PORTAL authentication method, device and storage medium applied to FTTR gateway

Abstract

The present application discloses a PORTAL authentication method, device and storage medium applied to FTTR gateway, which receives an access request from a terminal device; obtains the MAC address of the terminal device according to the source IP address in the access request; matches the corresponding access rights from a preset first correspondence, the first correspondence includes the correspondence between the MAC address and the access rights; matches the corresponding authentication method from a preset second correspondence according to the access rights, the second correspondence includes the correspondence between the access rights and the authentication method; sends an authentication request to the terminal device in an authentication manner; and opens the access rights corresponding to the MAC address to the terminal device in response to the authentication feedback of the terminal device. A differentiated access rights management mechanism is established, which can automatically open different network usage resources to different terminal devices, and further improve the intelligence of differentiated access rights management by presetting verification methods for different access rights.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a PORTAL authentication method, device and storage medium applied to an FTTR gateway. Background Art

[0002] Fiber to the Room (FTTR) is a new fiber broadband access technology that can transmit fiber signals to the user's room. The networking method is a main gateway connected to multiple sub-gateways to achieve high-quality Wi-Fi coverage throughout the house, further improving the user's experience of Gigabit optical networks. By the end of September 2023, there will be more than 8 million FTTR users.

[0003] In many application scenarios of FTTR, users usually need to be authenticated, and network resources are opened to users after authentication. The existing FTTR gateway authentication scheme adopts a unified authentication rule for multiple users, and the same network resource permissions are opened after authentication. The management is relatively rough, and the permission management and access control methods are relatively simple, resulting in a waste of network resources. Summary of the invention

[0004] The main purpose of this application is to provide a PORTAL authentication method, device and storage medium applied to FTTR gateway, aiming to solve the problems of rough user authentication management, relatively simple permission management and access control methods, and waste of network resources.

[0005] To achieve the above-mentioned purpose, in a first aspect, the present application provides a PORTAL authentication method applied to an FTTR gateway, comprising: receiving an access request from a terminal device, the access request including a source IP address of the terminal device; obtaining a MAC address of the terminal device according to the source IP address; matching a corresponding access right from a preset first correspondence relationship according to the MAC address, the first correspondence relationship including a correspondence relationship between a MAC address and the access right; matching a corresponding authentication method from a preset second correspondence relationship according to the access right, the second correspondence relationship including a correspondence relationship between the access right and the authentication method; sending an authentication request to the terminal device in an authentication manner, so that the terminal device generates an authentication feedback based on the authentication request; and opening the access right corresponding to the MAC address to the terminal device in response to the authentication feedback of the terminal device.

[0006] Optionally, according to the MAC address, the corresponding access rights are matched from a preset first correspondence, which also includes: determining whether the MAC address is recorded in the first correspondence; if so, using the MAC address as the MAC address corresponding to the access request; if not, searching for the directly connected device of the terminal device from the network topology map; using the MAC address of the directly connected device as the MAC address corresponding to the access request.

[0007] Optionally, the access permission includes at least one of DNS usage permission, traffic access permission, Internet behavior permission and Internet time permission.

[0008] Optionally, the authentication mode includes a verification code verification mode or a password verification mode.

[0009] Optionally, receiving an access request from a terminal device includes: receiving an access request forwarded by a sub-gateway; allocating a management IP address to the sub-gateway; establishing an interaction channel with the sub-gateway through the management IP address, and receiving a PORTAL service port configuration request from the sub-gateway; and sending configuration feedback to the sub-gateway in response to the PORTAL service port configuration request, so that the sub-gateway adds a target port to a PORTAL service bridge and removes a non-target port from the PORTAL service bridge according to the configuration feedback.

[0010] In a second aspect, the present application provides a PORTAL authentication device applied to an FTTR gateway, the device comprising: a receiving module for receiving an access request from a terminal device, the access request including a MAC address of the terminal device; a first matching module for matching a corresponding access right from a preset first correspondence relationship according to the MAC address, the first correspondence relationship including a correspondence relationship between the MAC address and the access right; a second matching module for matching a corresponding authentication method from a preset second correspondence relationship according to the access right, the second correspondence relationship including a correspondence relationship between the access right and the authentication method; a sending module for sending an authentication request to the terminal device in an authentication manner, so that the terminal device generates an authentication feedback based on the authentication request; and a permission opening module for opening the access right corresponding to the MAC address to the terminal device in response to the authentication feedback of the terminal device.

