A bypass authentication method and system of AC+AP mode

Abstract

The application discloses an AC+AP mode bypass authentication method and system, and belongs to the communication field. A first authentication mode is arranged in the AC end, a second authentication mode is arranged in the AP end, the first authentication mode is started, the second authentication mode is run, and the first authentication mode is in an authentication preparation state. The AP end receives an authentication probe message of a terminal and performs second authentication on the authentication probe message through the second authentication mode. The AC end receives the authentication probe message which passes the authentication under the second authentication mode through a virtual interface, and cancels the authentication preparation state of the first authentication mode and starts the first authentication. After the first authentication is finished, a bypass authentication process is completed. The application completes the authentication through the AC+AP, avoids the situation that the WIFI authentication module cannot be used, can normally use the authentication function in the bypass mode, does not need to add an authentication server, reduces deployment cost and management cost, and can complete all management in the AC end.

Description

Technical Field

[0001] This invention relates to the field of communications, and more particularly to a bypass authentication method and system in AC+AP mode. Background Technology

[0002] In real-world network deployments, there are instances where the AC controller is deployed in bypass mode, meaning it only controls the access points (APs) and doesn't participate in data forwarding. In this situation, the Wi-Fi authentication function on the AC controller is unusable because it doesn't participate in data forwarding. Therefore, an additional authentication server is needed to implement Wi-Fi authentication. Previously, Wi-Fi authentication relied on the NetFILTER module in the AC controller's kernel, utilizing the NetFILTER module's NAT functionality to redirect data, thereby redirecting the page and achieving authentication.

[0003] When AC is deployed in bypass mode, since AC does not participate in data forwarding, it cannot obtain the data required for authentication, and the authentication function cannot be effective. To use the authentication function, an authentication server must be added to the network system. Summary of the Invention

[0004] The purpose of this invention is to overcome the situation in the prior art where the wireless access controller does not participate in traffic forwarding in the bypass deployment mode, resulting in the inability to use the WIFI authentication function provided by the wireless access controller. This invention provides a bypass authentication method and system in AC+AP mode.

[0005] The objective of this invention is achieved through the following technical solution:

[0006] This mainly provides a bypass authentication method in AC+AP mode, the method including:

[0007] Set the first authentication mode internally on the AC side and the second authentication mode on the AP side;

[0008] When the first authentication mode is enabled, the second authentication mode is run, and the first authentication mode is put into the authentication preparation state. The authentication preparation state is that the AC end listens for data from the AP end through the built-in virtual interface and waits to receive the message sent by the AP end.

[0009] The AP receives the authentication probe message sent by the terminal and performs a second authentication on the authentication probe message through the second authentication mode;

[0010] The AC terminal receives the authentication probe message that has been successfully authenticated in the second authentication mode through the virtual interface, and releases the authentication preparation state of the first authentication mode and starts the first authentication.

[0011] After the first authentication is completed, the bypass authentication process is completed.

[0012] A bypass authentication method in AC+AP mode is provided, the method comprising:

[0013] The AC side enables authentication and sends an authentication enable message to the AP side. It also listens for authentication probe messages forwarded by the AP side through the virtual interface.

[0014] The AC terminal determines whether the authentication probe message requires authentication. If no authentication is required, it directly returns the terminal's IP address to the AP terminal and instructs the AP terminal to allow the terminal's data to pass through. If authentication is required, it determines the type of authentication to be performed.

[0015] The AC terminal sends an authentication page to the terminal according to the authentication type;

[0016] The AC terminal determines whether the authentication is successful based on the information entered by the terminal on the authentication page. If the authentication is successful, the AC terminal records the terminal's IP address and sends the terminal's IP address to the AP terminal, while instructing the AP terminal to allow the terminal's data to pass through.

[0017] A bypass authentication method in AC+AP mode is provided, the method comprising:

[0018] The AP receives the authentication enable message from the AC and enables authentication.

[0019] The AP receives the authentication probe message sent by the terminal and determines whether the current authentication probe message requires authentication. If no authentication is required, the terminal's data is allowed to pass; if authentication is required, the authentication probe message is redirected to the virtual interface of the AC for authentication.

