Access method and apparatus

Abstract

The present specification provides an access method and device, the method comprising: after a client completes a pre-domain authentication, if a terminal where the client is located supports a first authentication mode but does not initiate the first authentication, sending a login trigger instruction to the client, so that the client outputs login prompt information corresponding to the first authentication mode according to the login trigger instruction. If a first authentication request corresponding to the first authentication mode sent by the client based on the login prompt information is received, starting the first authentication mode to perform the first authentication on the client. If the client passes the first authentication, sending a first authentication response to the client, so that the client enters a post-domain.

Description

TECHNICAL FIELD

[0001] The present specification relates to the technical field of communication, and particularly relates to an access method and device. BACKGROUND

[0002] BRAS (Broadband Remote Access Server) level 802.1x authentication is a technology of providing 802.1x (Access Control and Authentication Protocol) access authentication on a BRAS device. It takes 802.1x as an authentication mode of IPoE (IP over Ethernet, Internet Protocol over Ethernet). 802.1x and IPoE can cooperate on the BRAS to realize the access of a client. Among them, 802.1x can be used for authentication and authorization, and IPoE can be used for charging.

[0003] However, in actual use, some clients do not support actively performing 802.1x authentication, so that the user cannot access the network through the 802.1x authentication mode. SUMMARY

[0004] To overcome the problems in the related art, the present specification provides a method and device.

[0005] According to a first aspect of an embodiment of the present specification, a method is provided, the method comprising: after a client completes a pre-domain authentication, if a terminal where the client is located supports a first authentication mode but does not initiate the first authentication, sending a login trigger instruction to the client, so that the client outputs login prompt information corresponding to the first authentication mode according to the login trigger instruction; if a first authentication request corresponding to the first authentication mode sent by the client based on the login prompt information is received, starting the first authentication mode to perform first authentication on the client; if the client passes the first authentication, sending a first authentication response to the client, so that the client enters a post-domain.

[0006] According to a second aspect of an embodiment of the present specification, a device is provided, comprising: a login prompt module, configured to, after a client completes a pre-domain authentication, if a terminal where the client is located supports a first authentication mode but does not initiate the first authentication, send a login trigger instruction to the client, so that the client outputs login prompt information corresponding to the first authentication mode according to the login trigger instruction; a first authentication module, configured to, if a first authentication request corresponding to the first authentication mode sent by the client based on the login prompt information is received, start the first authentication mode to perform first authentication on the client; a first access module, configured to, if the client passes the first authentication, send a first authentication response to the client, so that the client enters a post-domain.

[0007] According to a third aspect of the embodiments of the present specification, the present application provides a network device, comprising a processor and a machine readable storage medium, the machine readable storage medium stores machine executable instructions capable of being executed by the processor, and the processor is prompted to execute the method provided by the first aspect of the present application by the machine executable instructions.

[0008] The technical solutions provided by the embodiments of the present specification can include the following beneficial effects:

[0009] In the embodiments of the present specification, if the terminal where the client is located does not support actively performing the first authentication, a login trigger indication is sent to the client, so that the client outputs login prompt information corresponding to the first authentication mode according to the login trigger indication. Thereby, the terminal can access the network through the first authentication mode, and the terminal which does not support actively performing the first authentication is compatible.

[0010] It should be understood that the above general description and the following detailed description are only exemplary and explanatory, and cannot limit the present specification. BRIEF DESCRIPTION OF DRAWINGS

[0011] The accompanying drawings, which are incorporated into the specification and constitute a part of the specification, illustrate embodiments consistent with the present specification and, together with the specification, serve to explain the principles of the present specification.

[0012] Figure 1 is a schematic diagram of a system architecture according to an exemplary embodiment of the present specification.

[0013] Figure 2 is a flowchart of an access method according to an exemplary embodiment of the present specification.

[0014] Figure 3 is a block diagram of an access device according to an exemplary embodiment of the present specification.

