Access authentication method, device, system, electronic device and storage medium

Abstract

The present invention proposes an access authentication method, device, system, electronic device and storage medium, which relate to the field of communication technology. Two address pools with the same IP address range and gateway address are configured on the SDN controller, and the two address pools are associated with different VRF information. The SDN controller receives a DHCP relay request message sent by a DHCP relay device. When the address pool associated with the VRF information in the DHCP relay request message is the address pool corresponding to the default VLAN, an IP address is allocated to the terminal from the address pool and the terminal is authenticated; the access port VLAN of the terminal after successful authentication is configured as an authorized VLAN, and the IP address is synchronized to the allocation list of the address pool corresponding to the authorized VLAN. In this way, after the terminal is successfully authenticated, it can directly use the IP address obtained before authentication to communicate, without waiting for the terminal to renew its lease or manually triggering the terminal to re-acquire the IP address in the authorized VLAN before communication.

Description

Technical Field

[0001] The present invention relates to the field of communication technology, and in particular to an access authentication method, device, system, electronic device and storage medium. Background Art

[0002] In a campus network managed by an SDN (Software Defined Network) controller, network access policy control (such as external network access rights and network quality assurance) can be implemented for different users. VLAN (Virtual Local Area Network) authorization can be used to authorize different users to different VLANs, and network access policy control for users can be implemented based on VLANs.

[0003] In a campus network managed by an SDN controller, VLAN authorization can be used to implement network access policy control for Portal-authenticated users. Portal authentication, also known as Web authentication, requires Layer 3 network connectivity between the terminal and the authentication server. After accessing the network, the terminal obtains an IP address through DHCP (Dynamic Host Configuration Protocol). After successful authentication, the terminal is reauthorized to a new VLAN. However, the terminal is unaware of the VLAN change on the access port and does not automatically trigger DHCP to reacquire an IP address. This results in a mismatch between the IP address obtained before authentication and the authorized VLAN, leading to network disconnection. The terminal must manually trigger IP address reacquisition or wait for the authentication server to respond with a new IP address when the terminal renews its DHCP lease before normal network access is restored.

[0004] An existing solution is to configure the DHCP lease period before Portal authentication to be sufficiently short. The terminal frequently renews its lease. After a new VLAN is authorized, the terminal can update its IP address to an IP address from the address pool corresponding to the authorized VLAN during the next lease renewal. This solution can address the aforementioned issues to a certain extent, but frequent lease renewals by terminals may put a lot of pressure on the authentication server. Furthermore, network inaccessibility may occur between the successful VLAN authorization and the next lease renewal request. Summary of the Invention

[0005] In view of this, the purpose of the present invention is to provide an access authentication method, device, system, electronic device and storage medium to solve the problem in the existing terminal access authentication scheme that the IP address obtained before the terminal authentication does not match the authorized VLAN after the authentication is successful, thereby causing the network to be inaccessible.

[0006] In order to achieve the above objectives, the technical solutions adopted in the embodiments of the present invention are as follows:

[0007] In a first aspect, the present invention provides an access authentication method, which is applied to an SDN controller, wherein the SDN controller is in communication with a DHCP relay device; the SDN controller is configured with an address pool corresponding to a default VLAN and an address pool corresponding to an authorized VLAN, wherein the address pool corresponding to the default VLAN and the address pool corresponding to the authorized VLAN have the same IP address range and gateway address, and the address pool corresponding to the default VLAN and the address pool corresponding to the authorized VLAN are associated with different VRF information; the method comprises:

[0008] receiving a DHCP relay request message sent by the DHCP relay device based on the DHCP request message of the terminal; the DHCP relay request message carries VRF information corresponding to the access port VLAN of the terminal;

[0009] Query the address pool associated with the VRF information in the DHCP relay request message;

[0010] If the address pool associated with the VRF information in the DHCP relay request message is the address pool corresponding to the default VLAN, allocating an IP address to the terminal from the address pool corresponding to the default VLAN and returning the allocated IP address to the terminal through the DHCP relay device;

[0011] Authenticate the terminal after obtaining the IP address, configure the access port VLAN of the terminal after successful authentication as the authorized VLAN, and synchronize the IP address allocated to the terminal in the address pool corresponding to the default VLAN to the allocation list of the address pool corresponding to the authorized VLAN.

[0012] In an optional embodiment, the method further comprises:

[0013] If the address pool associated with the VRF information in the DHCP relay request message is the address pool corresponding to the authorized VLAN, an IP address is allocated to the terminal from the address pool corresponding to the authorized VLAN and the allocated IP address is returned to the terminal through the DHCP relay device.

[0014] In a second aspect, the present invention provides an access authentication method, which is applied to a DHCP relay device, wherein the DHCP relay device is in communication with an SDN controller, and the DHCP relay device records VRF information corresponding to a default VLAN and an authorized VLAN; the method comprises:

[0015] Acquire the access port VLAN of the terminal according to the DHCP request message sent by the terminal;

[0016] If the access port VLAN of the terminal is the default VLAN, adding the VRF information corresponding to the default VLAN to a DHCP relay request message generated based on the DHCP request message, and sending the DHCP relay request message carrying the VRF information corresponding to the default VLAN to the SDN controller, so that the SDN controller allocates an IP address to the terminal from the address pool corresponding to the default VLAN according to the VRF information corresponding to the default VLAN in the DHCP relay request message;

[0017] Receive the IP address assigned by the SDN controller and return it to the terminal.

[0018] In an optional embodiment, the method further comprises:

[0019] If the access port VLAN of the terminal is the authorized VLAN, adding the VRF information corresponding to the authorized VLAN to a DHCP relay request message generated based on the DHCP request message, and sending the DHCP relay request message carrying the VRF information corresponding to the authorized VLAN to the SDN controller, so that the SDN controller allocates an IP address to the terminal from the address pool corresponding to the authorized VLAN according to the VRF information corresponding to the authorized VLAN in the DHCP relay request message;

[0020] Receive the IP address assigned by the SDN controller and return it to the terminal.