[0020] If authentication is successful, the AP receives the terminal's IP address and allows the terminal's data to pass through.

[0021] As an option, a bypass authentication method in AC+AP mode, wherein the AC end determines whether the authentication probe packet requires authentication, including:

[0022] The AC terminal configures an address range for authentication. If the IP address of the authentication probe packet is within the configured address range, authentication is required; otherwise, authentication is not required.

[0023] As an option, a bypass authentication method in AC+AP mode, wherein the IP address of the virtual interface is 192.168.239.11, and different ports are bound for HTTP and HTTPS to process data: the HTTP is bound to port 2060, and the HTTPS is bound to port 8443.

[0024] As an option, a bypass authentication method in AC+AP mode, wherein the AP determines whether the current authentication probe packet requires authentication, including:

[0025] Create a hash table indexed by IP address on the AP side. Match the source IP address carried by the authentication probe message with the IP address in the hash table. If the match is successful, authentication is required; otherwise, authentication is not required.

[0026] As an option, a bypass authentication method in AC+AP mode, wherein redirecting the authentication probe message to the virtual interface of the AC end for authentication includes:

[0027] The AP modifies the destination IP address and port number of the successfully matched authentication probe packet and sends the modified authentication probe packet to the AC:

[0028] Change the HTTP data on port 80 to the destination IP 192.168.239.11 and the port number to 2060. Change the HTTPS data on port 443 to the destination IP 192.168.239.11 and the port number to 8443.

[0029] The present invention also provides a bypass authentication system in AC+AP mode, the system including an AC terminal, an AP terminal, a terminal, a Layer 3 switch, and an egress router. The AC terminal is connected to the Layer 3 switch through a LAN port, and the AP terminal is connected to the Layer 3 switch through an uplink port. The Layer 3 switch is also connected to the egress router.

[0030] The AC terminal has a separate virtual interface for internal use, and listens for authentication probe messages forwarded by the AP terminal through the virtual interface.

[0031] The AC terminal also includes an authentication switch; the AP terminal is equipped with an authentication module, which is connected to the virtual interface.

[0032] As an option, an AC+AP mode bypass authentication system includes an authentication module that includes a hash table indexed by IP address.

[0033] As an option, in an AC+AP mode bypass authentication system, the Layer 3 switch distinguishes between terminal internet access data and data requiring authentication by dividing VLANs. The IP address of the AP is assigned by the AC, and the IP address of the terminal is assigned by the Layer 3 switch.

[0034] It should be further noted that the technical features corresponding to the above options can be combined or substituted to form new technical solutions.

[0035] Compared with the prior art, the beneficial effects of the present invention are:

[0036] (1) The present invention deploys authentication modes on the AC end and AP end respectively, and completes authentication through AC+AP, avoiding the situation where the WIFI authentication module cannot be used. The authentication function can be used normally in the bypass mode without adding an authentication server, reducing deployment and management costs. All management can be completed on the AC end.

[0037] (2) The AC end adds a virtual interface, which is bound to an organization similar to an authentication server through the IP address and port of the virtual interface. It does not involve VLAN configuration on the AC end.

[0038] (3) The IP address range is used to determine whether authentication is required, without relying on VLAN; after successful authentication, the terminal IP address is sent directly to the AP. The AP can directly use the IP address to allow the terminal data to pass through, which is simpler and more effective than traditional authentication methods.

[0039] (4) Added HTTPS processing. By listening to the port, it can process data on ports 80 and 443 at the same time. Modifying the destination IP and port of the message does not involve modifying the actual content of the message, so there will be no situation where HTTPS messages cannot be processed, and it has better compatibility. Attached Figure Description

[0040] Figure 1 This is a flowchart of a bypass authentication method in AC+AP mode according to the present invention;

[0041] Figure 2 This is a schematic diagram of an AC+AP mode bypass authentication system according to the present invention. Detailed Implementation

[0042] The technical solution of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0043] Furthermore, the technical features involved in the different embodiments of the present invention described below can be combined with each other as long as they do not conflict with each other.