[0015] Figure 4 is a schematic diagram of a network device according to an exemplary embodiment of the present specification 。 DETAILED DESCRIPTION

[0016] The exemplary embodiments will be described in detail hereinafter with reference to the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present specification. Instead, they are merely examples of apparatuses and methods consistent with some aspects of the present specification as detailed in the appended claims.

[0017] The terminology used in this specification is for the purpose of describing particular embodiments only and is not intended to be limiting. As used in this specification, the singular forms "a," "an" and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise. It will be further understood that the terms "comprises" and / or "comprising," when used in this specification, specify the presence of stated features, integers, steps, operations, elements, and / or components, but do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and / or groups thereof.

[0018] It should be understood that, although the terms first, second, third, etc. can be used herein to describe various information, these terms are not intended to denote a particular order or hierarchy. These terms are used only to distinguish one from another. For example, a first information can be termed a second information, and, similarly, a second information can be termed a first information, without departing from the scope of the present specification. As used herein, the term "if' can be interpreted to mean "when" or "responsive to the determination" or "in response to the determination" depending on the context.

[0019] The following description is provided in relation to the accompanying drawings. Figure 1 A system architecture to which the access method and device of the embodiments of the present specification can be applied is described. It should be noted that the following is merely an example of the system architecture, and the access method and device of the embodiments of the present specification can also be used in other system architectures.

[0020] Figure 1 is a schematic diagram of a system architecture according to an exemplary embodiment of the present specification.

[0021] As shown in Figure 1 , the system architecture can include a client 110, a device end 120, and an authentication server 130.

[0022] According to the embodiments of the present specification, the client 110 can be a user terminal requesting access to a target network, and can be authenticated by the device end 120. The client 110 can have a client software supporting 802. IX authentication installed therein.

[0023] According to the embodiments of the present specification, the device end 120 can be used to control a network device to which the client 110 accesses, for example, can be a BRAS (Broadband Remote Access Server). The device end 120 is located between the client 110 and the authentication server 130, can provide a port (physical port or logical port) for the client 110 to access a target network, and can authenticate the connected client 110 through interaction with the authentication server 130.

[0024] According to an embodiment of the present specification, the authentication server 130 can be used for authenticating, authorizing and charging the client 110, for example, can be a RADIUS (Remote Authentication Dial-In User Service) server. The authentication server 130 can verify the legitimacy of the client 110 according to the client authentication information sent by the device end 120, and notify the device end 120 of the verification result, so that the device end 120 decides whether to allow the client 110 to access. According to another embodiment of the present specification, the role of the authentication server 130 can also be replaced by the device end 120, that is, the device end 120 performs local authentication, authorization and charging on the client 110.

[0025] Next, the access method of the embodiment of the present specification will be described in detail. This method can be applied to the device end shown above, for example.

[0026] As shown in Figure 2 , Figure 2 is a flowchart of a method according to an exemplary embodiment of the present specification, comprising the following steps:

[0027] In step 210, after the client completes the pre-domain authentication, if the terminal where the client is located supports the first authentication mode but does not initiate the first authentication, a login trigger indication is sent to the client, so that the client outputs login prompt information corresponding to the first authentication mode according to the login trigger indication.

[0028] According to an embodiment of the present specification, the client can request the device end to access the target network, wherein the target network can be a wide area network, a local area network or a metropolitan area network, or any combination of a wide area network, a local area network and a metropolitan area network. When the client accesses, the device end can first perform pre-domain authentication on the client. After the pre-domain authentication is passed, the client enters the pre-domain. Then, the client can send an authentication request to the device end. The device end can perform access authentication on the client according to the authentication request. After the client passes the access authentication, the client enters the post-domain. The pre-domain can be a domain that the client can access before access authentication. The post-domain can be a domain that the client can access after passing the access authentication.