[0011] Optionally, the PORTAL authentication device also includes a determination module, which is used to determine whether the MAC address is recorded in the first correspondence relationship; if so, the MAC address is used as the MAC address corresponding to the access request; if not, the directly connected device of the terminal device is searched from the network topology map; and the MAC address of the directly connected device is used as the MAC address corresponding to the access request.

[0012] Optionally, the access permission includes at least one of DNS usage permission, traffic access permission, Internet behavior permission and Internet time permission.

[0013] Optionally, the authentication mode includes a verification code verification mode or a password verification mode.

[0014] Optionally, the receiving module can be used to receive access requests forwarded by the sub-gateway; assign a management IP address to the sub-gateway; establish an interactive channel with the sub-gateway through the management IP address, and receive a PORTAL service port configuration request from the sub-gateway; in response to the PORTAL service port configuration request, send configuration feedback to the sub-gateway, so that the sub-gateway adds the target port to the PORTAL service bridge and removes the non-target port from the PORTAL service bridge according to the configuration feedback.

[0015] In a third aspect, the present application provides an electronic device, comprising: a memory, a processor; the memory is used to store program instructions; the processor is used to call the program instructions to execute any PORTAL authentication method provided in the first aspect above.

[0016] In a fourth aspect, the present application provides a computer-readable storage medium, in which computer-executable instructions are stored. When the computer-executable instructions are executed by a processor, they are used to implement the PORTAL authentication method of any one of the items provided in the first aspect above.

[0017] In a fifth aspect, the present application provides a computer program product, including a computer program; when the computer program is executed, it implements any one of the PORTAL authentication methods provided in the first aspect above.

[0018] The beneficial effects that can be achieved by this application are as follows: by presetting the correspondence between MAC addresses, access rights and authentication methods, a differentiated terminal device access rights management mechanism is established, multiple authentication methods are provided to users, providing users with more choices, and grouping users who access through different authentication methods and verification passwords, which facilitates permission division, behavior management, etc., while improving the security level of access devices.

[0019] The embodiment of the present application proposes a PORTAL authentication method, device and storage medium applied to FTTR gateway, which receives an access request from a terminal device, wherein the access request includes the source IP address of the terminal device; obtains the MAC address of the terminal device according to the source IP address; matches the corresponding access rights from a preset first correspondence according to the MAC address, wherein the first correspondence includes the correspondence between the MAC address and the access rights; matches the corresponding authentication method from a preset second correspondence according to the access rights, wherein the second correspondence includes the correspondence between the access rights and the authentication method; sends an authentication request to the terminal device in an authentication manner, so that the terminal device generates authentication feedback based on the authentication request; and opens the access rights corresponding to the MAC address to the terminal device in response to the authentication feedback of the terminal device. A differentiated access rights management mechanism is established according to the MAC address, which can automatically open different network usage resources to different terminal devices. By presetting verification methods for different access rights, the intelligence level of differentiated access rights management is further improved, the utilization rate of network resources is effectively improved, and the network security level is improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Figure 1 Schematic diagram of application scenarios provided for the implementation of this application;

[0021] Figure 2 Schematic diagram of the process of the PORTAL authentication method applied to the FTTR gateway provided in the embodiment of the present application Figure 1 ;

[0022] Figure 3 A schematic diagram of a first corresponding relationship and a second corresponding relationship provided in an embodiment of the present application;

[0023] Figure 4 A schematic diagram of the interaction between the main gateway and the sub-gateway of the PORTAL authentication method applied to the FTTR gateway provided in the embodiment of the present application;

[0024] Figure 5 Schematic diagram of the process of the PORTAL authentication method applied to the FTTR gateway provided in the embodiment of the present application Figure 2 ;

[0025] Figure 6 A schematic diagram of a flow chart of a PORTAL authentication device applied to an FTTR gateway provided in an embodiment of the present application;

[0026] Figure 7 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application.

[0027] The realization of the purpose, functional features and advantages of this application will be further explained in conjunction with embodiments and with reference to the accompanying drawings.

