal device to access the network. The present application can simplify the access authentication process and improve the authentication concurrency capability.

Description

Technical Field

[0001] The present invention relates to the field of network communication technology, and in particular to an access authentication method and device. Background Art

[0002] With the rapid application of WLAN (Wireless Local Area Networks) services in all walks of life, for public networks provided in public places such as hotels and supermarkets, there is a need for client-free and convenient authentication methods such as SMS verification code authentication, application authorization authentication and dynamic password authentication.

[0003] The current common authentication method is to use the China Mobile WLAN Service PORTAL (Portal) Protocol Specification to authenticate users accessing the LAN. Please refer to Figure 1 , which is a flowchart of an existing access authentication method, such as Figure 1 As shown, this access authentication method requires the Portal server to access Radius (Remote authentication dial in user service) to query user information. This authentication method is the best authentication method for scenarios such as built-in accounts, AD (Active Directory) domains, and LADP (Lightweight Directory Access Protocol) docking authentication.

[0004] However, for convenient authentication methods such as SMS verification code authentication, application authorization authentication and dynamic password authentication, after successful authentication on the portal server side, the Radius authentication process needs to be carried out in sequence in the Radius server, causing the authentication method to become bloated and redundant, seriously affecting the concurrent performance of the authentication processing. Summary of the invention

[0005] The purpose of the present invention is to provide an access authentication method and device to address the deficiencies in the above-mentioned prior art, so as to simplify the access authentication process and improve the authentication concurrency capability.

[0006] To achieve the above purpose, the technical solution adopted in the embodiment of the present application is as follows:

[0007] In a first aspect, an embodiment of the present application provides an access authentication method, which is applied to an access controller. The method includes:

[0008] Receiving an Internet access request sent by a terminal device, the Internet access request including: address information of the terminal device;

[0009] Determining whether the terminal device has been authenticated according to the address information;

[0010] If the terminal device is not authenticated, sending a redirection request and an identifier of the portal server to the terminal device, so that the terminal device forwards the redirection request to the portal server, so that the portal server performs access authentication on the terminal device;

[0011] receiving an admission notification sent by the portal server, wherein the admission notification is a message sent by the portal server after the portal server performs access authentication on the terminal device;

[0012] Control the terminal device to access the network.

[0013] Optionally, the redirection request includes: a request parameter and a first digital signature; before sending the redirection request to the terminal device, the method further includes:

[0014] Signing the request parameters to generate the first digital signature;

[0015] The redirection request is used by the portal server to verify the request parameters based on the first digital signature, and to perform access authentication on the terminal device after the request parameters are verified.

[0016] Optionally, the admission notification includes: terminal device information and a second digital signature. After receiving the admission notification sent by the portal server, the method further includes:

[0017] Verifying the terminal device information according to the second digital signature;

[0018] The controlling the terminal device to access the network includes:

[0019] If the terminal device information verification passes, the terminal device is controlled to access the network.

[0020] Optionally, the redirection request further includes: an address to be accessed; after controlling the terminal device to access the network, the method further includes:

[0021] An access response is sent to the portal server, where the access response is used to enable the portal server to push the web page corresponding to the address to be accessed to the terminal device.

[0022] In a second aspect, an embodiment of the present application further provides an access authentication method, which is applied to a portal server, and the method includes:

[0023] receiving a redirection request forwarded by a terminal device, wherein the redirection request is sent to the terminal device by the access controller when it is determined that the terminal device is not authenticated based on the address information of the terminal device in the Internet access request sent by the terminal device;

[0024] Performing access authentication on the terminal device;

[0025] After the access authentication succeeds, an admission notification is sent to the access controller so that the access controller controls the terminal device to access the network.

[0026] Optionally, the redirection request includes: a request parameter and a first digital signature, where the first digital signature is generated by the access controller signing the request parameter. After the redirection request forwarded by the receiving terminal device, the method further includes:

[0027] Verifying the request parameters based on the first digital signature;

[0028] The performing access authentication on the terminal device includes:

[0029] If the request parameter verification passes, access authentication is performed on the terminal device.

[0030] Optionally, the admission notification includes: terminal device information and a second digital signature, and before sending the admission notification to the access controller, the method further includes:

[0031] Signing the terminal device information to generate the second digital signature;

[0032] The admission notification is used by the access controller to verify the terminal device information based on the second digital signature, and to control the terminal device to access the network after the terminal device information is verified.

[0033] Optionally, the redirection request further includes: an address to be accessed; after sending the admission notification to the access controller, the method further includes:

[0034] receiving an admission response sent by the access controller;

[0035] Pushing the webpage corresponding to the address to be accessed to the terminal device.

[0036] In a third aspect, an embodiment of the present application further provides an access authentication device, applied to an access controller, the device comprising:

[0037] An Internet access request receiving module, used to receive an Internet access request sent by a terminal device, wherein the Internet access request includes: address information of the terminal device;

[0038] A device authentication judgment module, used to determine whether the terminal device has been authenticated according to the address information;

[0039] a redirection request sending module, configured to send a redirection request and an identifier of a portal server to the terminal device if the terminal device is not authenticated, so that the terminal device forwards the redirection request to the portal server, so that the portal server performs access authentication on the terminal device;

[0040] An admission notification receiving module, used to receive an admission notification sent by the portal server, wherein the admission notification is a message sent by the portal server after the portal server performs access authentication on the terminal device;

[0041] The access control module is used to control the terminal device to access the network.