[0029] According to an embodiment of the present specification, the first authentication can be access authentication, which can include 802.1x authentication, for example. It can be understood that in addition to 802.1x authentication, the first authentication can also include other authentication modes.

[0030] According to an embodiment of the present specification, after the client receives the login trigger indication, the client can output login prompt information corresponding to the first authentication mode according to the login trigger indication. The login prompt information can be used to prompt the user to perform access authentication using the first authentication mode.

[0031] Exemplarily, the login prompt information may, for example, include a login page.

[0032] At step 220, if the first authentication request corresponding to the first authentication mode sent by the client based on the login prompt information is received, the first authentication mode is started to perform the first authentication on the client.

[0033] According to the embodiments of the present specification, the client can select the first authentication mode to be adopted to perform the access authentication. Based on this, the client can send the first authentication request for requesting to perform the access authentication by the first authentication mode. The device end can start the first authentication mode to perform the first authentication on the client according to the first authentication request. Exemplarily, the first authentication request may, for example, include information such as a username and a password. Based on this, the client may, for example, be authenticated by the first authentication mode according to the username and the password.

[0034] According to the embodiments of the present specification, the first authentication on the client can be performed by the device end to obtain the authentication result. Alternatively, the first authentication on the client can also be performed by other devices other than the device end, and then the authentication result of the first authentication is sent to the device end. The other devices may, for example, include the authentication server shown above.

[0035] At step 230, if the client passes the first authentication, the first authentication response is sent to the client to make the client enter the post-domain.

[0036] According to the embodiments of the present specification, the first authentication response may, for example, be a response to the first authentication request, and can be used to inform the client that the first authentication has passed and the client can enter the post-domain and access the target network. Exemplarily, the first authentication response may, for example, include a notification message indicating that the 802.1x authentication is successful.

[0037] According to the access method of the embodiments of the present specification, if the terminal where the client is located does not support the first authentication, the login trigger indication is sent to the client to make the client output the login prompt information corresponding to the first authentication mode according to the login trigger indication. In this way, the terminal can access the network by the first authentication mode, and the terminal which does not support the first authentication can also access the target network by the first authentication mode.

[0038] Although the trigger indication can be sent to all terminals by timing to trigger the terminals to perform the first authentication. However, this method sends the trigger indication to all terminals, and the terminals which do not intend to perform the first authentication will also receive the trigger indication by timing, which is less targeted and has poor user experience. According to the access method of the embodiment of the present specification, the login trigger indication is sent to the client after the client enters the pre-domain, which can trigger the client to output the login prompt information when the user really needs to access the network, thereby improving the user experience.

[0039] Optionally, the device end can also receive the network access request sent by the client after the client completes the pre-domain authentication, and the network access request includes browser information and / or operating system information. The network access request can be used to request access to resources in the target network. The network access request may, for example, include an HTTP (Hyper Text Transfer Protocol) message. The device end can also parse the User-Agent field in the network access request to obtain the browser information and / or operating system information after receiving the network access request sent by the client. According to the browser information and / or operating system information, the terminal type of the terminal to which the client belongs is determined. If the terminal type is the target type, it is determined that the client supports the first authentication mode and does not support actively performing the first authentication. Illustratively, the terminal type which supports the first authentication mode and does not support active can be determined as the target type in advance.

[0040] For example, the Apple terminal also needs to receive the EAP (Extensible Authentication Protocol) request sent by the device end to pop up the login page for 802.1x authentication when performing 802.1x authentication, and the user can input the account and password for authentication through the login page. In actual application, the EAP request may be lost due to network problems or the user cancels the login page due to user error, which causes the user to be unable to authenticate online through the 802.1x mode. Therefore, if the device end determines that the terminal type of the terminal is an Apple terminal, it can actively send an EAP-Request (EAP request) of the Identity type to the client as a login trigger indication. After receiving the EAP-Request, the client will pop up a login page for 802.1x authentication, and the user can choose whether to perform 802.1x authentication through the login page.