[0028] Reference numerals:

[0029] 101-FTTR gateway, 102-terminal device, 103-network center, 301-first corresponding relationship, 302-second corresponding relationship, 600-PORTAL authentication device, 601-receiving module, 602-acquisition module, 603-first matching module, 604-second matching module, 605-sending module, 606-authorization opening module, 700-electronic device, 701-processor, 702-memory, 703-communication interface, 704-system bus. DETAILED DESCRIPTION

[0030] It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0031] The main solution of the embodiment of the present application is: by setting differentiated verification rules, different permissions are opened to different terminals, and the terminals are divided / grouped using MAC addresses. MAC addresses of different groups correspond to different access permissions, and different authentication methods are used for different access permissions, so as to achieve differentiated permission management of terminal devices.

[0032] There are a large number of FTTR access users. The existing technology grants equal permissions to successfully authenticated users without making any distinction. The authentication method is relatively simple, generally using a mobile phone to obtain a verification code. Once the verification is passed, the user can obtain the same network resource usage rights. Multiple authentication methods are not supported on the same device. This permission management method is relatively rough, and network resources cannot be used more efficiently, resulting in a loss of network resources and weakening network security.

[0033] The present application provides a solution that utilizes specific authentication rules to differentiate different terminal users, so that network resources can be opened to different terminal users on demand in a differentiated manner, achieve differentiated permission management of terminal devices, and improve network resource utilization and network access security level.

[0034] Figure 1 Schematic diagram of application scenarios provided for the implementation of this application. Figure 1 As shown, the application scenario includes an FTTR gateway 101 , a terminal device 102 and a network center 103 .

[0035] The FTTR gateway 101 is a network access device that can transmit optical fiber signals to the user's room, which is equivalent to the port of the terminal device 102 accessing the network center 103. The use of the FTTR gateway 101 can provide more stable and faster network services, and can also reduce network failures and maintenance costs, and is widely used in hotels and other places.

[0036] In this embodiment, the FTTR gateway 101 may include a main gateway and multiple sub-gateways, and the terminal device 102 accesses the main gateway through the sub-gateway, thereby accessing the network center 103. In some other embodiments, the terminal device 102 may also directly access the network center 103 through the main gateway. In an embodiment including multiple gateways, the PORTAL authentication method provided by the present invention may be applied to the main gateway, and the PORTAL authentication method provided by the present invention may also be applied to the sub-gateway.

[0037] The terminal device 102 refers to a hardware device that can interact with a server or a cloud platform, and examples thereof include mobile phones, tablets, laptops, local servers, smart TVs, smart refrigerators, and smart speakers, etc., which are not limited here. The network center 103 refers to a server, cloud platform, or computing center, etc. that can provide network resources to the terminal device 102. Generally, the network center 103 receives access requests from the terminal device 102 and opens various network resources to the terminal device 102.

[0038] The terminal device 102 belongs to the user side. When accessing the network center 103, its access request first reaches the FTTR gateway, which transmits the access request to the network center 103 and feeds back the feedback information to the terminal device 102 via the FTTR gateway.

[0039] In some application scenarios, a large number of terminal devices 102 want to access the network center 103 at the same time. If the same network resources are opened to these terminal devices 102 at the same time, channel congestion may occur, resulting in important tasks not being processed in time. This embodiment reasonably allocates network resources by differentially managing the access of terminal devices 102.

[0040] Figure 2 Schematic diagram of the process of the PORTAL authentication method applied to the FTTR gateway provided in the embodiment of the present application Figure 1 .like Figure 2 As shown, the method includes:

[0041] S201: Receive an access request from a terminal device, where the access request includes a source IP address of the terminal device.

[0042] Access requests are transmitted in the form of data packets, which generally include the destination address of the request, the request method, the header information, the main content of the request, and the source IP address. The destination address refers to the address of the server or website (network center) to be accessed, usually an IP address or a domain name. The request method refers to the protocol adopted by the terminal device to send the request, such as HTTP, HTTPS. The header information contains some meta-information about the request, such as the source of the request, the content type of the request, etc. The main content of the request refers to some data that the terminal device needs to send to the server. The source IP address indicates which device the access request comes from. These data are usually included in the request body.

[0043] S202: Obtain the MAC address of the terminal device according to the source IP address.

[0044] Each terminal device has a unique MAC address to identify the device. The terminal device sends an access request, the FTTR gateway receives the access request, and performs the following steps based on the MAC address of the access request.