[0042] Optionally, the redirection request includes: a request parameter and a first digital signature; before the redirection request sending module, the device further includes:

[0043] A first signature module, used to sign the request parameter to generate the first digital signature;

[0044] The redirection request is used by the portal server to verify the request parameters based on the first digital signature, and to perform access authentication on the terminal device after the request parameters are verified.

[0045] Optionally, the admission notification includes: terminal device information and a second digital signature. After the admission notification receiving module, the device further includes:

[0046] A first signature verification module, used to verify the terminal device information according to the second digital signature;

[0047] The access control module is specifically used to control the terminal device to access the network if the terminal device information verification passes.

[0048] Optionally, the redirection request further includes: an address to be accessed; and after the access control module, the device further includes:

[0049] The access response sending module is used to send an access response to the portal server, wherein the access response is used to enable the portal server to push the web page corresponding to the address to be accessed to the terminal device.

[0050] In a fourth aspect, an embodiment of the present application further provides an access authentication device, which is applied to a portal server, and the device includes:

[0051] A redirection request receiving module, used to receive a redirection request forwarded by a terminal device, wherein the redirection request is sent to the terminal device by the access controller when it is determined that the terminal device is not authenticated based on the address information of the terminal device in the Internet access request sent by the terminal device;

[0052] An access authentication module, used to perform access authentication on the terminal device;

[0053] The access notification sending module is used to send an access notification to the access controller after the access authentication is successful, so that the access controller controls the terminal device to access the network.

[0054] Optionally, the redirection request includes: a request parameter and a first digital signature, where the first digital signature is generated by the access controller signing the request parameter. After the redirection request receiving module, the device further includes:

[0055] A second signature verification module, used to verify the request parameters based on the first digital signature;

[0056] The access authentication module is specifically used to perform access authentication on the terminal device if the request parameter verification passes.

[0057] Optionally, the admission notification includes: terminal device information and a second digital signature, and before the admission notification sending module, the device further includes:

[0058] A second signature module, used to sign the terminal device information and generate the second digital signature;

[0059] The admission notification is used by the access controller to verify the terminal device information based on the second digital signature, and to control the terminal device to access the network after the terminal device information is verified.

[0060] Optionally, the redirection request further includes: an address to be accessed; after the admission notification sending module, the device further includes:

[0061] An admission response receiving module, used to receive an admission response sent by the access controller;

[0062] The web page push module is used to push the web page corresponding to the address to be visited to the terminal device.

[0063] In a fifth aspect, an embodiment of the present application further provides an electronic device, comprising: a processor, a storage medium and a bus, wherein the storage medium stores program instructions executable by the processor, and when the electronic device is running, the processor communicates with the storage medium through the bus, and the processor executes the program instructions to perform the steps of the Internet authentication method as described in any one of the first aspects or the steps of the Internet authentication method as described in any one of the second aspects.

[0064] In a sixth aspect, an embodiment of the present application further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the Internet authentication method as described in any one of the first aspects or the steps of the Internet authentication method as described in any one of the second aspects are executed.

[0065] The beneficial effects of this application are:

[0066] The present application provides an access authentication method and device, which directly provide access authentication services through a portal server for terminal devices that have not undergone access authentication. After the access authentication of the terminal device is completed through the portal server, the access controller opens Internet access rights for the terminal device, and there is no need to perform secondary authentication on the terminal device through the Radius server, which simplifies the access authentication process and makes the network access process for the public network more reasonable. Since the network access process is more reasonable and simple, the concurrent authentication capability of the portal server can be improved, thereby improving the access authentication efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0067] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required for use in the embodiments are briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present invention and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without creative work.

[0068] Figure 1 A flowchart of an existing access authentication method;

[0069] Figure 2 A schematic diagram of an access authentication system provided in an embodiment of the present application;

[0070] Figure 3 Schematic diagram of the access authentication method provided in this application embodiment Figure 1 ;

[0071] Figure 4 Schematic diagram of the access authentication method provided in this application embodiment Figure 2 ;

[0072] Figure 5Schematic diagram of the access authentication method provided in this application embodiment Figure 3 ;

[0073] Figure 6 An interactive diagram of the access authentication method provided in an embodiment of the present application;

[0074] Figure 7 A schematic diagram of the structure of the access authentication device provided in the embodiment of the present application Figure 1 ;

[0075] Figure 8 A schematic diagram of the structure of the access authentication device provided in the embodiment of the present application Figure 2 ;

[0076] Fig. 9 A schematic diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0077] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments.

[0078] Therefore, the following detailed description of the embodiments of the present application provided in the accompanying drawings is not intended to limit the scope of the present application for which protection is sought, but merely represents selected embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without creative work are within the scope of protection of the present application.

[0079] In addition, the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0080] It should be noted that, in the absence of conflict, the features in the embodiments of the present application may be combined with each other.

[0081] Before introducing the access authentication method provided by the embodiment of the present application, the application scenario involved in the present application is described first. The access authentication method provided by the embodiment of the present application mainly requires access authentication of the terminal device when the terminal device accesses the local area network of a public place, and enables the terminal device to access the local area network of the public place after the access authentication is successful.