[0044] This invention primarily achieves authentication through AC+AP collaboration, avoiding situations where the WIFI authentication module is unusable. The authentication function can be used normally in bypass mode without the need for a new authentication server, reducing deployment and management costs. All management can be completed on the AC side.

[0045] Example 1

[0046] In one exemplary embodiment, a bypass authentication method in AC+AP mode is mainly provided, such as... Figure 1 As shown, the method includes:

[0047] Set the first authentication mode internally on the AC side and the second authentication mode on the AP side;

[0048] When the first authentication mode is enabled, the second authentication mode is run, and the first authentication mode is put into the authentication preparation state. The authentication preparation state is that the AC end listens for data from the AP end through the built-in virtual interface and waits to receive the message sent by the AP end.

[0049] The AP receives the authentication probe message sent by the terminal and performs a second authentication on the authentication probe message through the second authentication mode;

[0050] The AC terminal receives the authentication probe message that has been successfully authenticated in the second authentication mode through the virtual interface, and releases the authentication preparation state of the first authentication mode and starts the first authentication.

[0051] After the first authentication is completed, the bypass authentication process is completed.

[0052] Specifically, the first authentication mode inside the AC terminal is activated. When the first authentication mode is activated, the AC terminal controls the second authentication mode inside the AP terminal to run. At this time, the first authentication mode is in the authentication preparation state, waiting to receive authentication data uploaded by the AP terminal.

[0053] When a terminal needs to use the current Wi-Fi, it first sends an authentication probe message to the Access Point (AP) to determine if authentication is required. If no authentication is required, the AP allows the data to pass without authentication, enabling the terminal to access the internet normally. If authentication is required, the AP authenticates the probe message using the second authentication mode. The AP forwards the successfully authenticated probe message to the virtual interface of the Access Control Center (AC). Upon receiving the forwarded probe message, the AC enters the first authentication mode and completes the bypass authentication process. If the first authentication is successful, the terminal is allowed to access the internet; otherwise, it is not allowed.

[0054] The method of this invention deploys authentication modes on both the AC and AP sides, and completes authentication through AC+AP, avoiding the situation where the WIFI authentication module cannot be used. The authentication function can be used normally in bypass mode without adding an authentication server, reducing deployment and management costs, and all management can be completed on the AC side.

[0055] Example 2

[0056] In one exemplary embodiment, a bypass authentication method in AC+AP mode is provided, the method comprising:

[0057] The AC side enables authentication and sends an authentication enable message to the AP side. It also listens for authentication probe messages forwarded by the AP side through the virtual interface.

[0058] The AC terminal determines whether the authentication probe message requires authentication. If no authentication is required, it directly returns the terminal's IP address to the AP terminal and instructs the AP terminal to allow the terminal's data to pass through. If authentication is required, it determines the type of authentication to be performed.

[0059] The AC terminal sends an authentication page to the terminal according to the authentication type;

[0060] The AC terminal determines whether the authentication is successful based on the information entered by the terminal on the authentication page. If the authentication is successful, the AC terminal records the terminal's IP address and sends the terminal's IP address to the AP terminal, while instructing the AP terminal to allow the terminal's data to pass through.

[0061] Specifically, a bypass authentication method in AC+AP mode, wherein the AC end determines whether the authentication probe packet requires authentication, including:

[0062] The AC terminal configures an address range for authentication. If the IP address of the authentication probe packet falls within this range, authentication is required; otherwise, it is not. This method determines authentication based on the IP address range, independent of VLANs. Upon successful authentication, the terminal's IP address is directly sent to the AP terminal, which can then use this IP address to allow data transmission to the terminal. This approach is simpler and more effective than traditional authentication methods.

[0063] Furthermore, the AC terminal performs a function similar to an authentication server. It receives redirection messages from the AP terminal, distinguishes different authentication types based on the source IP address according to the authentication server's configuration file, and sends the corresponding authentication portal page to the smart terminal. The terminal then displays the portal page for further authentication. After the portal page appears, the corresponding authentication operation is performed on the page. The AC terminal determines whether authentication is successful based on the input. If authentication is successful, it updates the terminal's IP address and sends it to the AP terminal, allowing the terminal's data to pass. The updated terminal IP address is used by the AP terminal to determine whether the terminal requires authentication.