[0045] S203: Match the corresponding access rights from a preset first correspondence according to the MAC address, where the first correspondence includes a correspondence between the MAC address and the access rights.

[0046] Access rights include but are not limited to the use rights of various network resources, such as access control, online behavior management, online time, etc. The first correspondence is preset, and can be preset according to user needs or historical experience. In some embodiments, the first correspondence can be adjusted and changed by the operator or the user through a preset data interface.

[0047] In the first correspondence, different MAC addresses may correspond to different access rights. For example, in an application scenario of an office building, different departments require different network resources, so the terminal devices can be divided according to departments. For example, the terminal devices in department one can use database resources from 9:00 to 12:00, while the terminal devices in department two are not allowed to use the database resources during this time period.

[0048] Optionally, the access rights include at least one of DNS usage rights, traffic access rights, Internet behavior rights, and Internet time rights. By setting different DNS usage rights, traffic access rights, Internet behavior rights, and Internet time rights for different MAC addresses, each terminal device can use network resources in a staggered manner, effectively avoiding the concentrated use and unreasonable allocation of network resources.

[0049] It should be noted that different MAC addresses may correspond to the same access rights. Figure 3 A schematic diagram of the first corresponding relationship and the second corresponding relationship provided in the embodiment of the present application is shown in FIG. Figure 3 As shown, MAC addresses are divided into different groups, and each group may include different numbers of MAC addresses. In the first correspondence 301, MAC addresses divided into the same group correspond to the same access rights, for example, MAC address 1, MAC address 2, and MAC address 3 all correspond to access right one, while MAC address 4, MAC address 5, and MAC address 6 all correspond to access right two, MAC address 7 and MAC address 8 all correspond to access right three, and so on.

[0050] S204: According to the access permission, a corresponding authentication method is matched from a preset second correspondence relationship, where the second correspondence relationship includes a correspondence relationship between the access permission and the authentication method.

[0051] The authentication mode refers to the method used by the terminal device for network authentication. Optionally, the authentication mode includes a verification code verification mode or a password verification mode. The verification code verification mode is that the gateway sends a specified verification code to the terminal device, and the user inputs the verification code into the terminal device and feeds the verification code back to the gateway. The gateway verifies the consistency of the verification code and grants permission to the terminal device that has passed the verification. The logic of the password verification mode is similar, but this mode does not require the gateway to send a verification code to the terminal device. For example, the password is informed in advance to users corresponding to different MAC addresses, and different users can obtain different access rights by entering different passwords.

[0052] Different authentication methods refer to different verification codes or passwords under the same verification mode. For example, Figure 3 As shown, in the second corresponding relationship 302, access right one corresponds to authentication password (ie, verification code or password) A, access right two corresponds to authentication password B, and access right three corresponds to authentication password C.

[0053] It should be understood that the PORTAL authentication method provided in the embodiment of the present application is not limited to the above two methods, and can also be an identity information verification mode, a digital certificate authentication or other multi-factor authentication, which is not limited here. In some embodiments, the mode of the authentication method is user-selectable, for example, options are provided to the user through the display interface of the terminal device.

[0054] S205: Send an authentication request to the terminal device in an authentication manner, so that the terminal device generates authentication feedback based on the authentication request.

[0055] In the above steps, the authentication method corresponding to the MAC address is determined, and the authentication request is sent to the terminal device according to the authentication method. The authentication request is used to present the authentication window to the user at the display position of the terminal device. The user enters the corresponding authentication password in the authentication window. The feedback information entered by the user and fed back to the FTTR gateway is the authentication feedback.

[0056] S206: In response to the authentication feedback from the terminal device, the access rights corresponding to the MAC address are opened to the terminal device.

[0057] The FTTR gateway confirms whether the authentication password contained in the authentication feedback is consistent. If it is consistent, the authentication is successful and the corresponding access rights are opened. If it is inconsistent, the authentication fails and a notification message of authentication failure can be fed back to the terminal device.

[0058] The embodiment of the present application receives an access request from a terminal device, the access request includes the source IP address of the terminal device; obtains the MAC address of the terminal device according to the source IP address; matches the corresponding access rights from a preset first correspondence according to the MAC address, the first correspondence includes the correspondence between the MAC address and the access rights; matches the corresponding authentication method from a preset second correspondence according to the access rights, the second correspondence includes the correspondence between the access rights and the authentication method; sends an authentication request to the terminal device in an authentication manner, so that the terminal device generates authentication feedback based on the authentication request; in response to the authentication feedback of the terminal device, opens the access rights corresponding to the MAC address to the terminal device. A differentiated access rights management mechanism is established according to the MAC address, which can automatically open different network usage resources to different terminal devices. By presetting verification methods for different access rights, the intelligence level of differentiated access rights management is further improved, the utilization rate of network resources is effectively improved, and the network security level is improved.