[0082] Please refer to Figure 2 , is a schematic diagram of an access authentication system provided in an embodiment of the present application, such as Figure 2 As shown, the access authentication system includes: a terminal device 10, an access controller 20 and a portal server 30, and the terminal device 10, the access controller 20 and the portal server 30 can be communicatively connected, wherein the terminal device 10 and the access controller 20 are connected by wire or wirelessly.

[0083] The access controller 20 is an AC (Access Point Controller, access control) device, that is, a NAS (Network Access Server, network access server) device with user access control function, unauthenticated user request interception redirection push function and Portal protocol server function, wherein the user access control function is to control the terminal device 10 to access the network when it is determined that the terminal device 10 has been authenticated; the unauthenticated user request interception redirection push function is to intercept the Internet access request of the terminal device 10 when it is determined that the terminal device 10 is not authenticated, and push a redirection request to the terminal device 10, so as to redirect the Internet access request of the terminal device 10 to the portal server 30 for access authentication; the Portal protocol server function is to open Internet access rights for the terminal device 10 after receiving the access notification sent by the portal server 30. Among them, the access controller 20 is set in a public place to provide a public local area network. For example, the access controller 20, that is, the NAS device, can be a gateway device, a three-layer switch or a router.

[0084] The portal server 30 is a portal server, which is used to provide a portal authentication website, i.e., a portal website, for the terminal device 10. The user enters authentication information through the portal website. Since the access controller 20 of the embodiment of the present application provides a public network, the authentication information is generally a text message verification code, application authorization information and a dynamic password. After receiving the authentication information, the portal server 30 verifies the authentication information. After the verification passes, the access controller 20 is notified to open the Internet access permission for the terminal device 10. The portal server 30 no longer needs to access the Radius server to authenticate the user's authentication information, which simplifies the access authentication process and makes the network access process for the public network more reasonable.

[0085] use Figure 2In the access authentication system shown, the terminal device 10 sends an Internet access request to the access controller 20. After the access controller 20 determines that the terminal device 10 is not authenticated, it sends a redirection request and an identifier of the portal server 30 to the terminal device 10, so that the terminal device 10 sends a redirection request to the portal server 30 according to the identifier of the portal server 30. The portal server 30 pushes an access authentication interface to the terminal device 10 according to the redirection request, so as to verify the access authentication information input by the terminal device 10 through the access authentication interface, and then notify the access controller 20 to provide network services for the terminal device 10.

[0086] Based on the above access authentication system, an embodiment of the present application provides an access authentication method, which is applied to the access controller 20 of the above access authentication system, that is, the access controller.

[0087] Please refer to Figure 3 , which is a flow chart of the access authentication method provided in the embodiment of the present application Figure 1 ,like Figure 3 As shown, the method may include:

[0088] S11: receiving an Internet access request sent by a terminal device, where the Internet access request includes: address information of the terminal device.

[0089] In this embodiment, the terminal device and the access controller are connected by wired or wireless communication. If wireless communication is used, the terminal device needs to be in the local area network coverage area of ​​the access controller. After the terminal device is connected by communication with the access controller, an Internet access request is sent to the terminal device. The Internet access request is actually a request to access a website or use an application through the local area network provided by the access controller. The Internet access request includes: the address information of the terminal device, which is used to ensure that the access controller can provide the terminal device with a network according to the address information. The address information may include: the MAC (Media Access Control) address and the IP (Internet Protocol) address of the terminal device.

[0090] S12: Determine whether the terminal device has been authenticated based on the address information.

[0091] In this embodiment, the access controller stores in a preset authentication registration table, in which address information of terminal devices that have passed authentication is registered. After receiving an Internet access request sent by a terminal device, the access controller searches the address information of multiple terminal devices in the preset authentication registration table for confirmation, based on the address information of the terminal device carried in the Internet access request, whether the address information of the terminal device is included. If the address information of the terminal device is included in the preset authentication registration table, it is determined that the terminal device has been authenticated. If the address information of the terminal device is not included in the preset authentication registration table, it is determined that the terminal device has not been authenticated.

[0092] In a possible implementation, if the terminal device has been authenticated, the access controller enables the terminal device to access a website or use an application according to an Internet access request.

[0093] S13: If the terminal device is not authenticated, a redirection request and an identifier of the portal server are sent to the terminal device, so that the terminal device forwards the redirection request to the portal server, so that the portal server performs access authentication on the terminal device.

[0094] In this embodiment, if it is determined that the terminal device is not authenticated, the terminal device needs to be authenticated first before Internet access service can be provided to the terminal device.

[0095] Specifically, the access controller generates a redirection request according to the Internet access request of the terminal device, and sends the redirection request and the identification of the portal server to the terminal device. The terminal device accesses the portal server according to the identification of the portal server, and sends the redirection request to the portal server. The portal server pushes the access authentication interface to the terminal device according to the redirection request, and the user interacts with the portal server for authentication through multiple authentication methods provided in the access authentication interface. Among them, the identification of the portal server can be the URL (Uniform Resource Locator) address of the portal server.

[0096] S14: receiving an admission notification sent by the portal server, where the admission notification is a message sent by the portal server after the portal server performs access authentication on the terminal device.

[0097] In this embodiment, after the portal server passes the access authentication of the terminal device, it sends an admission notification to the access controller, and the admission notification includes information related to the network access protocol, so that the access controller and the portal server can interact according to the network access protocol.