[0021] In a third aspect, the present invention provides an access authentication system, comprising an SDN controller and a DHCP relay device, wherein the SDN controller is in communication with the DHCP relay device; the DHCP relay device records VRF information corresponding to a default VLAN and an authorized VLAN; the SDN controller is configured with an address pool corresponding to the default VLAN and an address pool corresponding to the authorized VLAN; the address pool corresponding to the default VLAN and the address pool corresponding to the authorized VLAN have the same IP address range and gateway address, and the address pool corresponding to the default VLAN and the address pool corresponding to the authorized VLAN are associated with different VRF information;

[0022] The DHCP relay device is configured to obtain the access port VLAN of the terminal according to the DHCP request message sent by the terminal, and if the access port VLAN of the terminal is the default VLAN, add the VRF information corresponding to the default VLAN to the DHCP relay request message generated based on the DHCP request message, and send the DHCP relay request message carrying the VRF information corresponding to the default VLAN to the SDN controller;

[0023] The SDN controller is configured to allocate an IP address to the terminal from the address pool corresponding to the default VLAN according to the VRF information corresponding to the default VLAN in the DHCP relay request message, return the allocated IP address to the terminal through the DHCP relay device, authenticate the terminal after obtaining the IP address, configure the access port VLAN of the terminal after successful authentication as the authorized VLAN, and synchronize the IP address allocated to the terminal in the address pool corresponding to the default VLAN to the allocation list of the address pool corresponding to the authorized VLAN.

[0024] In an optional embodiment, the DHCP relay device is further configured to, if the access port VLAN of the terminal is the authorized VLAN, add VRF information corresponding to the authorized VLAN to a DHCP relay request message generated based on the DHCP request message, and send the DHCP relay request message carrying the VRF information corresponding to the authorized VLAN to the SDN controller;

[0025] The SDN controller is further configured to allocate an IP address to the terminal from the address pool corresponding to the authorized VLAN according to the VRF information corresponding to the authorized VLAN in the DHCP relay request message, and return the allocated IP address to the terminal through the DHCP relay device.

[0026] In a fourth aspect, the present invention provides an access authentication device, applied to an SDN controller, the SDN controller being communicatively connected to a DHCP relay device; the SDN controller being configured with an address pool corresponding to a default VLAN and an address pool corresponding to an authorized VLAN, the address pool corresponding to the default VLAN and the address pool corresponding to the authorized VLAN having the same IP address range and gateway address, and the address pool corresponding to the default VLAN and the address pool corresponding to the authorized VLAN being associated with different VRF information; the device comprising:

[0027] a transceiver module, configured to receive a DHCP relay request message sent by the DHCP relay device based on the DHCP request message of the terminal; the DHCP relay request message carries VRF information corresponding to the access port VLAN of the terminal;

[0028] a processing module, configured to query the address pool associated with the VRF information in the DHCP relay request message; if the address pool associated with the VRF information in the DHCP relay request message is the address pool corresponding to the default VLAN, allocating an IP address to the terminal from the address pool corresponding to the default VLAN;

[0029] The transceiver module is further configured to return the allocated IP address to the terminal via the DHCP relay device;

[0030] The processing module is further used to authenticate the terminal after obtaining the IP address, configure the access port VLAN of the terminal after successful authentication as the authorized VLAN, and synchronize the IP address allocated to the terminal in the address pool corresponding to the default VLAN to the allocation list of the address pool corresponding to the authorized VLAN.

[0031] In a fifth aspect, the present invention provides an access authentication device, which is applied to a DHCP relay device, wherein the DHCP relay device is in communication with an SDN controller, and wherein VRF information corresponding to a default VLAN and an authorized VLAN is recorded in the DHCP relay device; the device comprises:

[0032] The first transceiver module is used to receive a DHCP request message sent by a terminal and obtain an access port VLAN of the terminal;

[0033] a second transceiver module, configured to, if the access port VLAN of the terminal is the default VLAN, add VRF information corresponding to the default VLAN to a DHCP relay request message generated based on the DHCP request message, and send the DHCP relay request message carrying the VRF information corresponding to the default VLAN to the SDN controller, so that the SDN controller allocates an IP address to the terminal from an address pool corresponding to the default VLAN according to the VRF information corresponding to the default VLAN in the DHCP relay request message;

[0034] The second transceiver module is further configured to receive an IP address assigned by the SDN controller;

[0035] The first transceiver module is further configured to return the IP address allocated by the SDN controller to the terminal.

[0036] In a sixth aspect, the present invention provides an electronic device comprising a processor, a memory, and a computer program stored in the memory and executable on the processor, wherein the computer program, when executed by the processor, implements the steps of the access authentication method as described in any one of the foregoing embodiments.

[0037] In a seventh aspect, the present invention provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of the access authentication method as described in any one of the aforementioned embodiments.

[0038] The access authentication method, device, system, electronic device and storage medium provided by the embodiments of the present invention configure an address pool corresponding to a default VLAN and an address pool corresponding to an authorized VLAN on an SDN controller, wherein the IP address range and gateway address of the two address pools are the same, and the two address pools are associated with different VRF information. The SDN controller receives a DHCP relay request message sent by a DHCP relay device based on a DHCP request message of a terminal, wherein the DHCP relay request message carries VRF information corresponding to the access port VLAN of the terminal. When the address pool associated with the VRF information corresponding to the access port VLAN of the terminal is the address pool corresponding to the default VLAN, the SDN controller can allocate an IP address to the terminal from the address pool corresponding to the default VLAN, authenticate the terminal after obtaining the IP address, configure the access port VLAN of the terminal after successful authentication as an authorized VLAN, and synchronize the IP address allocated to the terminal in the address pool corresponding to the default VLAN to the allocation list of the address pool corresponding to the authorized VLAN. In this way, after the terminal is successfully authenticated, it can directly use the IP address obtained before authentication to communicate in the authorized VLAN after successful authentication. There is no need to wait for the terminal to renew its lease or manually trigger the terminal to re-acquire the IP address in the authorized VLAN before communication. This effectively avoids the problem of network inaccessibility caused by the mismatch between the IP address obtained before the terminal authentication and the authorized VLAN after successful authentication.