[0059] On the basis of the above embodiment, optionally, according to the MAC address, the corresponding access rights are matched from the preset first correspondence, which also includes: determining whether the MAC address is recorded in the first correspondence; if so, using the MAC address as the MAC address corresponding to the access request; if not, searching for the directly connected device of the terminal device from the network topology map; using the MAC address of the directly connected device as the MAC address corresponding to the access request. The embodiment of the present application adds a step of determining whether the MAC address exists in the first correspondence. In some embodiments, the preset first correspondence may be incomplete. For example, the MAC address of an unfamiliar visitor may not be added to the first correspondence when preset. In this case, the directly connected device of the terminal device is found from the network topology map according to the MAC address, and the access rights and authentication methods are determined according to the MAC address of the directly connected device, thereby improving compatibility with different terminal devices.

[0060] Optionally, receiving an access request from a terminal device includes: receiving an access request forwarded by a sub-gateway; allocating a management IP address to the sub-gateway; establishing an interaction channel with the sub-gateway through the management IP address, and receiving a PORTAL service port configuration request from the sub-gateway; and sending configuration feedback to the sub-gateway in response to the PORTAL service port configuration request, so that the sub-gateway adds a target port to a PORTAL service bridge and removes a non-target port from the PORTAL service bridge according to the configuration feedback.

[0061] The embodiment of the present application is applicable to application scenarios including a main gateway and a sub-gateway, and is intended to synchronize the PORTAL authentication function from the FTTR main gateway to the sub-gateway, and distribute the PORTAL authentication work of the FTTR main gateway to the sub-gateway, thereby improving the data processing speed.

[0062] Figure 4 The schematic diagram of the interaction between the main gateway and the sub-gateway of the PORTAL authentication method applied to the FTTR gateway provided in the embodiment of the present application shows the data flow of the interaction between the main FTTR gateway and the sub-gateway in the embodiment, where the portal is PORTAL. Figure 4 As shown, including:

[0063] The FTTR main gateway establishes a port corresponding to the Layer 2 portal service VLAN interface. On each network card (including the gateway), a Layer 2 VLAN interface of the configured PORTAL service VLAN is established, and the VLAN interface is added to the bridge where the PORTAL service is located;

[0064] The sub-gateway uplink port is Linkup, and its Layer 2 portal service VLAN interface is established. The sub-gateway establishes a PORTAL service bridge. When the sub-gateway is connected to the FTTR main gateway, a Layer 2 VLAN interface of the configured PORTAL service VLAN is established on the uplink port, and the VLAN interface is added to the bridge where the PORTAL service is located;

[0065] The sub-gateway sends an untag DHCP request to the main gateway. The DHCP request option 12 pre-adds an encrypted special field, such as fttrsub. The main gateway allocates an IP address (i.e., IP address) according to DHCP, that is, the sub-gateway obtains a management IP through the untag DHCP request;

[0066] The main gateway determines whether it is a sub-gateway through the option12 field, and if so, adds it to the sub-gateway management list. The main gateway determines whether the sub-gateway access is legal based on the encrypted special field, and if so, adds it to the main sub-gateway communication list whitelist (storing the MAC address);

[0067] The sub-gateway interacts with the main gateway through the management IP, requests the portal service VLAN, and the main gateway returns the portal service VLAN. The sub-gateway determines whether the portal service VLAN established previously is correct. If not, it recreates the corresponding VLAN. That is, if the current sub-gateway configuration is incorrect, it configures the correct VLAN.

[0068] The sub-gateway actively obtains portal service port information from the main gateway, and the main gateway returns the portal service port information. The sub-gateway determines whether the current portal service port information is consistent with the returned information. If it is inconsistent, the portal service port is adjusted. That is, if it is consistent with the current configuration, no processing is done. If it is inconsistent, the ports that need to be enabled are added to the portal service bridge, and the ports that do not need to be enabled are removed from the portal service bridge and added to the ordinary service bridge (or bound bridge).