[0064] Example 3

[0065] In one exemplary embodiment, a bypass authentication method in AC+AP mode is provided, the method comprising:

[0066] The AP receives the authentication enable message from the AC and enables authentication.

[0067] The AP receives the authentication probe message sent by the terminal and determines whether the current authentication probe message requires authentication. If no authentication is required, the terminal's data is allowed to pass; if authentication is required, the authentication probe message is redirected to the virtual interface of the AC for authentication.

[0068] If authentication is successful, the AP receives the terminal's IP address and allows the terminal's data to pass through.

[0069] Specifically, the AP (Access Point) is responsible for data filtering and packet redirection. After a terminal (such as a mobile phone) is associated with the SSID of the AP, the smart terminal will use HTTP packets to detect whether the current WIFI requires authentication. The AP determines whether the current packet needs authentication by using the source IP address of the HTTP packets on ports 80 and 443. Data that does not require authentication is allowed to pass through directly, allowing the terminal to access the Internet normally. Data that requires authentication is redirected to the AC (Access Point) for authentication processing by modifying the destination IP and port of the packet.

[0070] Example 4

[0071] In this embodiment, a bypass authentication method in AC+AP mode is provided, wherein the IP address of the virtual interface is 192.168.239.11, and different ports are bound for HTTP and HTTPS to process data: the HTTP is bound to port 2060, and the HTTPS is bound to port 8443.

[0072] Furthermore, a bypass authentication method in AC+AP mode, wherein the AP determines whether the current authentication probe packet requires authentication, includes:

[0073] Create a hash table indexed by IP address on the AP side. Match the source IP address carried by the authentication probe message with the IP address in the hash table. If the match is successful, further authentication is required; otherwise, no authentication is required.

[0074] Furthermore, a bypass authentication method in AC+AP mode, wherein redirecting the authentication probe message to the virtual interface of the AC end for authentication includes:

[0075] The AP modifies the destination IP address and port number of the successfully matched authentication probe packet and sends the modified authentication probe packet to the AC:

[0076] Change the HTTP data on port 80 to the destination IP 192.168.239.11 and the port number to 2060. Change the HTTPS data on port 443 to the destination IP 192.168.239.11 and the port number to 8443.

[0077] Specifically, the AC terminal enables the authentication function, configures the authentication address range and authentication internet access time, starts authentication, listens for HTTP and HTTPS messages uploaded by the AP terminal, prepares to receive authentication data uploaded by the AP terminal, and sends an authentication start message to the AP terminal, so that the AP terminal starts the WIFI authentication mode.

[0078] This method adds HTTPS handling by listening on ports, allowing it to process data from both ports 80 and 443 simultaneously. It modifies the destination IP and port of the message without altering the actual content of the message, thus avoiding situations where HTTPS messages cannot be processed and providing better compatibility.

[0079] After receiving the authentication enable message, the AP initiates authentication, creates a hash table to store successful authentication pages, and simultaneously begins fetching data from the TCP / IP protocol stack, filtering for data from ports 80 and 443. Here, it's crucial to ensure the DNS and DHCP servers are functioning correctly, allowing DNS and DHCP messages to pass through while discarding UDP messages that are not needed.

[0080] The filtered data from ports 80 and 443 is redirected to the AC end, the destination address and port of the packet are modified, the data is sent to the AC end, and a TCP connection is established with the AC end.

[0081] After receiving the redirect message from the AP, the AC terminal determines the message type. If it is not an HTTP GET request message, no action is taken. If it is an HTTP GET request message, the AC terminal determines whether the terminal needs authentication. If no authentication is required, the AC terminal sends a message to inform the AP to allow the terminal to access the data. If authentication is required, the AC terminal determines the authentication type based on the IP address and returns an authentication page to the terminal for authentication according to the different authentication types.