[0039] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, preferred embodiments are given below and described in detail with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for use in the embodiments. It should be understood that the following drawings only illustrate certain embodiments of the present invention and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other relevant drawings can be obtained based on these drawings without paying any creative work.

[0041] Figure 1 A schematic diagram of an application scenario of the access authentication system provided by an embodiment of the present invention is shown;

[0042] Figure 2 A schematic diagram of a process flow of an access authentication method applied to an SDN controller provided by an embodiment of the present invention is shown;

[0043] Figure 3 Another schematic diagram of a flow chart of an access authentication method applied to an SDN controller provided by an embodiment of the present invention is shown;

[0044] Figure 4A schematic diagram of a process flow of an access authentication method applied to a DHCP relay device provided by an embodiment of the present invention is shown;

[0045] Figure 5 Another schematic diagram of a flow chart of an access authentication method applied to a DHCP relay device provided by an embodiment of the present invention is shown;

[0046] Figure 6 A functional module diagram of an access authentication device applied to an SDN controller provided by an embodiment of the present invention is shown;

[0047] Figure 7 A functional module diagram of an access authentication device applied to a DHCP relay device provided by an embodiment of the present invention is shown;

[0048] Figure 8 A block diagram of an electronic device provided by an embodiment of the present invention is shown.

[0049] Icon: 100 - SDN controller; 110 - memory; 120 - processor; 130 - communication module; 200 - DHCP relay device; 300 - terminal; 400 - terminal access device; 610 - transceiver module; 620 - processing module; 710 - first transceiver module; 720 - second transceiver module. DETAILED DESCRIPTION

[0050] The following will be combined with the accompanying drawings to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Generally, the components of the embodiments of the present invention described and shown in the drawings herein can be arranged and designed in various different configurations.

[0051] Therefore, the following detailed description of the embodiments of the present invention provided in the accompanying drawings is not intended to limit the scope of the invention as claimed, but is merely intended to represent selected embodiments of the present invention. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative work are within the scope of protection of the present invention.

[0052] It should be noted that relational terms such as "first" and "second" are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or apparatus. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of additional identical elements in the process, method, article, or apparatus comprising the element.

[0053] Please refer to Figure 1 , which is a schematic diagram of an application scenario of the access authentication system provided by an embodiment of the present invention. The access authentication system includes an SDN controller 100 and a DHCP relay device 200. The SDN controller 100 is communicatively connected to the DHCP relay device 200, and the terminal 300 is communicatively connected to the DHCP relay device 200 via a terminal access device 400.

[0054] In this embodiment, a DHCP server and authentication service can be deployed in the SDN controller 100. The DHCP relay device 200 can be a network device such as a router or switch that supports the DHCP protocol. The terminal 300 is a terminal used by a user, including but not limited to a personal computer (PC), tablet computer, smartphone, personal digital assistant (PDA), etc. The terminal access device 400 can be a gateway, router, switch, access controller, wireless access point, etc. This embodiment of the present invention does not limit the types of the SDN controller 100, DHCP relay device 200, terminal 300, and terminal access device 400.

[0055] Among them, the DHCP relay device 200 records the VRF (Virtual Routing Forwarding) information corresponding to the default VLAN and the authorized VLAN, and the SDN controller 100 is configured with the address pool corresponding to the default VLAN and the address pool corresponding to the authorized VLAN. The IP address range and gateway address of the address pool corresponding to the default VLAN and the address pool corresponding to the authorized VLAN are the same, and the address pool corresponding to the default VLAN and the address pool corresponding to the authorized VLAN are associated with different VRF information.

[0056] In this embodiment, the VRF information may be a VRF name, which can be understood as the name of the Layer 3 network corresponding to each VLAN.

[0057] The DHCP relay device 200 is used to obtain the access port VLAN of the terminal 300 according to the DHCP request message sent by the terminal 300. If the access port VLAN of the terminal 300 is the default VLAN, the DHCP relay device 200 adds the VRF information corresponding to the default VLAN to the DHCP relay request message generated based on the DHCP request message broadcast by the terminal 300, and unicasts the DHCP relay request message carrying the VRF information corresponding to the default VLAN to the SDN controller 100.

[0058] In this embodiment, when the terminal 300 accesses the network through the terminal access device 400, the VLAN of the port (access port) to which the terminal 300 is connected to the terminal access device 400 is the default VLAN. The terminal 300 broadcasts a DHCP request message to the DHCP relay device 200 through the terminal access device 400. The DHCP request message received by the DHCP relay device 200 carries the access port VLAN of the terminal 300. The DHCP relay device 200 obtains the VLAN to which the interface receiving the DHCP request message belongs as the default VLAN, obtains the corresponding VRF information based on the default VLAN, and adds the VRF information of the default VLAN to the DHCP request message broadcast by the terminal 300, obtains the corresponding DHCP relay request message, and unicasts the DHCP relay request message to the DHCP server of the SDN controller 100.

[0059] For example, a custom Option, such as Option 122, can be added to the DHCP relay request message, the length of Option 122 can be defined, such as 8 bytes, and the value of Option 122 can be set to the VRF information corresponding to the default VLAN. Then, the DHCP relay request message carrying the VRF information corresponding to the default VLAN is unicasted to the SDN controller 100.

[0060] The SDN controller 100 is used to allocate an IP address to the terminal 300 from the address pool corresponding to the default VLAN according to the VRF information corresponding to the default VLAN in the DHCP relay request message, and return the allocated IP address to the terminal 300 through the DHCP relay device, and authenticate the terminal 300 after obtaining the IP address, configure the access port VLAN of the terminal 300 after successful authentication as the authorized VLAN, and synchronize the IP address allocated to the terminal 300 in the address pool corresponding to the default VLAN to the allocation list of the address pool corresponding to the authorized VLAN.

[0061] In this embodiment, the SDN controller 100 supports Portal authentication, VLAN authorization, and DHCP Server, and the DHCP Server supports parsing custom options. The DHCP Server of the SDN controller 100 opens DHCP address pools for the default VLAN before terminal authentication and the authorized VLAN after terminal authentication. The IP address ranges and gateway addresses of the two address pools are consistent, and the two address pools are associated with different VRF information. When a DHCP relay request message is sent to the DHCP Server of the SDN controller 100, the DHCP Server of the SDN controller queries the address pool list for which address pool to allocate the IP address based on the value of the custom option in the DHCP relay request message. The address pool list records the association between different address pools and VRF information.