[0098] For example, the interaction between the access controller and the portal server mainly includes the portal server requesting the access controller to provide network access authority to the terminal device, notifying the access controller that the terminal device is offline, and requesting the terminal device to cancel the network access authority of the terminal device.

[0099] S15: Control terminal devices to access the network.

[0100] In this embodiment, after receiving the admission notification, the access controller determines that the interactive authentication between the terminal device and the portal server is successful, and the access controller grants Internet access permission to the terminal device according to the address information of the terminal device.

[0101] In one possible implementation, after the access authentication is successful and Internet access permission is opened for the terminal device, while the terminal device maintains a communication connection with the access controller, the terminal device can directly access the web page or use the application through the local area network provided by the access controller; when the terminal device disconnects the communication connection with the access controller, if the terminal device needs to use the local area network provided by the access controller here, it is necessary to re-execute the above steps S11-S15 to perform access authentication and open Internet access permission.

[0102] The access authentication method provided in the above embodiment directly provides access authentication services through the portal server for terminal devices that have not undergone access authentication. After the access authentication of the terminal device is completed through the portal server, the access controller opens the Internet access permission for the terminal device. There is no need to perform secondary authentication on the terminal device through the Radius server, which simplifies the access authentication process and makes the network access process for the public network more reasonable. Since the network access process is more reasonable and simple, the concurrent authentication capability of the portal server can be improved, thereby improving the access authentication efficiency.

[0103] In a possible implementation, the redirection request includes: a request parameter and a first digital signature. Before the above S13 sends the redirection request to the terminal device, the method may further include:

[0104] Sign the request parameters to generate a first digital signature.

[0105] The redirection request is used by the portal server to verify the request parameters based on the first digital signature, and to perform access authentication on the terminal device after the request parameters are verified.

[0106] In this embodiment, in order to prevent the request parameters from being tampered with, the access controller signs the preset request parameters and generates a first digital signature. After the terminal device sends the redirection request to the portal server, the portal server also signs the request parameters and compares the generated digital signature with the first digital signature for consistency. If the digital signature generated by the portal server is consistent with the first digital signature, it is determined that the request parameters have not been tampered with, thereby ensuring the security of the access authentication process.

[0107] In a possible implementation, the access controller and the portal server use the same preset key to encrypt the request parameters and generate digital signatures respectively. The preset key can be a key configured by an administrator on the access controller and the portal server respectively. The preset key is not transmitted through network interaction to ensure that the preset key is not leaked.

[0108] In a possible implementation, the request parameters may include: the MAC address of the terminal device, the IP address of the terminal device, the unique KEY information of the access controller, the address to be accessed and the timestamp; wherein the address to be accessed is the address that the terminal device needs to access in the Internet access request sent by the terminal device; when encrypting the request parameters, a preset key may be written into the request parameters, so that the preset key is used to encrypt the request parameters containing the preset key, generate a first digital signature, implement irreversible encryption, avoid inferring the preset key based on the signature and the request parameters, and ensure that the preset key is not leaked. For example, the MD (Message-Digest) 5 encryption algorithm may be used to encrypt the request parameters.

[0109] It should be noted that when encrypting the request parameters, the preset key needs to be included, but when sending a redirect request to the portal server, the preset key cannot be carried in the request parameters. Since the access controller and the portal server use the same preset key, when verifying the request parameters, the portal server adds its own preset key to the request parameters, uses the preset key to encrypt the request parameters including the preset key, and compares the generated digital signature with the first digital signature for consistency.

[0110] The access authentication method provided in the above embodiment generates a first digital signature by encrypting the request parameters, so that the portal server can verify the request parameters according to the first digital signature, thereby preventing the request parameters from being tampered with during the interaction process and ensuring the security of the access authentication process.

[0111] In a possible implementation, the admission notification includes: terminal device information and the second digital signature. After the above S14 receives the admission notification sent by the portal server, the method may further include:

[0112] The terminal device information is verified according to the second digital signature.

[0113] The above S15 controlling the terminal device to access the network may include:

[0114] If the terminal device information is verified, the terminal device is controlled to access the network.

[0115] In this embodiment, when the portal server sends the terminal device information to the access controller, in order to prevent the terminal device information from being tampered with, the portal server needs to encrypt the terminal device information and generate a second digital signature. After the access controller receives the terminal device information sent by the portal server, the access controller also signs the terminal device information and compares the generated digital signature with the second digital signature for consistency. If the digital signature generated by the access controller is consistent with the second digital signature, it is determined that the terminal device information has not been tampered with, thereby ensuring the communication security between the access controller and the portal server.

[0116] For example, the terminal device information may be address information of a terminal device authorized for access by the portal server, access bandwidth limitation, access flow limitation, and other information provided by the portal server for each terminal device.

[0117] In a possible implementation, the access controller and the portal server use the same preset key to sign the terminal device information respectively.

[0118] In the access authentication method provided by the above embodiment, the access controller verifies the terminal device information according to the second digital signature to prevent the terminal device information from being tampered with during the interaction process, thereby ensuring the communication security between the access controller and the portal server.

[0119] In a possible implementation, the redirection request further includes: an address to be accessed; after the above S15 controls the terminal device to access the network, the method may further include:

[0120] An access response is sent to the portal server, where the access response is used to enable the portal server to push the web page corresponding to the address to be accessed to the terminal device.

