Network access method, electronic equipment and storage medium

Abstract

The invention relates to a network access method, electronic equipment and a storage medium, the network access method comprises the following steps: receiving an authentication request of a user terminal, the authentication request carrying target authentication information of the user terminal; authenticating the user terminal based on preset configuration information and the target authentication information; and controlling the user terminal to access the network through a virtual private network (VPN) tunnel under the condition of confirming that the authentication of the user terminal is passed. According to the application, the user terminal is authenticated based on the preset configuration information and the target authentication information carried by the authentication request of the user terminal, and the user terminal is controlled to access the network through the VPN tunnel under the condition of confirming that the user terminal passes the authentication. According to the method and the device, the function of automatically providing the VPN tunnel to access the network only for the user terminal passing the authentication is achieved, interference of other Internet surfing users is avoided, the user terminal can conveniently use the VPN tunnel to access the resources after accessing the CPE, and the user experience is improved.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a network access method, electronic device and storage medium. Background Art

[0002] With the development of economic globalization, more and more enterprises, government agencies or special organizations (hereinafter referred to as enterprises, other agencies or organizations will not be described in detail) have established branches, and branches often need to access the resources of the headquarters. In addition, employees and partners on business trips also need to access the resources of the headquarters. Therefore, it is very necessary to be able to easily establish a tunnel connection with the headquarters to achieve access to the resources of the headquarters.

[0003] Currently, CPE (Customer-Premises Equipment) and router devices can be used as virtual private network (VPN) clients. VPN tunnel connection can be established by configuring the server address, account and password on the VPN page. However, users need to configure the VPN tunnel connection on the VPN page every time they want to use it, which is inconvenient for users who need to use this function frequently. Summary of the invention

[0004] In order to at least solve the above technical problem or at least partially solve the above technical problem, the present application provides a network access method, an electronic device and a storage medium.

[0005] In the first aspect, the present application provides a network access method applied to a CPE device, the method comprising: receiving an authentication request from a user terminal, the authentication request carrying target authentication information of the user terminal; authenticating the user terminal based on preset configuration information and the target authentication information; and when confirming that the user terminal has passed the authentication, controlling the user terminal to access the network through a virtual private network VPN tunnel.

[0006] In the second aspect, the present application provides a network access method applied to a user terminal, the method comprising: sending an authentication request to a CPE device, the authentication request carrying the target authentication information of the user terminal; after receiving the authentication success notification sent by the CPE device, accessing the network through a virtual private network VPN tunnel.

[0007] In a third aspect, the present application provides an electronic device comprising a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other via the communication bus; the memory is used to store computer programs; and the processor is used to implement any network access method described in the first aspect, or any network access method described in the second aspect, when executing the program stored in the memory.

[0008] In a fourth aspect, the present application provides a computer-readable storage medium, on which a program of a network access method is stored. When the program of the network access method is executed by a processor, the network access method described in any one of the first aspects, or the steps of the network access method described in any one of the second aspects, is implemented.

[0009] The above technical solution provided by the embodiment of the present application has at least the following advantages compared with the prior art:

[0010] This application authenticates the user terminal based on preset configuration information and the target authentication information carried in the authentication request of the user terminal. When it is confirmed that the user terminal has passed the authentication, the application controls the user terminal to access the network through the virtual private network VPN tunnel, thereby realizing the function of automatically providing VPN tunnel access to the network only for the user terminal that has passed the authentication, without being interfered by other Internet users, and enabling the user terminal to conveniently use the VPN tunnel to access resources after connecting to the CPE device, thereby improving the user experience. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the invention and, together with the description, serve to explain the principles of the invention.

[0012] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0013] Figure 1 A schematic diagram of a network topology for an exemplary application scenario provided in an embodiment of the present application;

[0014] Figure 2 A schematic diagram of the internal structure of a CPE device provided in an embodiment of the present application;

[0015] Figure 3 A flowchart of a network access method provided in an embodiment of the present application;

[0016] Figure 4 A flowchart of step S102 provided in an embodiment of the present application;

[0017] Figure 5 A flowchart of another network access method provided in an embodiment of the present application;

[0018] Figure 6A flowchart of another network access method provided in an embodiment of the present application;

[0019] Figure 7 A flowchart of another network access method provided in an embodiment of the present application;

[0020] Figure 8 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0021] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application.