[0062] For example, after the SDN controller 100 receives the DHCP relay request message sent by the DHCP relay device 200, the value of Option 122 obtained from the DHCP relay request message by the DHCP Server is the VRF information corresponding to the default VLAN (the configured VRF name). According to the VRF information corresponding to the default VLAN, the associated address pool is searched in the address pool list. The associated address pool is the address pool corresponding to the default VLAN. The IP address (such as IP1) is allocated from the address pool corresponding to the default VLAN, and a DHCP response message corresponding to the DHCP relay request message is generated and unicasted to the DHCP relay device 200.

[0063] After the DHCP relay device 200 receives the DHCP response message sent by the SDN controller 100, it converts the DHCP response message from unicast to a broadcast message of the default VLAN and returns it to the terminal 300. The terminal 300 performs portal authentication based on the assigned IP address, that is, the SDN controller 100 authenticates the terminal 300 after obtaining the IP address. After the authentication is successful, the SDN controller 100 issues a VLAN authorization based on the terminal 300 to the access port of the terminal 300 on the terminal access device 400, reallocates the access port of the terminal 300 to the authorized VLAN, and synchronizes the IP address assigned to the terminal 300 in the address pool corresponding to the default VLAN to the allocation list of the address pool corresponding to the authorized VLAN. At this time, the terminal 300 has been authorized to the new VLAN (authorized VLAN). For the terminal 300, its three-layer gateway and IP address have not changed, but the three-layer network is available at this time, and the user does not perceive the VLAN change.

[0064] In one embodiment, the DHCP relay device 200 is further configured to, if the access port VLAN of the terminal 300 is an authorized VLAN, add VRF information corresponding to the authorized VLAN to a DHCP relay request message generated based on the DHCP request message, and unicast the DHCP relay request message carrying the VRF information corresponding to the authorized VLAN to the SDN controller 100; the SDN controller 100 is further configured to allocate an IP address to the terminal 300 from the address pool corresponding to the authorized VLAN according to the VRF information corresponding to the authorized VLAN in the DHCP relay request message, and return the allocated IP address to the terminal 300 through the DHCP relay device 200.

[0065] In this embodiment, since the IP address assigned by the SDN controller 100 has a lease period, that is, the terminal 300 can only use the assigned IP address within a certain period of time, the length of the lease period can be configured on the SDN controller 100. When the IP address usage period reaches a certain length (e.g., half of the lease period), the terminal 300 broadcasts a DHCP renewal request message. At this time, the access port VLAN of the terminal 300 is an authorized VLAN. After the DHCP relay device 200 receives the DHCP renewal request message broadcast by the terminal, it obtains the VLAN to which the interface receiving the DHCP renewal request message belongs as the authorized VLAN. Based on the authorized VLAN, the DHCP relay device 200 obtains the corresponding VRF information, adds the VRF information of the authorized VLAN to the DHCP renewal request message sent by the terminal 300, obtains the corresponding DHCP relay request message, and unicasts the DHCP relay request message to the DHCP server of the SDN controller 100.

[0066] After receiving the DHCP relay request message unicast from the DHCP relay device 200, the SDN controller 100 obtains the custom option value from the DHCP relay request message as the VRF information corresponding to the authorized VLAN. Based on the VRF information corresponding to the authorized VLAN, it searches the address pool list for the associated address pool. If the associated address pool is the address pool corresponding to the authorized VLAN, it allocates an IP address from the address pool corresponding to the authorized VLAN and generates a DHCP response message corresponding to the DHCP relay request message, which it unicasts to the DHCP relay device 200. After receiving the DHCP response message sent by the SDN controller 100, the DHCP response message is converted from unicast to a broadcast message for the authorized VLAN and returned to the terminal 300. At this point, the terminal 300 obtains an IP address from the address pool of the authorized VLAN, and the Layer 3 network remains accessible.

[0067] Please refer to Figure 2, is a flow chart of an access authentication method applied to the SDN controller 100 provided by an embodiment of the present invention. It should be noted that the access authentication method of the embodiment of the present invention is not based on Figure 2 It should be understood that in other embodiments, the order of some steps in the access authentication method of the embodiment of the present invention can be interchanged according to actual needs, or some steps can be omitted or deleted. Figure 2 The specific process shown is explained in detail.

[0068] Step S201: Receive a DHCP relay request message sent by a DHCP relay device based on a DHCP request message from a terminal; the DHCP relay request message carries VRF information corresponding to the access port VLAN of the terminal.

[0069] In this embodiment, the VRF information corresponding to the access port VLAN is added to the DHCP relay request message by the DHCP relay device 200. When the terminal 300 accesses the network through the terminal access device 400, the terminal's access port VLAN is the default VLAN. After receiving the DHCP request message broadcast by the terminal, the DHCP relay device 200 obtains the corresponding VRF information based on the access port VLAN of the terminal 300 carried in the message, namely the VRF information corresponding to the default VLAN, and generates a DHCP relay request message corresponding to the DHCP request message. The DHCP relay request message then is added to the VRF information corresponding to the default VLAN and unicasted to the DHCP server of the SDN controller 100.

[0070] Step S202: query the address pool associated with the VRF information in the DHCP relay request message.

[0071] In this embodiment, after receiving the DHCP relay request message unicasted by the DHCP relay device 200, the SDN controller 100 queries the associated address pool according to the VRF information corresponding to the default VLAN and finds that the address pool is the address pool corresponding to the default VLAN.

[0072] Step S203: If the address pool associated with the VRF information in the DHCP relay request message is the address pool corresponding to the default VLAN, an IP address is allocated to the terminal from the address pool corresponding to the default VLAN and the allocated IP address is returned to the terminal through the DHCP relay device.