[0041] Optionally, the client can also not select the first authentication mode, but select the second authentication mode. Illustratively, the second authentication mode may, for example, include a Web authentication mode. It can be understood that in addition to the Web authentication mode, the second authentication mode can also include other authentication modes.

[0042] Based on this, the client can send a second authentication request corresponding to the second authentication mode to the device end. If the device end receives the second authentication request corresponding to the second authentication mode sent by the client, the device end can start the second authentication mode to perform the second authentication on the client according to the second authentication request. If the client passes the second authentication, the client enters the post-domain. For example, the second authentication request can include information such as a username and a password. Based on this, the client can be authenticated according to the username and the password.

[0043] Optionally, after the client passes the second authentication, a second authentication response can also be sent to the client. The second authentication response can be a response to the second authentication request, and can be used to inform the client that it has entered the post-domain and can access the target network after passing the second authentication. For example, the second authentication response can include a login success page. After receiving the login success page, the client can display the login success page to the user, thereby informing the user that the target network has been accessed. According to the embodiments of the present specification, the device end can perform the second authentication on the client to obtain an authentication result. Alternatively, another device other than the device end can perform the second authentication on the client, and then send the authentication result of the second authentication to the device end. The other device can include the authentication server shown above.

[0044] Optionally, after the client passes the second authentication, the device end can record the authentication information of the client. The device end can authorize the client to access the post-domain according to the authentication information. Correspondingly, the device end can delete the authentication information of the client, thereby closing the permission of the client to enter the post-domain. Based on this, after the client enters the post-domain by passing the second authentication, if the device end receives the first authentication request sent by the client, the device end can delete the authentication information corresponding to the second authentication of the client. Then, the device end can perform the first authentication on the client. In this way, the client can access the target network by the first authentication mode.

[0045] Optionally, the authentication service can perform the second authentication on the client. Based on this, the device end can send an authentication notification to the authentication server. The authentication server performs the second authentication on the client according to the authentication notification, obtains authentication information, and then returns the authentication information of the client to the device end. In addition, if the device end receives the first authentication request sent by the client after the client enters the post-domain by passing the second authentication, the device end can also send an offline notification to the authentication server to make the authentication server delete the authentication information of the client.

[0046] Optionally, the login prompt information can also be repeatedly sent to the client at a predetermined interval, for example, without receiving the first authentication request. Thus, the client can be prevented from not logging in due to EAP message packet loss or other reasons. The number of repeated sending of the login prompt information and the sending interval can be set according to actual needs. For example, the number of repeated sending can be 2 times, and the interval can be 30s.

[0047] Corresponding to the embodiments of the foregoing method, the specification also provides embodiments of an apparatus and a terminal to which the apparatus is applied.

[0048] As shown in Figure 3 , Figure 3 is a block diagram of an apparatus according to an exemplary embodiment of the specification, and the apparatus includes:

[0049] The login prompt module 310 is configured to, after the client completes the pre-domain authentication, if the terminal where the client is located supports the first authentication mode but does not initiate the first authentication, send a login trigger instruction to the client, so that the client outputs login prompt information corresponding to the first authentication mode according to the login trigger instruction.

[0050] The first authentication module 320 is configured to, if the first authentication request corresponding to the first authentication mode sent by the client based on the login prompt information is received, start the first authentication mode to perform the first authentication on the client.

[0051] The first access module 330 is configured to, if the client passes the first authentication, send a first authentication response to the client, so that the client enters the post-domain.

[0052] Optionally, the apparatus can also include an access message receiving module, a type determining module, and an authentication determining module. The access message receiving module can be configured to, after the client completes the pre-domain authentication, receive a network access request sent by the client, and the network access request includes browser information and / or operating system information. The type determining module can be configured to determine the terminal type of the terminal to which the client belongs according to the browser information and / or the operating system information. The authentication determining module can be configured to, if the terminal type is the target type, determine that the client supports the first authentication mode and does not support actively performing the first authentication.