[0121] In this embodiment, after the access controller grants Internet access permission to the terminal device according to the access notification, the access controller sends an access response to the portal server. After receiving the access response, the portal server determines that the terminal device can use the local area network provided by the access controller. Since the user has entered the address to be accessed when sending an Internet access request through the terminal device, after completing access authentication and Internet access permission activation for the terminal device, in order to avoid a poor user experience caused by the need for the user to re-enter the address to be accessed, the address to be accessed entered by the user in the Internet access request can be directly sent to the portal server through a redirection request, so that after determining that the access controller has granted Internet access permission to the terminal device, the portal server accesses the address to be accessed and pushes the web page corresponding to the address to be accessed to the terminal device.

[0122] In a possible implementation, when sending the access response, the access controller uses a preset key to encrypt the access response and generates a digital signature, so that the portal server can perform signature verification on the access response.

[0123] The access authentication method provided in the above embodiment enables the portal server to directly push the web page corresponding to the address to be accessed to the terminal device by sending an access response to the portal server, without the need for the user to re-enter the address to be accessed, thereby improving the user experience.

[0124] Based on the above access authentication system, an embodiment of the present application further provides an access authentication method, which is applied to the portal server 30 of the above access authentication system, that is, a Portal server.

[0125] Please refer to Figure 4 , which is a flow chart of the access authentication method provided in the embodiment of the present application Figure 2 ,like Figure 4 As shown, the method may include:

[0126] S21: receiving a redirection request forwarded by the terminal device, where the redirection request is sent by the access controller to the terminal device when it is determined that the terminal device is not authenticated based on the address information of the terminal device in the Internet access request sent by the terminal device.

[0127] S22: Perform access authentication on the terminal device.

[0128] S23: After the access authentication is successful, an admission notification is sent to the access controller so that the access controller controls the terminal device to access the network.

[0129] In this embodiment, the portal server receives a redirection request sent by the terminal device, the redirection request includes the address information of the terminal device, and the portal server pushes an access authentication interface to the terminal device according to the address information of the terminal device. The user interacts with the portal server for authentication through a variety of authentication methods provided in the access authentication interface. After the authentication is successful, the portal server sends an admission notification to the access controller to notify the access controller that the access authentication of the terminal device has been successful, so that the access controller can open Internet access permissions for the terminal device.

[0130] Among them, the method of generating the redirection request can refer to the aforementioned S11-S13, which will not be repeated here.

[0131] For example, the multiple authentication methods provided by the access authentication interface may include: SMS verification code authentication, application authentication, dynamic password authentication, graphic authentication, etc.

[0132] Among them, SMS verification code authentication is that the user enters the user's mobile phone number through the access authentication interface and requests to obtain the SMS verification code. After the access controller receives the request to obtain the SMS verification code, it sends the SMS verification code to the user through the operator to which the user's mobile phone number belongs. After receiving the SMS verification code, the user enters the SMS verification code on the access authentication interface and submits it. The access controller verifies the SMS verification code entered by the user and the SMS verification code sent to the user. If the SMS verification codes are consistent, the authentication is passed.

[0133] Application authentication is that the user selects the target application from the multiple application authentication methods provided in the access authentication interface, authorizes the target application's identity information, and then sends the target application's identity information to the access controller. After the access controller receives the target application's identity information, the authentication is completed.

[0134] Dynamic password authentication is that the access controller uses a preset algorithm to generate a random dynamic password and sends the dynamic password to the terminal device. The terminal device enters the dynamic password through the access authentication interface and submits it. The access controller verifies the dynamic password entered by the user and the dynamic password sent to the user. If the dynamic passwords are consistent, the authentication is passed.

[0135] Graphic authentication is a method in which the user provides a graphic through the access authentication interface and performs preset operations on the graphic, such as selecting specified words from the graphic, splicing and rotating the graphic, etc. The user's operation results are submitted to the access controller, and the access controller verifies the user's operation results. If the operation results meet the preset requirements, the authentication is passed.

[0136] In some embodiments, the interaction process between the terminal device and the portal server may use an https (hypertext transfer protocol secure) interface to ensure the security of the interaction process.

[0137] In the access authentication method provided in the above embodiment, the portal server provides access authentication services to terminal devices that have not undergone access authentication. After completing access authentication for the terminal device, it sends an access notification to the access controller, and the access controller opens Internet access rights for the terminal device. There is no need to perform secondary authentication on the terminal device through the Radius server, which simplifies the access authentication process and makes the network access process for the public network more reasonable. Since the network access process is more reasonable and simple, the concurrent authentication capability of the portal server can be improved, thereby improving the access authentication efficiency.

[0138] In a possible implementation, the redirection request includes: a request parameter and a first digital signature, where the first digital signature is generated by the access controller signing the request parameter. After the above S21 receives the redirection request forwarded by the terminal device, the method may further include:

[0139] The request parameters are verified based on the first digital signature.

[0140] The above S22 performs access authentication on the terminal device, which may include:

[0141] If the request parameter verification passes, the terminal device is authenticated for access.

[0142] In this embodiment, after receiving the request parameters and the first digital signature, the portal server encrypts the request parameters and compares the generated digital signature with the first digital signature for consistency. If the digital signature generated by the portal server is consistent with the first digital signature, it is determined that the request parameters have not been tampered with.