[0073] In this embodiment, when the SDN controller 100 finds that the address pool associated with the VRF information in the DHCP relay request message is the address pool corresponding to the default VLAN, it allocates an IP address from the address pool corresponding to the default VLAN, and generates a DHCP response message corresponding to the DHCP relay request message and unicasts it to the DHCP relay device 200. After receiving the DHCP response message, the DHCP relay device 200 converts the DHCP response message from unicast to a broadcast message of the default VLAN and returns it to the terminal 300.

[0074] Step S204: authenticate the terminal after obtaining the IP address, configure the access port VLAN of the terminal after successful authentication as the authorized VLAN, and synchronize the IP address allocated to the terminal in the address pool corresponding to the default VLAN to the allocation list of the address pool corresponding to the authorized VLAN.

[0075] In this embodiment, the terminal 300 performs portal authentication based on the assigned IP address. That is, the SDN controller 100 authenticates the terminal 300 after obtaining the IP address. After successful authentication, the SDN controller 100 issues a VLAN authorization based on the terminal 300 to the access port of the terminal 300 on the terminal access device 400, reallocates the access port of the terminal 300 to the authorized VLAN, and synchronizes the IP address assigned to the terminal 300 in the address pool corresponding to the default VLAN to the allocation list of the address pool corresponding to the authorized VLAN. At this point, the terminal 300 has been authorized to the new VLAN (authorized VLAN). For the terminal 300, its three-layer gateway and IP address have not changed, but the three-layer network is available at this time, and the user is not aware of the VLAN change.

[0076] In one embodiment, see Figure 3 The access authentication method provided by the embodiment of the present invention may further include:

[0077] Step S301: If the address pool associated with the VRF information in the DHCP relay request message is the address pool corresponding to the authorized VLAN, an IP address is allocated to the terminal from the address pool corresponding to the authorized VLAN and the allocated IP address is returned to the terminal through the DHCP relay device.

[0078] In this embodiment, when the usage period of the IP address allocated to the terminal 300 reaches a certain length of time, the terminal 300 can broadcast a DHCP renewal request message. At this time, the access port VLAN of the terminal 300 is an authorized VLAN. After the DHCP relay device 200 receives the DHCP renewal request message broadcast by the terminal 300, it obtains the VLAN to which the interface receiving the DHCP renewal request message belongs as the authorized VLAN. The DHCP relay device 200 obtains the corresponding VRF information according to the authorized VLAN, and generates a DHCP relay request message corresponding to the DHCP request message. In the DHCP relay request message, the custom option is set to the VRF information corresponding to the authorized VLAN, and then the DHCP relay request message carrying the VRF information corresponding to the authorized VLAN is unicasted to the SDN controller 100.

[0079] After receiving the DHCP relay request message unicast from the DHCP relay device 200, the SDN controller 100 obtains the custom option value from the DHCP relay request message, which is the VRF information corresponding to the authorized VLAN. Based on the VRF information corresponding to the authorized VLAN, it searches the address pool list and finds that the address pool associated with the authorized VLAN is the address pool corresponding to the authorized VLAN. It then allocates an IP address from the address pool corresponding to the authorized VLAN and generates a DHCP response message corresponding to the DHCP relay request message, which it unicasts to the DHCP relay device 200. After receiving the DHCP response message from the SDN controller 100, the DHCP response message is converted from a unicast message to a broadcast message for the authorized VLAN and returned to the terminal 300. At this point, the terminal 300 obtains an IP address from the address pool of the authorized VLAN, and the Layer 3 network remains accessible.

[0080] Please refer to Figure 4 , is a flow chart of an access authentication method applied to a DHCP relay device 200 provided in an embodiment of the present invention. It should be noted that the access authentication method in the embodiment of the present invention is not based on Figure 4 It should be understood that in other embodiments, the order of some steps in the access authentication method of the embodiment of the present invention can be interchanged according to actual needs, or some steps can be omitted or deleted. Figure 4 The specific process shown is explained in detail.

[0081] Step S401: Acquire the access port VLAN of the terminal according to the DHCP request message sent by the terminal.

[0082] In this embodiment, when the terminal 300 accesses the network through the terminal access device 400, the terminal's access port VLAN is the default VLAN. The DHCP relay device 200 can determine the terminal's access port VLAN according to the VLAN to which the interface receiving the DHCP request message belongs.

[0083] In step S402, if the access port VLAN of the terminal is the default VLAN, VRF information corresponding to the default VLAN is added to the DHCP relay request message generated based on the DHCP request message, and the DHCP relay request message carrying the VRF information corresponding to the default VLAN is unicasted to the SDN controller, so that the SDN controller allocates an IP address to the terminal from the address pool corresponding to the default VLAN according to the VRF information corresponding to the default VLAN in the DHCP relay request message.

[0084] In this embodiment, the DHCP relay device 200 determines that the access port VLAN of the terminal 300 carried in the terminal's DHCP request message is the default VLAN. It then obtains the VRF information corresponding to the default VLAN, generates a corresponding DHCP relay request message, then adds the VRF information corresponding to the default VLAN to the generated DHCP relay request message, and unicasts the DHCP relay request message to the SDN controller 100. After receiving the DHCP relay request message from the DHCP relay device 200, the SDN controller 100 queries the associated address pool based on the VRF information corresponding to the default VLAN and finds that it is the address pool corresponding to the default VLAN. It then allocates an IP address from the address pool corresponding to the default VLAN, generates a DHCP response message corresponding to the DHCP relay request message, and unicasts it to the DHCP relay device 200.

[0085] Step S403: Receive the IP address assigned by the SDN controller and return it to the terminal.

[0086] In this embodiment, after the DHCP relay device 200 receives the DHCP response message sent by the SDN controller 100, it converts the DHCP response message from unicast to a broadcast message of the default VLAN and returns it to the terminal 300. The terminal 300 performs portal authentication based on the assigned IP address, that is, the SDN controller 100 authenticates the terminal 300 after obtaining the IP address. After successful authentication, the SDN controller 100 issues a VLAN authorization based on the terminal 300 to the access port of the terminal 300 on the terminal access device 400, reallocates the access port of the terminal 300 to the authorized VLAN, and synchronizes the IP address assigned to the terminal 300 in the address pool corresponding to the default VLAN to the allocation list of the address pool corresponding to the authorized VLAN. At this point, the terminal 300 has been authorized to the new VLAN (authorized VLAN). For the terminal 300, its three-layer gateway and IP address have not changed, but the three-layer network is available at this time, and the user is not aware of the VLAN change.