[0053] Optionally, the apparatus can also include a second authentication module and a second access module. The second authentication module can be configured to, if the second authentication request corresponding to the second authentication mode sent by the client is received, start the second authentication mode to perform the second authentication on the client according to the second authentication request. The second access module can be configured to, if the client passes the second authentication, send a second authentication response to the client, so that the client enters the post-domain.

[0054] Optionally, the device may further include an offline module and a third authentication module. The offline module, after the client has passed the second authentication, can delete the authentication information corresponding to the client's second authentication if a first authentication request is received from the client. The third authentication module can be used to initiate the first authentication method to perform the first authentication on the client.

[0055] Optionally, the device may also include a retransmission module for repeatedly sending login prompts to the client at predetermined intervals if the first authentication request is not received.

[0056] According to the access device of the embodiments of this specification, if the client terminal does not support active first authentication, a login trigger instruction is sent to the client, causing the client to output login prompt information corresponding to the first authentication method based on the login trigger instruction. This allows the terminal to access the network via the first authentication method and is compatible with terminals that do not support active first authentication accessing the target network via the first authentication method. Furthermore, by sending the login trigger instruction to the client only after the client enters the front domain and receives the network access request sent by the client, the client can be triggered to output login prompt information when the user actually needs to access the network, thereby improving the user experience.

[0057] Based on the same inventive concept, embodiments of this application also provide a network device, such as... Figure 4 As shown, the system includes a processor 410, a transceiver 420, and a machine-readable storage medium 430. The machine-readable storage medium 430 stores machine-executable instructions that can be executed by the processor 410. The processor 410 is prompted by the machine-executable instructions to execute the access method provided in the embodiments of this application. (The foregoing...) Figure 3 The access device shown can be adopted as follows: Figure 4 The hardware structure of the network device shown is implemented.

[0058] The aforementioned computer-readable storage medium 430 may include random access memory (RAM) or non-volatile memory (NVM), such as at least one disk storage device. Optionally, the computer-readable storage medium 430 may also be at least one storage device located remotely from the aforementioned processor 610.

[0059] The processor 410 can be a general processor, including a central processing unit (CPU), a network processor (NP), etc.; or can be a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component.

[0060] In the embodiments of the present application, the processor 410 is enabled to implement the access method described above by reading the machine-executable instructions stored in the machine-readable storage medium 430 and by the machine-executable instructions.

[0061] In addition, the embodiments of the present application provide a machine-readable storage medium 430, which stores machine-executable instructions, and when the machine-executable instructions are invoked and executed by the processor 410, the processor 410 is enabled to implement the access method described above by itself and by invoking the transceiver 420.

[0062] The implementation process of the functions and roles of the modules in the above apparatus will be specifically described in the implementation process of the corresponding steps in the above method, and will not be described here.

[0063] For the device embodiments, since they basically correspond to the method embodiments, the related parts can be referred to the part of the method embodiments. The device embodiments described above are only illustrative, and the modules described as separate components can be or can not be physically separated, and the components displayed as modules can be or can not be physical modules, i.e., they can be located in one place or distributed on multiple network modules. According to actual needs, some or all of the modules can be selected to achieve the purpose of the present application. Those skilled in the art can understand and implement it without creative labor.

[0064] The above described embodiments of the present description have been described. Other embodiments are within the scope of the following claims. In some cases, the actions or steps recited in the claims can be performed in a different order and still accomplish the desired result. In addition, the processes depicted in the accompanying figures do not necessarily require the particular order shown, or sequential order, to achieve the desired results. In certain implementations, multitasking and parallel processing can be advantageous or necessary.

[0065] Other embodiments of the present description will be apparent to those skilled in the art from consideration of the specification and practice of the application disclosed herein. The specification and examples given are intended as illustrative only and not in limitation of the true scope and spirit of the present description. The true scope and spirit of the present description are indicated by the following claims.