[0022] Since currently every time you want to use a VPN tunnel you need to configure it on the VPN page, it is very inconvenient for users who need to use this function frequently to configure it every time. To this end, the embodiments of the present application provide a network access method, an electronic device, and a storage medium.

[0023] Figure 1 This is the network topology diagram of the application scenario of this application, which mainly includes user terminals, CPE devices and external networks. User terminals such as mobile phones or PCs on the user side are connected to the CPE device through Wi-Fi or wired broadband. The CPE device accesses the uplink server through the VPN network, and the CPE device is connected to the Internet.

[0024] Figure 2 This is a schematic diagram of the system structure inside the CPE device. It is mainly divided into user terminal, Web UI VPN configuration page, bridge br-lan DHCP service and WAN side network card. First, you need to turn on the switch on the Web UI VPN configuration page to determine whether the CPE device needs to authenticate the downstream user terminal, and then select the authentication method, that is, user device information authentication or user-defined keyword authentication, and then configure the authentication information as a whitelist. The user terminal and the bridge br-lan DHCP service report information through DHCP message interaction. After the CPE device obtains the information, it compares it with the whitelist it maintains to determine whether the user terminal accesses the upstream server through the VPN tunnel or accesses the Internet through the default method. When it is determined that the user terminal accesses the upstream server through the VPN tunnel, a VPN tunnel and routing rules through the VPN tunnel are established.

[0025] The present application embodiment provides a network access method, which can be applied to a CPE device, such as Figure 3 As shown, the method may include:

[0026] Step S101, receiving an authentication request from a user terminal, wherein the authentication request carries target authentication information of the user terminal;

[0027] The authentication request is a DHCP request message. The user terminal can access the CPE device through wired broadband or Wi-Fi. After the user terminal accesses the CPE device using wired broadband or Wi-Fi, it will send a DHCP request message to the CPE device (at this time, the CPE device can act as a DHCP server and the user terminal as a DHCP client).

[0028] The optional field of the DHCP request message carries the target authentication information of the user terminal. In the embodiment of the present application, the target authentication information includes two types, the first type is user equipment information, including one or more of IP address, MAC address, SN number, IMEI number, etc., and the second type is user-defined special keywords, i.e., customized keyword information.

[0029] In the embodiment of the present application, the content of the DHCP request message is roughly divided into a main body part and an additional option part, wherein the additional option part is the DHCP option, which is an optional field, and carries the target authentication information of the target user terminal. The function of option is to extend the DHCP function, and different information can be carried in the DHCP message according to different scenarios, so different options are also numbered, for example: option 3 is to set the gateway address option; option 60 sets the manufacturer classification information option, which is used to identify the type and configuration of the DHCP client; option 125 can carry the device SN number, etc. The CPE device side can obtain user device information or special keyword information that can be used for authentication from the DHCP message sent by the user terminal.

[0030] Step S102, authenticating the user terminal based on preset configuration information and the target authentication information;

[0031] In an embodiment of the present application, the preset configuration information may be pre-configured information for authenticating target authentication information from a user terminal, such as a white list, etc. The preset configuration information may store authentication information of user terminals that can pass authentication.

[0032] In this step, the target authentication information may be matched with the configuration information. If the match is successful, it may be determined that the user terminal has passed the authentication.

[0033] Step S103, when confirming that the user terminal has passed the authentication, controlling the user terminal to access the network through a virtual private network VPN tunnel.

[0034] If the user terminal passes the authentication, the user terminal can be allowed to access the network through the VPN tunnel. That is, the user terminal can access network resources through the VPN tunnel between the CPE device and the uplink server. The CPE device can send a notification of authentication success to the user terminal so that the user terminal can access the network through the VPN tunnel.

[0035] This application authenticates the user terminal based on preset configuration information and the target authentication information carried in the authentication request of the user terminal. When it is confirmed that the user terminal has passed the authentication, the application controls the user terminal to access the network through the virtual private network VPN tunnel, thereby realizing the function of automatically providing VPN tunnel access to the network only for the user terminal that has passed the authentication, without being interfered by other Internet users, and enabling the user terminal to conveniently use the VPN tunnel to access resources after connecting to the CPE device, thereby improving the user experience.

[0036] In another embodiment of the present application, Figure 4 As shown, step S102 authenticates the user terminal based on the preset configuration information and the target authentication information, including:

[0037] Step S201, obtaining target authentication information of the user terminal;

[0038] In this step, target authentication information of the user terminal may be extracted from the authentication request.