[0087] In one embodiment, see Figure 5 The access authentication method provided by the embodiment of the present invention may further include:

[0088] In step S501, if the access port VLAN of the terminal is an authorized VLAN, VRF information corresponding to the authorized VLAN is added to the DHCP relay request message generated based on the DHCP request message, and the DHCP relay request message carrying the VRF information corresponding to the authorized VLAN is sent to the SDN controller, so that the SDN controller can allocate an IP address to the terminal from the address pool corresponding to the authorized VLAN according to the VRF information corresponding to the authorized VLAN in the DHCP relay request message.

[0089] In this embodiment, when the usage period of the IP address allocated to the terminal 300 reaches a certain length of time, the terminal 300 can broadcast a DHCP renewal request message. At this time, the access port VLAN of the terminal 300 is an authorized VLAN, that is, the DHCP relay device 200 determines that the access port VLAN of the terminal 300 is an authorized VLAN based on the VLAN to which the interface receiving the DHCP renewal request message belongs. At this time, the corresponding VRF information is obtained according to the authorized VLAN, and a corresponding DHCP relay request message is generated. The custom option is set to the VRF information corresponding to the authorized VLAN in the DHCP relay request message, and then the DHCP relay request message carrying the VRF information corresponding to the authorized VLAN is unicasted to the SDN controller 100. After the SDN controller 100 receives the DHCP relay request message unicasted by the DHCP relay device 200, the value of the custom option obtained from the DHCP relay request message is the VRF information corresponding to the authorized VLAN. At this time, according to the VRF information corresponding to the authorized VLAN, the associated address pool is queried in the address pool list, which is the address pool corresponding to the authorized VLAN. Therefore, the IP address is allocated from the address pool corresponding to the authorized VLAN, and a DHCP response message corresponding to the DHCP relay request message is generated and unicasted to the DHCP relay device 200.

[0090] Step S502: Receive the IP address assigned by the SDN controller and return it to the terminal.

[0091] In this embodiment, after receiving the DHCP response message sent by the SDN controller 100, the DHCP relay device 200 converts the DHCP response message from unicast to a broadcast message of the default VLAN and returns it to the terminal 300. At this time, the terminal 300 obtains an IP address from the address pool of the authorized VLAN, and the three-layer network is still accessible.

[0092] In order to execute the corresponding steps in the above embodiments and various possible methods, a method for implementing the access authentication device is given below. Figure 6 , a functional block diagram of an access authentication device for an SDN controller 100 according to an embodiment of the present invention. It should be noted that the basic principles and technical effects of the access authentication device provided in this embodiment are the same as those of the aforementioned embodiments. For the sake of brevity, any details not mentioned in this embodiment are referred to the corresponding contents of the aforementioned embodiments. The access authentication device includes a transceiver module 610 and a processing module 620.

[0093] The transceiver module 610 is configured to receive a DHCP relay request message sent by a DHCP relay device based on a DHCP request message from a terminal; the DHCP relay request message carries VRF information corresponding to the VLAN of the access port of the terminal.

[0094] The processing module 620 is configured to query the address pool associated with the VRF information in the DHCP relay request message; if the address pool associated with the VRF information in the DHCP relay request message is the address pool corresponding to the default VLAN, allocate an IP address to the terminal from the address pool corresponding to the default VLAN.

[0095] The transceiver module 610 is further configured to return the allocated IP address to the terminal via the DHCP relay device;

[0096] The processing module 620 is also used to authenticate the terminal after obtaining the IP address, configure the access port VLAN of the terminal after successful authentication as the authorized VLAN, and synchronize the IP address allocated to the terminal in the address pool corresponding to the default VLAN to the allocation list of the address pool corresponding to the authorized VLAN.

[0097] Optionally, the processing module 620 is further configured to allocate an IP address to the terminal from the address pool corresponding to the authorized VLAN if the address pool associated with the VRF information in the DHCP relay request message is the address pool corresponding to the authorized VLAN; the transceiver module 610 is further configured to return the allocated IP address to the terminal through the DHCP relay device.

[0098] Please refer to Figure 7 , a functional block diagram of an access authentication device for a DHCP relay device 200 according to an embodiment of the present invention. It should be noted that the basic principles and technical effects of the access authentication device provided in this embodiment are the same as those of the aforementioned embodiments. For the sake of brevity, any details not mentioned in this embodiment are referred to the corresponding contents of the aforementioned embodiments. The access authentication device includes a first transceiver module 710 and a second transceiver module 720.

[0099] The first transceiver module 710 is configured to receive a DHCP request message sent by a terminal and obtain an access port VLAN of the terminal.

[0100] The second transceiver module 720 is configured to, if the access port VLAN of the terminal is the default VLAN, add the VRF information corresponding to the default VLAN to the DHCP relay request message generated based on the DHCP request message, and send the DHCP relay request message carrying the VRF information corresponding to the default VLAN to the SDN controller, so that the SDN controller allocates an IP address to the terminal from the address pool corresponding to the default VLAN according to the VRF information corresponding to the default VLAN in the DHCP relay request message.

[0101] The second transceiver module 720 is further configured to receive an IP address allocated by the SDN controller.

[0102] The first transceiver module 710 is further configured to return the IP address allocated by the SDN controller to the terminal.

[0103] Optionally, the second transceiver module 720 is further used to add VRF information corresponding to the authorized VLAN to a DHCP relay request message generated based on the DHCP request message if the access port VLAN of the terminal is an authorized VLAN, and send the DHCP relay request message carrying the VRF information corresponding to the authorized VLAN to the SDN controller, so that the SDN controller allocates an IP address to the terminal from the address pool corresponding to the authorized VLAN according to the VRF information corresponding to the authorized VLAN in the DHCP relay request message; the second transceiver module 720 is further used to receive the IP address allocated by the SDN controller, and the first transceiver module 710 is further used to return the IP address allocated by the SDN controller to the terminal.