[0082] The terminal performs authentication based on the pop-up authentication prompt. The AC determines whether the authentication is successful based on the information entered by the terminal. If the authentication fails, no action is taken. If the authentication is successful, the terminal's IP address is sent to the AP. The AP then allows the terminal's data to pass through and returns a message to the terminal indicating whether the authentication was successful or failed.

[0083] The AC and AP communicate via CAPWAP messages. These messages primarily send successful authentication data from the AC to the AP, along with updates to page configuration settings and blacklists / whitelists. The AC also periodically updates the AP with expired authentication information based on the authentication duration. The AP then deletes the terminal's information, requiring re-authentication for the terminal to access the internet.

[0084] Furthermore, the AC end adds a virtual interface, which is bound to an organization similar to an authentication server through the IP address and port of the virtual interface, without involving VLAN configuration on the AC end.

[0085] Example 5

[0086] This invention also provides a bypass authentication system in AC+AP mode, such as Figure 2 As shown, the system includes an AC terminal, an AP terminal, a terminal, a Layer 3 switch, and an egress router. The AC terminal is connected to the Layer 3 switch via a LAN port, and the AP terminal is connected to the Layer 3 switch via an uplink port. The Layer 3 switch is also connected to the egress router.

[0087] The AC terminal has a separate virtual interface for internal use, and listens for authentication probe messages forwarded by the AP terminal through the virtual interface.

[0088] The AC terminal also includes an authentication switch; the AP terminal is equipped with an authentication module, which is connected to the virtual interface.

[0089] Specifically, add configuration for the first authentication mode on the AC side: authentication types include account password authentication, QR code authentication, and WeChat authentication; authentication switch: ON OFF; authentication scope is the IP address that needs to be authenticated. Create a separate network interface for the authentication module within the AC side.

[0090] Furthermore, the AC side uses libuhttpd and libubox to create an HTTP server, using HTTP to listen for data on port 192.168.239.11:2060 and using HTTPS to listen for data on port 192.168.239.11:8443.

[0091] Furthermore, an AC+AP mode bypass authentication system adds an authentication module to the kernel space of the AP end to specifically handle authentication data. The authentication module includes a hash table indexed by IP address to store the data required by the authentication module.

[0092] The packets are retrieved from the TCP / IP protocol stack of the AP kernel and filtered using the SKB header:

[0093] First, the source IP address carried in the message is matched with the IP address in the HASH table. If the match is successful, the message is allowed to be forwarded. If not, the UDP message is filtered out by the TCP / IP header information carried in the message and is discarded without any processing.

[0094] For TCP data, DHCP and DNS service data are allowed to pass through via port numbers, i.e., data on ports 53 and 67. HTTP and HTTPS packets are forwarded to the AC end, i.e., data on ports 80 and 443 is forwarded. Data on other ports is discarded.

[0095] The forwarding operation works on the same principle as NAT. Data is transmitted to the AC by modifying the destination IP address and port number of the SKB. Here, the AC controller provides a fixed port number and IP address to receive data sent by the AP. HTTP data on port 80 is modified to have a destination IP of 192.168.239.11 and a port number of 2060; HTTPS data on port 443 is modified to have a destination IP of 192.168.239.11 and a port number of 8443. After modifying the packet, the packet checksum needs to be modified to ensure the packet is intact after forwarding.

[0096] Furthermore, in an AC+AP mode bypass authentication system, the Layer 3 switch distinguishes between terminal internet access data and data requiring authentication by dividing VLANs. The IP address of the AP is assigned by the AC, and the IP address of the terminal is assigned by the Layer 3 switch. Terminal internet access data is forwarded to the egress router, and data requiring authentication is forwarded to the AC.

[0097] Furthermore, the IP addresses of the access points (APs) are assigned by the control agent (AC) within the management VLAN, while the IP addresses of the terminals are assigned by the Layer 3 switch. The Layer 3 switch is configured with a default route pointing to the IP address of the egress router, and the router is configured with a static route pointing to the Layer 3 switch. The control agent does not participate in data forwarding for terminals accessing the internet, i.e., it does not participate in NAT.