[0039] Step S202, determining whether the user terminal is in a preset whitelist according to the target authentication information;

[0040] The preset whitelist is pre-configured in the CPE device, and the preset whitelist may include: at least one pre-configured terminal device information and / or custom keyword information, wherein the terminal device information may include: one or more of IP address, MAC address, SN number and IMEI, and the custom keyword information may be special keyword information customized by the user.

[0041] Since the authentication completed by VPN tunnel configuration is the authentication between CPE device and upstream server, CPE device does not perform related authentication with downstream client device, which results in all user terminals connected to CPE device can access headquarters resources through VPN tunnel. For the current network environment, it cannot be guaranteed that all terminal devices connected to CPE device have the authority to access headquarters resources, so there are certain security risks if CPE device does not perform authentication for downstream client devices.

[0042] To this end, in this step, the target authentication information can be matched with the preset whitelist. If the target authentication information matches the information in the preset whitelist, it can be determined that the user terminal is in the preset whitelist. If the target authentication information does not match the information in the preset whitelist, it can be determined that the user terminal is not in the preset whitelist.

[0043] Step S203, if the user terminal is in the preset whitelist, determining that the user terminal is authenticated;

[0044] Step S204: if the user terminal is not in the preset whitelist, determine that the user terminal authentication fails.

[0045] The embodiment of the present application uses a preset whitelist to authenticate whether the user terminal is in the preset whitelist, and can obtain an authentication result of whether the user terminal has passed the authentication, thereby facilitating the screening of user terminals that are allowed to access the network through the VPN tunnel. For users who need to frequently access headquarters resources, it can be achieved that after accessing the CPE device, the whitelist can be automatically used for authentication, thereby improving the user experience. At the same time, since the whitelist is used to authenticate the user terminal, the security of resource access can be guaranteed.

[0046] In another embodiment of the present application, Figure 5 As shown, the method also includes:

[0047] Step S301, before receiving the authentication request, receiving an access request from the user terminal;

[0048] The user terminal can access the CPE device through wired broadband or Wi-Fi. When the user terminal accesses the CPE device using wired broadband or Wi-Fi, it can send an access request to the CPE device, and the CPE device can receive the access request from the user terminal.

[0049] Step S302, determining an authentication method for the target authentication information;

[0050] In an embodiment of the present application, authentication information can be configured in advance on the VPN configuration page of the Web UI VPN configuration page. Furthermore, the authentication information configured on the VPN configuration page of the configuration page includes: turning on the switch for authentication of the downlink terminal device; selecting an authentication method, the authentication method includes: user device information authentication or user-defined special keyword authentication; and, after selecting the authentication method, configuring the whitelist authentication information, the whitelist authentication information includes: IP address, MAC address, SN number, IMEI number or special keywords, etc., and establishing a whitelist based on the whitelist authentication information.

[0051] In this step, a pre-configured authentication method may be obtained.

[0052] Step S303: Add the authentication method to a reply message and send it to the user terminal, so that the user terminal sends the authentication request.

[0053] After obtaining the authentication mode, the CPE device may add information about the authentication mode in a reply message, so that the user terminal sends an authentication request carrying target authentication information to the CPE device.

[0054] The embodiment of the present application can obtain corresponding target authentication information based on a pre-configured authentication method, which facilitates obtaining authentication information that better matches a preset whitelist and improves authentication efficiency.

[0055] In another embodiment of the present application, step S202 determines whether the user terminal is in a preset whitelist according to the target authentication information, including:

[0056] If the authentication method is determined to be the terminal device information authentication method according to the target authentication information, whether the user terminal is in the preset whitelist is determined based on the terminal device information carried in the target authentication information; when the authentication method is the terminal device information authentication method, the authentication of the user terminal can be considered to be passed only when the CPE device matches the terminal device information provided by the user terminal in the preset whitelist.

[0057] or,

[0058] If the authentication method is determined to be a custom keyword authentication method according to the target authentication information, whether the user terminal is in a preset whitelist is determined based on the custom keyword information carried in the target authentication information. When the authentication method is a custom keyword authentication method, the user terminal can be considered authenticated only when the CPE device matches the custom keyword information provided by the user terminal in the preset whitelist.

[0059] In the embodiment of the present application, since there are two authentication methods, corresponding authentication strategies can be adopted for different authentication methods to improve authentication efficiency.