[0104] Please refer to Figure 8 , a block diagram of an electronic device that can implement the aforementioned SDN controller 100 and DHCP relay device 200, provided in an embodiment of the present invention. The electronic device includes a memory 110, a processor 120, and a communication module 130. The memory 110, processor 120, and communication module 130 are electrically connected to each other, directly or indirectly, to enable data transmission or interaction. For example, these components can be electrically connected to each other via one or more communication buses or signal lines.

[0105] Memory 110 is used to store programs or data. Memory 110 may be, but is not limited to, random access memory (RAM), read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), etc.

[0106] The processor 120 is used to read / write data or programs stored in the memory 110 and execute corresponding functions. For example, when the computer program stored in the memory 110 is executed by the processor 120, the access authentication method disclosed in the above embodiments can be implemented.

[0107] The communication module 130 is used to establish a communication connection between the electronic device and other devices through a network, and to send and receive data through the network.

[0108] It should be understood that Figure 8 The structure shown is only a schematic diagram of the structure of the electronic device. The electronic device may also include Figure 8 More or fewer components than shown, or with Figure 8 Different configurations shown. Figure 8 Each component shown in the figure can be implemented by hardware, software or a combination thereof.

[0109] An embodiment of the present invention further provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by the processor 120, the access authentication method disclosed in the above embodiments is implemented.

[0110] In summary, the access authentication method, device, system, electronic device and storage medium provided by the embodiments of the present invention configure an address pool corresponding to the default VLAN and an address pool corresponding to the authorized VLAN on the SDN controller, the IP address range and gateway address of the two address pools are the same, and the two address pools are associated with different VRF information. The SDN controller receives a DHCP relay request message sent by a DHCP relay device based on a DHCP request message of a terminal, the DHCP relay request message carries the VRF information corresponding to the access port VLAN of the terminal, when the address pool associated with the VRF information corresponding to the access port VLAN of the terminal is the address pool corresponding to the default VLAN, the SDN controller can allocate an IP address to the terminal from the address pool corresponding to the default VLAN, authenticate the terminal after obtaining the IP address, configure the access port VLAN of the terminal after successful authentication as the authorized VLAN, and synchronize the IP address allocated to the terminal in the address pool corresponding to the default VLAN to the allocation list of the address pool corresponding to the authorized VLAN. In this way, after the terminal is successfully authenticated, it can directly use the IP address obtained before authentication to communicate in the authorized VLAN after successful authentication, without having to wait for the terminal to renew its lease or manually trigger the terminal to re-acquire the IP address in the authorized VLAN before communication can be achieved. This effectively avoids the problem of network inaccessibility caused by the IP address obtained before the terminal authentication not matching the authorized VLAN after successful authentication. In the existing solution, after the terminal is successfully authenticated, it cannot directly use the IP address assigned before authentication for communication, and it is necessary to re-acquire the IP address. There is at least a situation where the network is disconnected or unavailable in seconds. However, by adopting the access authentication scheme of the present invention, the network is immediately available after VLAN authorization in the Portal authentication scenario, and the user does not perceive the VLAN change.

[0111] In the several embodiments provided in this application, it should be understood that the disclosed devices and methods can also be implemented in other ways. The device embodiments described above are merely illustrative. For example, the flowcharts and block diagrams in the accompanying drawings show the possible architectures, functions and operations of the devices, methods and computer program products according to multiple embodiments of the present invention. In this regard, each box in the flowchart or block diagram can represent a module, a program segment or a portion of code, and the module, program segment or a portion of code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in an order different from that marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, and the combination of boxes in the block diagram and / or flowchart, can be implemented using a dedicated hardware-based system that performs the specified function or action, or can be implemented using a combination of dedicated hardware and computer instructions.

[0112] In addition, the functional modules in the various embodiments of the present invention may be integrated together to form an independent part, or each module may exist independently, or two or more modules may be integrated to form an independent part.

[0113] If the functions are implemented in the form of software function modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0114] The foregoing description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. Those skilled in the art will readily appreciate that various modifications and variations of the present invention are possible. Any modifications, equivalent substitutions, or improvements made within the spirit and principles of the present invention are intended to be within the scope of protection of the present invention.

Claims

1. An access authentication method, characterized in that: Applied to an SDN controller, the SDN controller is in communication with a DHCP relay device; the SDN controller is configured with an address pool corresponding to a default VLAN and an address pool corresponding to an authorized VLAN, the IP address range and gateway address of the address pool corresponding to the default VLAN and the address pool corresponding to the authorized VLAN are the same, and the address pool corresponding to the default VLAN and the address pool corresponding to the authorized VLAN are associated with different virtual routing forwarding (VRF) information; the method includes: receiving a DHCP relay request message sent by the DHCP relay device based on the DHCP request message of the terminal; the DHCP relay request message carries VRF information corresponding to the access port VLAN of the terminal; Query the address pool associated with the VRF information in the DHCP relay request message; If the address pool associated with the VRF information in the DHCP relay request message is the address pool corresponding to the default VLAN, allocating an IP address to the terminal from the address pool corresponding to the default VLAN and returning the allocated IP address to the terminal through the DHCP relay device; Authenticate the terminal after obtaining the IP address, configure the access port VLAN of the terminal after successful authentication as the authorized VLAN, and synchronize the IP address allocated to the terminal in the address pool corresponding to the default VLAN to the allocation list of the address pool corresponding to the authorized VLAN.

2. The access authentication method according to claim 1, wherein: The method further comprises: If the address pool associated with the VRF information in the DHCP relay request message is the address pool corresponding to the authorized VLAN, an IP address is allocated to the terminal from the address pool corresponding to the authorized VLAN and the allocated IP address is returned to the terminal through the DHCP relay device.