[0143] In a possible implementation, the access controller and the portal server use the same preset key to encrypt the request parameters respectively and generate digital signatures respectively.

[0144] For example, if the access controller encrypts the request parameters including the preset key to generate a first digital signature, although the request parameters in the redirection request do not include the preset key, after receiving the request parameters, the portal server needs to use the preset key to encrypt the preset key and the request parameters together, and then compare the generated digital signature with the first digital signature for consistency.

[0145] In one possible implementation, during the interaction between the terminal device and the portal server, in order to mark the interaction process, a temporary token instruction can be generated according to the request parameters, and the temporary token can be carried when the access authentication interface is pushed to the terminal device. The temporary token is carried throughout the process between the terminal device and the portal server to mark the interaction process with the temporary token, indicating that it is for this access authentication of the terminal device.

[0146] In the access authentication method provided by the above embodiment, the portal server verifies the request parameters according to the first digital signature, which can prevent the request parameters from being tampered with during the interaction process and ensure the security of the access authentication process.

[0147] In a possible implementation, the admission notification includes: terminal device information and the second digital signature. Before the above S23 sends the admission notification to the access controller, the method may further include:

[0148] Sign the terminal device information to generate a second digital signature.

[0149] The admission notification is used by the access controller to verify the terminal device information based on the second digital signature, and to control the terminal device to access the network after the terminal device information is verified.

[0150] In this embodiment, in order to prevent the terminal device information from being tampered with, which may cause risks to the access controller, the portal server needs to encrypt the terminal device information and generate a second digital signature. After the portal server sends the access notification to the access controller, the access controller signs the terminal device information and compares the generated digital signature with the second digital signature for consistency. If the digital signature generated by the access controller is consistent with the second digital signature, it is determined that the terminal device information has not been tampered with, and the access controller can open Internet access permissions for the terminal device.

[0151] For example, please refer to Table 1, which is the format and content of the admission notice provided in the embodiment of the present application. As shown in Table 1, the admission notice includes:

[0152] Ver is the protocol version number, which is 1 byte long; Type is the message type of the access notification, which is 1 byte long; Pap / Chap is the access authentication method of the terminal device, which is 1 byte long; Rsv is a reserved field, which is 1 byte long; SerialNo is the message serial number of the access notification, which is 2 bytes long and is randomly generated by the portal server. SerialNo is not repeated in different authentication processes within the preset time period; ReqID is randomly generated by the access controller, which is 2 bytes long; UserIP is the IP address of the terminal device, which is 4 bytes long; UserPort is a reserved field, which is 2 bytes long; ErrCode and Type are used in combination, which is 1 byte long; AttrNum identifies the number of attributes of the variable-length attribute field, which is 1 byte long; the Attractive field is a message attribute field, which is composed of multiple attributes connected in sequence; Authenticator is the second digital signature.

[0153] Table 1 Format and content of admission notice

[0154]

[0155] Optionally, the terminal device information included in the admission notification message may also carry information such as ACL (Access Control List) and QOS (Quality of Service) authorized by the terminal device.

[0156] The access authentication method provided in the above embodiment generates a second digital signature by encrypting the terminal device information, so that the access controller can verify the terminal device information according to the second digital signature, thereby preventing the terminal device information from being tampered with during the interaction process and ensuring the communication security between the access controller and the portal server.

[0157] In one possible implementation, see Figure 5, which is a flow chart of the access authentication method provided in the embodiment of the present application Figure 3 ,like Figure 5 As shown, after the above S23 sends the admission notification to the access controller, the method may further include:

[0158] S31: Receive an admission response sent by the access controller.

[0159] S32: Pushing the web page corresponding to the address to be accessed to the terminal device.

[0160] In this implementation, the portal server determines, based on the access response, that the access controller has enabled Internet access permissions for the terminal device, and that the terminal device can use the local area network provided by the access controller. Since the user has entered the address to be accessed when sending an Internet access request through the terminal device, after completing access authentication and Internet access permission activation for the terminal device, the portal server can directly access the address to be accessed entered by the user in the Internet access request, and push the web page corresponding to the address to be accessed to the terminal device.

[0161] In a possible implementation, if the network access request of the terminal device does not include the address to be accessed, the portal server may push the operator's recommendation interface to the terminal device.

[0162] In the access authentication method provided by the above embodiment, the access controller directly pushes the webpage corresponding to the address to be accessed to the terminal device according to the access response, without the user having to re-enter the address to be accessed, thereby improving the user experience.

[0163] The following combination Figure 6 The interactive process of the access authentication method in the embodiment of the present application is described.

[0164] Please refer to Figure 6 , is an interactive diagram of the access authentication method provided in the embodiment of the present application, such as Figure 6 As shown, the process may include:

[0165] S101: The terminal device sends an Internet access request to the access controller.

[0166] S102: The access controller determines that the terminal device is not authenticated, and sends a redirection request and an identifier of the portal server to the terminal device. The redirection request includes: a request parameter and a first digital signature.

[0167] S103: The terminal device sends a redirection request to the portal server.

[0168] S104: The portal server uses a preset key to perform signature verification on the request parameters.

[0169] S105: The portal server pushes the access authentication interface to the terminal device.

[0170] S106: The terminal device and the portal server perform access authentication interaction.