[0098] Example 6

[0099] Based on Example 4, an example of AC-side authentication is given. Specifically, after the authentication server receives the authentication data forwarded by the AP, it compares the IP address of the received data packet with the authentication range configured on the web. First, it determines whether the terminal data requires authentication. If no authentication is required, it directly returns the terminal's IP address to the AP, allowing the terminal's data to pass. If authentication is required, it further compares the IP address to determine the type of authentication needed. For account / password authentication, it returns the account / password authentication data; for QR code authentication, it returns the QR code authentication data. The returned data here is the portal page data, i.e., the page that pops up on the mobile phone.

[0100] The returned data utilizes page redirection, sending the portal page address to the smart terminal via a connection established between the terminal and the authentication server, thus popping up the page. All page data is stored under the AC's WWW service and can be accessed via the AC gateway address and file path, without requiring external device involvement.

[0101] After the portal page pops up, it is necessary to confirm whether the terminal user has been correctly authenticated. For example, for account and password authentication, the correct account and password need to be saved on the AC in advance. After the user enters the account and password, the AC will verify whether the entered password is correct in the background. If the password is correct, the terminal's IP address will be sent to the AP, allowing the AP to allow the terminal's data.

[0102] The methods for verifying successful authentication differ between QR code authentication and WeChat authentication. A module needs to be added within the AC to determine authentication success. For QR code authentication, after the smart terminal connects to the corresponding SSID, a portal page pops up, prompting the user to scan a QR code for authentication. The user needs to scan the QR code provided by the merchant. After scanning the QR code, the customer will access an authentication success page on the AC. This page is fixed, with the address 192.168.239.11:2071. The AC continuously listens to this address. When the AC detects a user accessing this page, it records the smart terminal's IP address and sends it to the AP, allowing the AP to allow terminal data and internet access. Simultaneously, it returns an authentication success page to the smart terminal.

[0103] For WeChat authentication, guidance is provided when the portal page pops up. Following the prompts, clicking "authenticate" will redirect you to WeChat. After following the official account, click the "WIFI authentication" button (this button needs to be configured beforehand). Clicking the button will access the authentication success page on the AC (Access Controller). This page is fixed, with the address 192.168.239.11:2070. The AC continuously listens on this address. When the AC detects a user accessing this page, it records the smart terminal's IP address and sends it to the AP (Access Point), allowing the AP to allow the terminal's data and internet access. Simultaneously, it will return an authentication success page to the smart terminal.

[0104] The above detailed embodiments are a description of the present invention. It should not be considered that the specific embodiments of the present invention are limited to these descriptions. For those skilled in the art, several simple deductions and substitutions can be made without departing from the concept of the present invention, and all of these should be considered to fall within the protection scope of the present invention.

Claims

1. An AC+AP mode bypass authentication system, characterized by, The system comprises an AC end, an AP end, a terminal, a three-layer switch and an export router, the AC end is connected to the three-layer switch through a LAN port, and the AP end is connected to the three-layer switch through an uplink port; the three-layer switch is also connected to the export router; The AC end is internally provided with a virtual interface used alone, and the authentication probe message forwarded by the AP end is listened through the virtual interface; The AC end further comprises an authentication switch; the AP end is provided with an authentication module, and the authentication module is connected to the virtual interface; The three-layer switch distinguishes the terminal online data and the data requiring authentication through dividing VLAN, the IP address of the AP end is allocated by the AC end, and the IP address of the terminal is allocated by the three-layer switch; The AP end receives the message of authentication opening issued by the AC end, and opens the authentication; The AP end receives the authentication probe message sent by the terminal, and judges whether the current authentication probe message requires authentication, if not, the data of the terminal is released; If authentication is required, the authentication probe message is redirected to the virtual interface of the AC end for authentication; If the authentication is successful, the AP end receives the IP address of the terminal, and releases the data of the terminal; The AP end judges whether the current authentication probe message requires authentication, comprising: A hash table with IP address as index is created in the AP end, the source IP address carried by the authentication probe message is matched with the IP address in the hash table, if the matching is passed, authentication is required, otherwise, authentication is not required.