[0069] Optionally, the list can be viewed and set on the main gateway (online or offline), and then the main gateway will pass these settings to the sub-gateway through the interactive interface when the sub-device is online. The sub-gateway returns the configuration results after completing the configuration.

[0070] In some embodiments, the first correspondence and the second correspondence can be pre-stored in a location accessible to the FTTR gateway through a list, such as a black and white list. In some implementations, DNS usage rights can be hijacked in the following manner: when a terminal device is accessed at an interface that requires authentication and is not in the authentication white list or fails authentication, the local address is returned. Traffic access rights can be controlled in the following manner: when a terminal device is accessed and the access device is not in the white list or the traffic destination address of the unauthenticated device is not in the white list, outward forwarding is prohibited, and the destination address and port conversion is performed for tcp80 and 443 ports whose traffic is not in the white list, and converted to the address and port monitored by the PORTAL module.

[0071] After the terminal device passes the verification, a prompt message indicating that the authentication is successful may also be returned to the terminal device. If the verification fails, a prompt message indicating that the authentication fails may be returned.

[0072] In some other embodiments, the first correspondence and the second correspondence can be preset according to the user's needs for network security. For example, a temporary trust list can be added, and the terminal devices in the temporary trust list can obtain all or part of the specified network access rights without the above-mentioned PORTAL authentication, etc.

[0073] The above-mentioned application embodiment establishes a differentiated terminal device access permission management mechanism by presetting the correspondence between MAC addresses, access permissions and authentication methods, provides users with multiple authentication methods, provides users with more choices, and groups users who access through different authentication methods and verification passwords, which facilitates permission division, behavior management, etc., while improving the security level of access devices.

[0074] Figure 5 Schematic diagram of the process of the PORTAL authentication method applied to the FTTR gateway provided in the embodiment of the present application Figure 2 , shows another specific implementation method, which groups terminal devices and establishes access permission rules after access. Figure 4 As shown in the figure, the FTTR gateway uses the portal module to implement the PORTAL authentication function. After the portal module is started and initialized, the device (i.e., the terminal device) receives non-whitelisted tcp80 and 443 port requests and redirects them to the portal module listening address and port. The user authenticates according to the preset mode: in the password mode (i.e., password verification mode), the portal module performs password verification. If it passes, the device is added to the corresponding group, and the corresponding rules (i.e., the correspondence between MAC address, access permission and authentication method) are established. The device is released and the authentication success page is returned. If it fails, the user authentication page is returned. In the SMS mode (i.e., verification code verification mode), the portal module forwards the mac (i.e., MAC address) and mobile phone number to the SMS platform. The user receives the SMS and enters the verification code to submit. The portal module submits the verification code and mac to the SMS platform for verification. If it passes, the device is released and the authentication success page is returned. If it fails, the user authentication page is returned.

[0075] The above embodiments have described in detail the PORTAL authentication method applied to the FTTR gateway provided by the present application. The following will specifically explain the PORTAL authentication device, electronic device, storage medium and program product applied to the FTTR gateway provided by the embodiments of the present application.

[0076] Figure 6 This is a flow chart of a PORTAL authentication device applied to a FTTR gateway provided in an embodiment of the present application. Figure 6 As shown, the PORTAL authentication device 600 includes:

[0077] The receiving module 601 is used to receive an access request from a terminal device, where the access request includes a source IP address of the terminal device;

[0078] The acquisition module 602 is used to acquire the MAC address of the terminal device according to the source IP address;

[0079] A first matching module 603, configured to match a corresponding access right from a preset first correspondence according to the MAC address, where the first correspondence includes a correspondence between the MAC address and the access right;

[0080] A second matching module 604, used to match a corresponding authentication method from a preset second correspondence according to the access rights, where the second correspondence includes a correspondence between the access rights and the authentication methods;

[0081] The sending module 605 is used to send an authentication request to the terminal device in an authentication manner, so that the terminal device generates an authentication feedback based on the authentication request;

[0082] The permission opening module 606 is used to open the access rights corresponding to the MAC address to the terminal device in response to the authentication feedback of the terminal device.

[0083] Optionally, the PORTAL authentication device 600 also includes a determination module, which is used to determine whether the MAC address is recorded in the first correspondence relationship; if so, the MAC address is used as the MAC address corresponding to the access request; if not, the directly connected device of the terminal device is searched from the network topology map; the MAC address of the directly connected device is used as the MAC address corresponding to the access request.