[0060] In another embodiment of the present application, Figure 6 As shown, if the user terminal passes the authentication, the method further includes:

[0061] Step S401, establishing a VPN tunnel and a routing rule corresponding to the VPN tunnel;

[0062] When it is determined that the user terminal has passed the authentication, a VPN tunnel may be established for the user terminal, that is, a VPN tunnel corresponding to the user terminal may be established. In order to facilitate routing the user terminal to the VPN tunnel, a routing rule corresponding to the VPN tunnel may also be established.

[0063] Step S402: Based on the routing rule, transmit the message of the user terminal through the VPN tunnel.

[0064] In this step, the established routing rules may be sent to the user terminal. When the user terminal requests to access the network using the VPN tunnel based on the routing rules, the CPE device transmits the message that the user terminal needs to transmit through the VPN tunnel between itself and the uplink server.

[0065] The embodiment of the present application saves system resources by establishing a VPN tunnel and routing rules only when the user terminal is authenticated.

[0066] On the basis of the above-mentioned embodiment, after the CPE device establishes the VPN tunnel, if it is set as the default route, then the CPE device can only access the resources of the upstream server through the VPN tunnel, and cannot be used as a normal Internet access device, so it has certain limitations. Therefore, in another embodiment of the present application, the method further includes:

[0067] In the case where the user terminal fails in authentication, the user terminal is prohibited from accessing resources through a virtual private network VPN tunnel, and the user terminal is allowed to access resources through a default network connection.

[0068] The embodiment of the present application can enable the CPE device to provide a VPN tunnel access method for user terminals in the whitelist while also providing a default Internet access method for user terminals not in the whitelist, thereby enriching the application scenarios and facilitating user use.

[0069] In another embodiment of the present application, Figure 7 As shown, the method also includes:

[0070] Step S501, determining whether the user terminal has been disconnected;

[0071] In this step, it can be detected whether the user terminal has disconnected the connection previously established with the CPE device through wired broadband or Wi-Fi.

[0072] Step S502: When it is confirmed that the user terminal has been disconnected, release the VPN tunnel resources corresponding to the user terminal.

[0073] If the user terminal has been disconnected, it is determined that the user terminal does not need to use the VPN tunnel to obtain resources from the uplink server. At this time, the VPN tunnel and corresponding resources established for the user terminal can be released to save system resources.

[0074] In another embodiment of the present application, a network access method is also provided, which is applied to a user terminal, such as Figure 3 As shown, the method includes:

[0075] Step S601, sending an authentication request to a CPE device, wherein the authentication request carries target authentication information of the user terminal;

[0076] When the user terminal needs to access the network through the VPN tunnel, it sends an authentication request to the CPE device. In order to facilitate authentication by the CPE device, the target authentication information is carried.

[0077] Step S602: After receiving the authentication success notification sent by the CPE device, access the network through the virtual private network VPN tunnel.

[0078] The embodiment of the present application can facilitate the CPE device to authenticate the user terminal by carrying the target authentication information in the authentication request, and then can access the network through the VPN tunnel after receiving the notification of successful authentication, thereby realizing the function of automatically providing VPN tunnel access to the network only for the user terminal that has passed the authentication, without being interfered by other Internet users, and can conveniently use the VPN tunnel to access resources, thereby improving the user experience.

[0079] In another embodiment of the present application, Figure 5 As shown, before sending the authentication request to the CPE, the method further includes:

[0080] Step S701, sending an access request to a CPE device;

[0081] The user terminal can access the CPE device through wired broadband or Wi-Fi. When the user terminal accesses the CPE device using wired broadband or Wi-Fi, it can send an access request to the CPE device.

[0082] Step S702, receiving a reply message from the CPE device, wherein the reply message carries an authentication method;

[0083] In this step, the user terminal can extract the authentication method information from the reply message from the CPE device.

[0084] Step S703: Send an authentication request to the CPE device via a DHCP message based on the authentication method.

[0085] In this step, in order for the user terminal to pass the authentication of the CPE device, the corresponding target authentication information can be obtained according to the authentication method specified by the CPE device, and then a DHCP message carrying the target authentication information is generated, and then an authentication request is sent to the CPE device through the DHCP message.

[0086] The embodiment of the present application can obtain the authentication method of the CPE device before authenticating to the CPE device, and then provide an authentication request carrying target authentication information corresponding to the authentication method in a targeted manner, so that the user terminal can pass the authentication and improve the authentication efficiency.