2. The AC+AP mode bypass authentication system of claim 1, wherein, The authentication module comprises a hash table with IP address as index.

3. A bypass authentication method of an AC+AP mode, characterized in that, The bypass authentication system applied to the AC+AP mode of claim 1; The bypass authentication method comprises: A first authentication mode is set in the AC end, and a second authentication mode is set in the AP end; If the first authentication mode is opened, the second authentication mode is run, and the first authentication mode is in an authentication preparation state; the authentication preparation state is that the AC end listens to the data of the AP end through the built-in virtual interface, and waits to receive the message sent by the AP end; The AP end receives the authentication probe message sent by the terminal, and performs the second authentication on the authentication probe message through the second authentication mode; The AC end receives the authentication probe message authenticated in the second authentication mode, and releases the authentication preparation state of the first authentication mode, and opens the first authentication; The bypass authentication process is completed after the first authentication is ended.

4. A bypass authentication method of an AC+AP mode, characterized in that, The bypass authentication system applied to the AC+AP mode, the system comprises an AC end, an AP end, a terminal, a three-layer switch and an export router, the AC end is connected to the three-layer switch through a LAN port, and the AP end is connected to the three-layer switch through an uplink port; the three-layer switch is also connected to the export router; The AC terminal has a separate virtual interface for internal use, and listens for authentication probe messages forwarded by the AP terminal through the virtual interface. The AC terminal also includes an authentication switch; the AP terminal is equipped with an authentication module, which is connected to the virtual interface. The Layer 3 switch distinguishes between terminal internet access data and data requiring authentication by dividing VLANs. The IP address of the AP is assigned by the AC, and the IP address of the terminal is assigned by the Layer 3 switch. The bypass authentication method includes: The AC side enables authentication and sends an authentication enabled message to the AP side, and listens for authentication probe messages redirected by the AP side through the virtual interface. The AC terminal determines whether the authentication probe message requires authentication. If no authentication is required, it directly returns the terminal's IP address to the AP terminal and instructs the AP terminal to allow the terminal's data to pass through. If authentication is required, it determines the type of authentication to be performed. The AC terminal sends an authentication page to the terminal according to the authentication type; The AC terminal determines whether the authentication is successful based on the information entered by the terminal on the authentication page. If the authentication is successful, the AC terminal records the terminal's IP address and sends the terminal's IP address to the AP terminal, while instructing the AP terminal to allow the terminal's data to pass through. The AC terminal determines whether the authentication probe message requires authentication, including: The AC terminal configures an address range for authentication. If the IP address of the authentication probe packet is within the configured address range, authentication is required; otherwise, authentication is not required.

5. The method of claim 4, wherein the AC+AP mode of bypass authentication is characterized by, The virtual interface has an IP address of 192.168.239.11 and binds different ports for HTTP and HTTPS to process data: HTTP is bound to port 2060 and HTTPS is bound to port 8443.

6. A bypass authentication method of an AC+AP mode, characterized in that, A bypass authentication system applied to the AC+AP mode as described in claim 1; The bypass authentication method includes: The AP receives the authentication enable message from the AC and enables authentication. The AP receives the authentication probe message sent by the terminal and determines whether the current authentication probe message requires authentication. If no authentication is required, the terminal's data is allowed to pass; if authentication is required, the authentication probe message is redirected to the virtual interface of the AC for authentication. If authentication is successful, the AP receives the terminal's IP address and allows the terminal's data to pass through.

7. The method of claim 6, wherein the AC+AP mode of bypass authentication is characterized by, The step of redirecting the authentication probe message to the virtual interface of the AC for authentication includes: The AP modifies the destination IP address and port number of the successfully matched authentication probe packet and sends the modified authentication probe packet to the AC: Change the HTTP data on port 80 to the destination IP 192.168.239.11 and the port number to 2060. Change the HTTPS data on port 443 to the destination IP 192.168.239.11 and the port number to 8443.

Images