[0084] Optionally, the access permission includes at least one of DNS usage permission, traffic access permission, Internet behavior permission and Internet time permission.

[0085] Optionally, the authentication mode includes a verification code verification mode or a password verification mode.

[0086] Optionally, the receiving module 601 can be used to receive an access request forwarded by a sub-gateway; assign a management IP address to the sub-gateway; establish an interactive channel with the sub-gateway through the management IP address, and receive a PORTAL service port configuration request from the sub-gateway; in response to the PORTAL service port configuration request, send configuration feedback to the sub-gateway, so that the sub-gateway adds the target port to the PORTAL service bridge and removes the non-target port from the PORTAL service bridge according to the configuration feedback.

[0087] The device provided in the embodiment of the present application can be used to execute the above-mentioned PORTAL authentication method applied to the FTTR gateway. Its implementation method and technical effect are similar and will not be repeated here.

[0088] Figure 7 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. Figure 7 As shown, the electronic device 700 includes:

[0089] Processor 701 , memory 702 , communication interface 703 and system bus 704 .

[0090] Among them, the memory 702 and the communication interface 703 are connected to the processor 701 through the system bus 704 and complete communication with each other. The memory 702 is used to store computer execution instructions, the communication interface 703 is used to communicate with other devices, and the processor 701 is used to execute computer execution instructions to execute the PORTAL authentication method applied to the FTTR gateway as in the above-mentioned method embodiment.

[0091] Specifically, the processor 701 may include one or more processing units, for example, the processor 701 may be a CPU, or a digital signal processing (DSP), an application specific integrated circuit (ASIC), etc. A general processor may be a microprocessor or the processor may be any conventional processor, etc. The steps of the method disclosed in the application may be directly embodied as being executed by a hardware processor, or may be executed by a combination of hardware and software modules in the processor.

[0092] The memory 702 can be used to store program instructions. The memory 702 may include a program storage area and a data storage area. Among them, the program storage area may store an operating system, an application required for at least one function (such as a sound playback function, etc.), etc. The data storage area may store data created during the use of the electronic device 700 (such as audio data, etc.), etc. In addition, the memory 702 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, a universal flash storage (Universal Flash Storage, referred to as UFS), etc. The processor 701 executes various functional applications and data processing of the electronic device 700 by running the program instructions stored in the memory 702.

[0093] The communication interface 703 can provide solutions for wireless communications including 2G / 3G / 4G / 17G applied to the electronic device 700. The communication interface 703 can receive electromagnetic waves through the antenna, filter, amplify and other processes the received electromagnetic waves, and transmit them to the modulation and demodulation processor for demodulation. The communication interface 703 can also amplify the signal modulated by the modulation and demodulation processor, and convert it into electromagnetic waves for radiation through the antenna. In some embodiments, at least some functional modules of the communication interface 703 can be set in the processor 701. In some embodiments, at least some functional modules of the communication interface 703 can be set in the same device as at least some modules of the processor 701.

[0094] The system bus 704 may be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The system bus 704 may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus.

[0095] It should be noted that the number of the memory 702 and the processor 701 is not limited in the embodiment of the present application, and they can be one or more. Figure 7 Take one as an example for illustration; the memory 702 and the processor 701 can be connected by wire or wirelessly in various ways, such as through a bus connection. In practical applications, the electronic device 700 can be various forms of computers or mobile terminals. Among them, the computer is, for example, a laptop computer, a desktop computer, a workbench, a server, a blade server, a mainframe computer, etc.; the mobile terminal is, for example, a personal digital assistant, a cellular phone, a smart phone, a wearable device, and other similar computing devices.

[0096] The electronic device of this embodiment can be used to execute the technical solution in the above method embodiment. Its implementation principle and technical effect are similar and will not be described in detail here.

[0097] The embodiment of the present application also provides a computer-readable storage medium, in which computer-executable instructions are stored. When the computer-executable instructions are executed by a processor, they are used to implement the solution of the PORTAL authentication method applied to the FTTR gateway in the above method embodiment.

[0098] The embodiment of the present application also provides a computer program product, including a computer program; when the computer program is executed, the solution of the PORTAL authentication method applied to the FTTR gateway in the above method embodiment is implemented.