[0066] It should be understood that the present description is not limited to the precise structures as herein described and illustrated in the drawings, and that various modifications and changes can be made by those skilled in the art without departing from the scope of the present description. The scope of the description is limited only by the claims that follow.

[0067] The above descriptions are only the preferred embodiments of the present description and are not intended to limit the present description. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present description shall be included in the scope of protection of the present description.

Claims

1. An access method, characterized in that, The method includes: After the client completes the pre-domain authentication, if the terminal where the client is located supports the first authentication method but does not support actively initiating the first authentication, a login trigger instruction is sent to the client so that the client outputs login prompt information corresponding to the first authentication method according to the login trigger instruction. The pre-domain is the domain accessed by the client before access authentication. If a first authentication request corresponding to the first authentication method is received from the client based on the login prompt information, then the first authentication method is activated to perform first authentication on the client; If the client passes the first authentication, a first authentication response is sent to the client so that the client can enter the back domain, which is the domain accessed by the client after passing access authentication.

2. The method according to claim 1, characterized in that, The method further includes: After the client completes the pre-domain authentication, the system receives a network access request sent by the client, which includes browser information and / or operating system information. Based on the browser information and / or the operating system information, determine the terminal type of the terminal to which the client belongs; If the terminal type is the target type, then it is determined that the client supports the first authentication method but does not support actively performing the first authentication.

3. The method according to claim 1, characterized in that, The method further includes: If a second authentication request corresponding to the second authentication method is received from the client, then the second authentication method is initiated to perform second authentication on the client according to the second authentication request; If the client passes the second authentication, a second authentication response is sent to the client to allow the client to enter the back domain.

4. The method according to claim 3, characterized in that, The method further includes: After the client passes the second authentication, if a first authentication request is received from the client, the authentication information corresponding to the client during the second authentication is deleted. The first authentication method is initiated to perform the first authentication on the client.

5. The method according to claim 1, characterized in that, The method further includes: If the first authentication request is not received, the login prompt message is repeatedly sent to the client at predetermined intervals.

6. An access device, characterized in that, The device includes: The login prompt module is used to send a login trigger instruction to the client after the client completes the pre-domain authentication. If the terminal where the client is located supports the first authentication method but does not support actively initiating the first authentication, the client will output login prompt information corresponding to the first authentication method according to the login trigger instruction. The pre-domain is the domain accessed by the client before access authentication. The first authentication module is configured to, if it receives a first authentication request from the client based on the login prompt information and corresponding to the first authentication method, initiate the first authentication method to perform first authentication on the client; The first access module is configured to send a first authentication response to the client if the client passes the first authentication, so that the client enters the back domain, the back domain being the domain accessed by the client after passing the access authentication.

7. The apparatus according to claim 6, characterized in that, The device further includes: The access message receiving module is used to receive network access requests sent by the client after the client completes pre-domain authentication. The network access requests include browser information and / or operating system information. The type determination module is used to determine the terminal type of the client based on the browser information and / or the operating system information. The authentication determination module is used to determine, if the terminal type is the target type, that the client supports the first authentication method but does not support actively performing the first authentication.

8. The apparatus according to claim 6, characterized in that, The device further includes: The second authentication module is used to, if it receives a second authentication request from the client corresponding to the second authentication method, initiate the second authentication method to perform second authentication on the client according to the second authentication request; The second access module is used to send a second authentication response to the client if the client passes the second authentication, so that the client can enter the back domain.

9. The apparatus according to claim 8, characterized in that, The device further includes: The offline module is used to delete the authentication information corresponding to the client when performing the second authentication if it receives a first authentication request sent by the client after the client has passed the second authentication. The third authentication module is used to initiate the first authentication method to perform the first authentication on the client.

10. The apparatus according to claim 6, characterized in that, The device further includes: The resend module is used to repeatedly send the login prompt information to the client at predetermined intervals if the first authentication request is not received.

Images