3. An access authentication method, characterized in that: The method is applied to a DHCP relay device, the DHCP relay device is in communication with an SDN controller, and the DHCP relay device records VRF information corresponding to a default VLAN and an authorized VLAN; the method includes: Acquire the access port VLAN of the terminal according to the DHCP request message sent by the terminal; If the access port VLAN of the terminal is the default VLAN, adding the VRF information corresponding to the default VLAN to a DHCP relay request message generated based on the DHCP request message, and sending the DHCP relay request message carrying the VRF information corresponding to the default VLAN to the SDN controller, so that the SDN controller allocates an IP address to the terminal from the address pool corresponding to the default VLAN according to the VRF information corresponding to the default VLAN in the DHCP relay request message; Receive the IP address assigned by the SDN controller and return it to the terminal, wherein the SDN controller authenticates the terminal after obtaining the IP address, configures the access port VLAN of the terminal after successful authentication as the authorized VLAN, and synchronizes the IP address assigned to the terminal in the address pool corresponding to the default VLAN to the allocation list of the address pool corresponding to the authorized VLAN.

4. The access authentication method according to claim 3, wherein: The method further comprises: If the access port VLAN of the terminal is the authorized VLAN, adding the VRF information corresponding to the authorized VLAN to a DHCP relay request message generated based on the DHCP request message, and sending the DHCP relay request message carrying the VRF information corresponding to the authorized VLAN to the SDN controller, so that the SDN controller allocates an IP address to the terminal from the address pool corresponding to the authorized VLAN according to the VRF information corresponding to the authorized VLAN in the DHCP relay request message; Receive the IP address assigned by the SDN controller and return it to the terminal.

5. An access authentication system, characterized in that: The invention comprises an SDN controller and a DHCP relay device, wherein the SDN controller is in communication with the DHCP relay device; the DHCP relay device records VRF information corresponding to the default VLAN and the authorized VLAN; the SDN controller is configured with an address pool corresponding to the default VLAN and an address pool corresponding to the authorized VLAN; the address pool corresponding to the default VLAN and the address pool corresponding to the authorized VLAN have the same IP address range and gateway address, and the address pool corresponding to the default VLAN and the address pool corresponding to the authorized VLAN are associated with different VRF information; The DHCP relay device is configured to obtain the access port VLAN of the terminal according to the DHCP request message sent by the terminal, and if the access port VLAN of the terminal is the default VLAN, add the VRF information corresponding to the default VLAN to the DHCP relay request message generated based on the DHCP request message, and send the DHCP relay request message carrying the VRF information corresponding to the default VLAN to the SDN controller; The SDN controller is configured to allocate an IP address to the terminal from the address pool corresponding to the default VLAN according to the VRF information corresponding to the default VLAN in the DHCP relay request message, return the allocated IP address to the terminal through the DHCP relay device, authenticate the terminal after obtaining the IP address, configure the access port VLAN of the terminal after successful authentication as the authorized VLAN, and synchronize the IP address allocated to the terminal in the address pool corresponding to the default VLAN to the allocation list of the address pool corresponding to the authorized VLAN.

6. The access authentication system according to claim 5, characterized in that: The DHCP relay device is further configured to, if the access port VLAN of the terminal is the authorized VLAN, add VRF information corresponding to the authorized VLAN to a DHCP relay request message generated based on the DHCP request message, and send the DHCP relay request message carrying the VRF information corresponding to the authorized VLAN to the SDN controller; The SDN controller is further configured to allocate an IP address to the terminal from the address pool corresponding to the authorized VLAN according to the VRF information corresponding to the authorized VLAN in the DHCP relay request message, and return the allocated IP address to the terminal through the DHCP relay device.

7. An access authentication device, characterized in that: Applied to an SDN controller, the SDN controller is communicatively connected to a DHCP relay device; the SDN controller is configured with an address pool corresponding to a default VLAN and an address pool corresponding to an authorized VLAN, the IP address range and gateway address of the address pool corresponding to the default VLAN and the address pool corresponding to the authorized VLAN are the same, and different VRF information is associated with the address pool corresponding to the default VLAN and the address pool corresponding to the authorized VLAN; the device comprises: a transceiver module, configured to receive a DHCP relay request message sent by the DHCP relay device based on the DHCP request message of the terminal; the DHCP relay request message carries VRF information corresponding to the access port VLAN of the terminal; a processing module, configured to query the address pool associated with the VRF information in the DHCP relay request message; if the address pool associated with the VRF information in the DHCP relay request message is the address pool corresponding to the default VLAN, allocating an IP address to the terminal from the address pool corresponding to the default VLAN; The transceiver module is further configured to return the allocated IP address to the terminal via the DHCP relay device; The processing module is further used to authenticate the terminal after obtaining the IP address, configure the access port VLAN of the terminal after successful authentication as the authorized VLAN, and synchronize the IP address allocated to the terminal in the address pool corresponding to the default VLAN to the allocation list of the address pool corresponding to the authorized VLAN.

8. An access authentication device, characterized in that: Applied to a DHCP relay device, the DHCP relay device is in communication with an SDN controller, and the DHCP relay device records VRF information corresponding to the default VLAN and the authorized VLAN; the device includes: The first transceiver module is used to receive a DHCP request message sent by a terminal and obtain an access port VLAN of the terminal; a second transceiver module, configured to, if the access port VLAN of the terminal is the default VLAN, add VRF information corresponding to the default VLAN to a DHCP relay request message generated based on the DHCP request message, and send the DHCP relay request message carrying the VRF information corresponding to the default VLAN to the SDN controller, so that the SDN controller allocates an IP address to the terminal from an address pool corresponding to the default VLAN according to the VRF information corresponding to the default VLAN in the DHCP relay request message; The second transceiver module is further configured to receive an IP address assigned by the SDN controller; The first transceiver module is further configured to return the IP address assigned by the SDN controller to the terminal, wherein the SDN controller authenticates the terminal after obtaining the IP address, configures the access port VLAN of the terminal after successful authentication as the authorized VLAN, and synchronizes the IP address assigned to the terminal in the address pool corresponding to the default VLAN to the allocation list of the address pool corresponding to the authorized VLAN.

9. An electronic device, characterized in that: The method comprises a processor, a memory, and a computer program stored in the memory and executable on the processor, wherein when the computer program is executed by the processor, the steps of the access authentication method according to any one of claims 1 to 4 are implemented.

10. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the access authentication method according to any one of claims 1 to 4 are implemented.

Images