[0099] The above are only preferred embodiments of the present application, and are not intended to limit the patent scope of the present application. Any equivalent structure or equivalent process transformation made using the contents of the present application specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present application.

Claims

1. A PORTAL authentication method applied to an FTTR gateway, characterized in that: include: Receiving an access request from a terminal device, wherein the access request includes a source IP address of the terminal device; Obtaining the MAC address of the terminal device according to the source IP address; According to the MAC address, matching a corresponding access right from a preset first correspondence relationship, wherein the first correspondence relationship includes a correspondence relationship between the MAC address and the access right; According to the access right, a corresponding authentication method is matched from a preset second correspondence, wherein the second correspondence includes a correspondence between the access right and the authentication method; the mode of the authentication method includes a verification code verification mode or a password verification mode; different authentication methods refer to different verification codes or passwords corresponding to the same verification mode; Sending an authentication request to the terminal device in the authentication mode, so that the terminal device generates authentication feedback based on the authentication request; In response to authentication feedback from the terminal device, opening access rights corresponding to the MAC address to the terminal device; According to the MAC address, matching the corresponding access rights from a preset first correspondence relationship also includes: Determine whether the MAC address is recorded in the first corresponding relationship; If yes, use the MAC address as the MAC address corresponding to the access request; If not, searching the network topology for the directly connected device of the terminal device; Using the MAC address of the directly connected device as the MAC address corresponding to the access request; The receiving an access request from a terminal device comprises: receiving the access request forwarded by the sub-gateway; Allocating a management IP address to the sub-gateway; Establish an interactive channel with the sub-gateway through the management IP address, and receive a PORTAL service port configuration request from the sub-gateway; In response to the PORTAL service port configuration request, configuration feedback is sent to the sub-gateway, so that the sub-gateway adds the target port to the PORTAL service bridge and removes the non-target port from the PORTAL service bridge according to the configuration feedback.

2. The PORTAL authentication method according to claim 1, characterized in that: The access rights include at least one of DNS usage rights, traffic access rights, Internet behavior rights, and Internet time rights.

3. A PORTAL authentication device applied to an FTTR gateway, characterized in that: The device comprises: A receiving module, configured to receive an access request from a terminal device, wherein the access request includes a source IP address of the terminal device; An acquisition module, used to acquire the MAC address of the terminal device according to the source IP address; A first matching module, configured to match a corresponding access right from a preset first correspondence according to the MAC address, wherein the first correspondence includes a correspondence between the MAC address and the access right; A second matching module is used to match a corresponding authentication method from a preset second correspondence according to the access right, wherein the second correspondence includes a correspondence between the access right and the authentication method; the mode of the authentication method includes a verification code verification mode or a password verification mode; different authentication methods refer to different verification codes or passwords corresponding to the same verification mode; A sending module, configured to send an authentication request to the terminal device in the authentication mode, so that the terminal device generates an authentication feedback based on the authentication request; A permission opening module, configured to open access rights corresponding to the MAC address to the terminal device in response to authentication feedback from the terminal device; A determination module, configured to: determine whether the MAC address is recorded in a preset first correspondence before matching the corresponding access authority from the first correspondence according to the MAC address; if so, use the MAC address as the MAC address corresponding to the access request; if not, search for a directly connected device of the terminal device from a network topology diagram; use the MAC address of the directly connected device as the MAC address corresponding to the access request; The receiving an access request from a terminal device comprises: receiving the access request forwarded by the sub-gateway; Allocating a management IP address to the sub-gateway; Establish an interactive channel with the sub-gateway through the management IP address, and receive a PORTAL service port configuration request from the sub-gateway; In response to the PORTAL service port configuration request, configuration feedback is sent to the sub-gateway, so that the sub-gateway adds the target port to the PORTAL service bridge and removes the non-target port from the PORTAL service bridge according to the configuration feedback.

4. An electronic device, characterized in that: include: Memory, processor; The memory is used to store program instructions; The processor is used to call the program instructions to execute the PORTAL authentication method as described in claim 1 or 2.

5. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, which are used to implement the PORTAL authentication method according to claim 1 or 2 when executed by a processor.

6. A computer program product, characterized in that including computer programs; When the computer program is executed, the PORTAL authentication method as claimed in claim 1 or 2 is implemented.

Images