[0087] In another embodiment of the present application, an electronic device is provided, including a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other through the communication bus;

[0088] Memory, used to store computer programs;

[0089] The processor is used to implement the network access method described in any of the above method embodiments when executing the program stored in the memory.

[0090] In the electronic device provided by the embodiment of the present invention, the processor realizes authentication of the user terminal based on preset configuration information and target authentication information carried in the authentication request of the user terminal by executing the program stored in the memory. When it is confirmed that the user terminal authentication is passed, the user terminal is controlled to access the network through the virtual private network VPN tunnel, so as to realize the function of automatically providing VPN tunnel access to the network only for the user terminal that has passed the authentication, and will not be interfered by other Internet users. Moreover, the user terminal can conveniently use the VPN tunnel to access resources after being connected to the CPE device, thereby improving the user experience.

[0091] The communication bus 1140 mentioned in the above electronic device can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus. The communication bus 1140 can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 8 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0092] The communication interface 1120 is used for communication between the above electronic device and other devices.

[0093] The memory 1130 may include a random access memory (RAM) or a non-volatile memory, such as at least one disk memory. Optionally, the memory may also be at least one storage device located away from the aforementioned processor.

[0094] The above-mentioned processor 1110 can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components.

[0095] In another embodiment of the present application, a computer-readable storage medium is provided, on which a program of the network access method is stored. When the program of the network access method is executed by a processor, the steps of the network access method described in any of the aforementioned method embodiments are implemented.

[0096] It should be noted that, in this article, relational terms such as "first" and "second" are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0097] The foregoing is merely a specific embodiment of the present invention, which enables those skilled in the art to understand or implement the present invention. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but rather to the widest scope consistent with the principles and novel features claimed herein.

Claims

1. A network access method, characterized in that: Applied to CPE equipment, the method comprises: receiving an authentication request from a user terminal, the authentication request carrying target authentication information of the user terminal; authenticating the user terminal based on preset configuration information and the target authentication information; When it is confirmed that the user terminal has passed the authentication, the user terminal is controlled to access the network through a virtual private network VPN tunnel.

2. The network access method according to claim 1, characterized in that: The authentication request is a DHCP request message, and an optional field of the DHCP request message carries target authentication information of the user terminal.

3. The network access method according to claim 1, characterized in that: The authenticating the user terminal based on the preset configuration information and the target authentication information includes: Acquiring target authentication information of the user terminal; Determining whether the user terminal is in a preset whitelist according to the target authentication information; If the user terminal is in the preset whitelist, determining that the user terminal is authenticated; or, When the user terminal is not in the preset whitelist, it is determined that the user terminal authentication fails.

4. The network access method according to claim 1, characterized in that: The method further comprises: Before receiving the authentication request, receiving an access request from the user terminal; Determining an authentication method for the target authentication information; The authentication method is added to a reply message and sent to the user terminal, so that the user terminal sends the authentication request.

5. The network access method according to claim 1, characterized in that: If the user terminal passes the authentication, the method further includes: Establishing a VPN tunnel and a routing rule corresponding to the VPN tunnel; Based on the routing rule, the message of the user terminal is transmitted through the VPN tunnel.

6. The network access method according to claim 1, characterized in that: The method further comprises: Determining whether the user terminal has been disconnected; When it is confirmed that the user terminal has been disconnected, the VPN tunnel resources corresponding to the user terminal are released.

7. A network access method, characterized in that: Applied to a user terminal, the method comprises: Sending an authentication request to the CPE device, wherein the authentication request carries target authentication information of the user terminal; After receiving the authentication notification sent by the CPE device, access the network through the virtual private network VPN tunnel.

8. The network access method according to claim 7, characterized in that: The method further comprises: before sending the authentication request to the CPE, Send an access request to the CPE device; receiving a reply message from the CPE device, wherein the reply message carries an authentication method; Based on the authentication method, an authentication request is sent to the CPE device through a DHCP message.

9. An electronic device, characterized in that: It includes a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other through the communication bus; Memory, used to store computer programs; The processor is used to implement the network access method described in any one of claims 1 to 6, or the network access method described in any one of claims 7 to 8 when executing the program stored in the memory.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a program of a network access method, and when the program of the network access method is executed by a processor, the network access described in any one of claims 1 to 6, or the steps of the network access method described in any one of claims 7 to 8, is implemented.

Images