[0171] S107: If the authentication is successful, the portal server sends a signed access authentication notification to the access controller.

[0172] S108: The access controller uses a preset key to perform signature verification on the access notification.

[0173] S109: The access controller sends an admission response to be signed to the portal server.

[0174] S110: The portal server pushes a preset web page interface to the terminal device.

[0175] Based on the above embodiments, the present application also provides an access authentication device, which is applied to an access controller. Figure 7 , which is a schematic diagram of the structure of the access authentication device provided in the embodiment of the present application Figure 1 ,like Figure 7 As shown, the device comprises:

[0176] The Internet access request receiving module 11 is used to receive an Internet access request sent by a terminal device, wherein the Internet access request includes: address information of the terminal device;

[0177] The device authentication judgment module 12 is used to determine whether the terminal device has been authenticated according to the address information;

[0178] A redirection request sending module 13, for sending a redirection request and an identifier of the portal server to the terminal device if the terminal device is not authenticated, so that the terminal device forwards the redirection request to the portal server, so that the portal server performs access authentication on the terminal device;

[0179] The access notification receiving module 14 is used to receive the access notification sent by the portal server. The access notification is a message sent by the portal server after the terminal device passes the access authentication.

[0180] The access control module 15 is used to control the terminal device to access the network.

[0181] Optionally, the redirection request includes: a request parameter and a first digital signature; before the redirection request sending module 13, the device further includes:

[0182] A first signature module, used to sign the request parameters and generate a first digital signature;

[0183] The redirection request is used by the portal server to verify the request parameters based on the first digital signature, and to perform access authentication on the terminal device after the request parameters are verified.

[0184] Optionally, the admission notification includes: terminal device information and a second digital signature. After the admission notification receiving module 14, the device further includes:

[0185] A first signature verification module, used to verify the terminal device information according to the second digital signature;

[0186] The access control module is specifically used to control the terminal device to access the network if the terminal device information verification passes.

[0187] Optionally, the redirection request further includes: an address to be accessed; after the access control module 15, the device further includes:

[0188] The access response sending module is used to send an access response to the portal server, and the access response is used to enable the portal server to push the web page corresponding to the address to be accessed to the terminal device.

[0189] Based on the above embodiments, the present application also provides an access authentication device, which is applied to a portal server. Figure 8 , which is a schematic diagram of the structure of the access authentication device provided in the embodiment of the present application Figure 2 ,like Figure 8 As shown, the device comprises:

[0190] A redirection request receiving module 21, configured to receive a redirection request forwarded by a terminal device, wherein the redirection request is sent by the access controller to the terminal device when the access controller determines that the terminal device is not authenticated based on the address information of the terminal device in the Internet access request sent by the terminal device;

[0191] Access authentication module 22, used to perform access authentication on terminal devices;

[0192] The access notification sending module 23 is used to send an access notification to the access controller after the access authentication is successful, so that the access controller controls the terminal device to access the network.

[0193] Optionally, the redirection request includes: a request parameter and a first digital signature, where the first digital signature is generated by the access controller signing the request parameter. After the redirection request receiving module 21, the device further includes:

[0194] A second signature verification module, used to verify the request parameters based on the first digital signature;

[0195] The access authentication module is specifically used to perform access authentication on the terminal device if the request parameter verification passes.

[0196] Optionally, the admission notification includes: terminal device information and a second digital signature. Before the admission notification sending module 23, the device further includes:

[0197] The second signature module is used to sign the terminal device information and generate a second digital signature;

[0198] The admission notification is used by the access controller to verify the terminal device information based on the second digital signature, and to control the terminal device to access the network after the terminal device information is verified.

[0199] Optionally, the redirection request further includes: an address to be accessed; after the admission notification sending module 23, the device further includes:

[0200] An admission response receiving module, used for receiving an admission response sent by an access controller;

[0201] The web page push module is used to push the web page corresponding to the address to be visited to the terminal device.

[0202] The above-mentioned device is used to execute the method provided by the aforementioned embodiment, and its implementation principle and technical effect are similar, which will not be repeated here.

[0203] The above modules may be one or more integrated circuits configured to implement the above methods, such as one or more application specific integrated circuits (ASICs), or one or more microprocessors, or one or more field programmable gate arrays (FPGAs). For another example, when a module is implemented in the form of a processing element scheduling program code, the processing element may be a general-purpose processor, such as a central processing unit (CPU) or other processor that can call program code. For another example, these modules may be integrated together and implemented in the form of a system-on-a-chip (SOC).

[0204] Please refer to Fig. 9 , is a schematic diagram of an electronic device provided in an embodiment of the present application, such as Fig. 9 As shown, the electronic device 100 includes: a processor 101, a storage medium 102 and a bus, the storage medium 102 stores program instructions executable by the processor 101, when the electronic device 100 is running, the processor 101 and the storage medium 102 communicate through the bus, and the processor 101 executes the program instructions to execute the steps of the Internet access authentication method applied to the access controller or the steps of the Internet access authentication method applied to the portal server. The specific implementation method and technical effect are similar and will not be repeated here.

[0205] Optionally, the present invention further provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the steps of the Internet access authentication method applied to the access controller or the steps of the Internet access authentication method applied to the portal server are executed. The specific implementation method and technical effect are similar and will not be repeated here.

[0206] In the several embodiments provided by the present invention, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0207] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0208] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of hardware plus software functional units.

[0209] The above-mentioned integrated unit implemented in the form of a software functional unit can be stored in a computer-readable storage medium. The above-mentioned software functional unit is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) or a processor (English: processor) to perform some steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (English: Read-Only Memory, abbreviated: ROM), random access memory (English: Random Access Memory, abbreviated: RAM), disk or optical disk and other media that can store program codes.

[0210] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any person skilled in the art who is familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed by the present invention, which should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

Claims

1. An access authentication method, characterized in that: Applied to an access controller, the method comprises: Receiving an Internet access request sent by a terminal device, the Internet access request including: address information of the terminal device; Determining whether the terminal device has been authenticated according to the address information; If the terminal device is not authenticated, sending a redirection request and an identifier of the portal server to the terminal device, so that the terminal device forwards the redirection request to the portal server, so that the portal server pushes an access authentication interface to the terminal device, and performs access authentication on the access authentication information input by the terminal device through the access authentication interface; receiving an admission notification sent by the portal server, wherein the admission notification is a message sent by the portal server after the portal server performs access authentication on the terminal device; Controlling the terminal device to access the network; The redirection request includes: a request parameter and a first digital signature; before sending the redirection request to the terminal device, the method further includes: Signing the request parameters to generate the first digital signature; The redirection request is used by the portal server to verify the request parameters based on the first digital signature, and to perform access authentication on the terminal device after the request parameters are verified.

2. The method according to claim 1, characterized in that The admission notification includes: terminal device information and a second digital signature. After receiving the admission notification sent by the portal server, the method further includes: Verifying the terminal device information according to the second digital signature; The controlling the terminal device to access the network includes: If the terminal device information verification passes, the terminal device is controlled to access the network.

3. The method according to claim 2, characterized in that The redirection request further includes: an address to be accessed; after controlling the terminal device to access the network, the method further includes: An access response is sent to the portal server, where the access response is used to enable the portal server to push the web page corresponding to the address to be accessed to the terminal device.

4. An access authentication method, characterized in that: Applied to a portal server, the method comprises: receiving a redirection request forwarded by a terminal device, wherein the redirection request is sent to the terminal device by the access controller when it is determined that the terminal device is not authenticated based on the address information of the terminal device in the Internet access request sent by the terminal device; Pushing an access authentication interface to the terminal device, and performing access authentication on the access authentication information input by the terminal device through the access authentication interface; After the access authentication succeeds, sending an admission notification to the access controller so that the access controller controls the terminal device to access the network; The redirection request includes: a request parameter and a first digital signature, where the first digital signature is generated by the access controller signing the request parameter. After the redirection request forwarded by the receiving terminal device, the method further includes: Verifying the request parameters based on the first digital signature; The performing access authentication on the terminal device includes: If the request parameter verification passes, access authentication is performed on the terminal device.

5. The method according to claim 4, characterized in that The admission notification includes: terminal device information and a second digital signature. Before sending the admission notification to the access controller, the method further includes: Signing the terminal device information to generate the second digital signature; The admission notification is used by the access controller to verify the terminal device information based on the second digital signature, and to control the terminal device to access the network after the terminal device information is verified.

6. The method according to claim 4, characterized in that The redirection request further includes: an address to be accessed; after sending the admission notification to the access controller, the method further includes: receiving an admission response sent by the access controller; Pushing the webpage corresponding to the address to be accessed to the terminal device.

7. An access authentication device, characterized in that: Applied to an access controller, the device comprises: An Internet access request receiving module, used to receive an Internet access request sent by a terminal device, wherein the Internet access request includes: address information of the terminal device; A device authentication judgment module, used to determine whether the terminal device has been authenticated according to the address information; a redirection request sending module, configured to send a redirection request and an identifier of a portal server to the terminal device if the terminal device is not authenticated, so that the terminal device forwards the redirection request to the portal server, so that the portal server pushes an access authentication interface to the terminal device, and performs access authentication on the access authentication information input by the terminal device through the access authentication interface; An admission notification receiving module, used to receive an admission notification sent by the portal server, wherein the admission notification is a message sent by the portal server after the portal server performs access authentication on the terminal device; An access control module, used to control the terminal device to access the network; The redirection request includes: request parameters and a first digital signature; A first signature module, used to sign the request parameter to generate the first digital signature; The redirection request is used by the portal server to verify the request parameters based on the first digital signature, and to perform access authentication on the terminal device after the request parameters are verified.

8. An access authentication device, characterized in that: Applied to a portal server, the device comprises: A redirection request receiving module, used to receive a redirection request forwarded by a terminal device, wherein the redirection request is sent to the terminal device by the access controller when it is determined that the terminal device is not authenticated based on the address information of the terminal device in the Internet access request sent by the terminal device; An access authentication module, used to push an access authentication interface to the terminal device, and perform access authentication on the access authentication information input by the terminal device through the access authentication interface; An access notification sending module, configured to send an access notification to the access controller after the access authentication is successful, so that the access controller controls the terminal device to access the network; The redirection request includes: a request parameter and a first digital signature, where the first digital signature is generated by the access controller signing the request parameter; A second signature verification module, used to verify the request parameters based on the first digital signature; The access authentication module is specifically used to perform access authentication on the terminal device if the request parameter verification passes.

Images