Wireless local area network access control method and related device

Abstract

The invention discloses a wireless local area network access control method and a related device, and belongs to the technical field of wireless local area network communication, and the method comprises the following steps: a special authentication network authenticates a terminal, and after the authentication succeeds, an authentication server issues an executable script or a two-dimensional code required by authentication of an access service network to the terminal; and the terminal sends a detection frame for detecting the service network, and the service network hiding the SSID responds to the detection frame of the successfully authenticated terminal, so that an authentication request of the terminal accessing the service network is forwarded to the authentication server for secondary authentication. The special authentication network only performs identity authentication on the terminal, and the service network which is configured with the hidden SSID and performs service data communication only responds to the terminal passing the identity authentication, so that the risk of exposure of the service network can be avoided; the service network is accessed in a mode of automatically executing the script or scanning the two-dimensional code, so that a user does not perceive, and the password leakage risk can be effectively prevented.

Description

Technical Field

[0001] The present invention relates to the technical field of wireless local area network communication, and in particular to a wireless local area network access control method and related devices. Background Art

[0002] When deploying a wireless LAN, the security of the wireless network and the convenience of access are usually considered. In order to meet these requirements, enterprises deploy multiple wireless networks for different user groups and use different authentication methods for different wireless networks. Internal employees generally use key authentication, such as pre-shared key (PSK) authentication; visitors generally use key authentication or portal authentication. In this deployment method, since the wireless network is an open network, all terminals in the environment can scan the wireless network, resulting in the terminals in the environment being able to perceive wireless networks with different purposes. The network exposure is at risk of being attacked. To address this problem, the current solution in the industry is to configure the name of the hidden wireless network, that is, to hide the service set identifier (SSID). After the configuration, the wireless network does not broadcast, so that the terminals in the environment cannot perceive the existence of the wireless network. However, after configuring the hidden SSID operation, it is necessary to manually create and configure the relevant wireless network connection on the terminal. The operation process requires the operator to know the network name, password and other information. The operation is cumbersome and there is still a risk of network exposure and password leakage. Summary of the invention

[0003] The purpose of the present invention is to overcome the problems of the prior art and provide a wireless local area network access control method and related devices.

[0004] The object of the present invention is to achieve the following technical solution: a wireless local area network access control method, applied to a wireless access point, the method comprising the following steps:

[0005] Receive an authentication request initiated by a terminal to access a dedicated authentication network, and forward it to a wireless controller; configure a dedicated authentication network and a service network on the wireless controller and send them to all wireless access points, wherein the dedicated authentication network is only used for authentication of terminal access to a wireless network;

[0006] Forward the confirmation information of successful authentication sent by the wireless controller from the authentication server to the terminal; the confirmation information is an executable script or a two-dimensional code required for access to the service network authentication, and the executable script or the two-dimensional code is generated based on the service network information to which the terminal belongs, the authentication method and the random key; the service network is a wireless network configured on the wireless access point for service data communication and hiding the service set identifier, and only responds to the detection frame of the terminal that has successfully authenticated the dedicated authentication network;

[0007] Receiving a detection frame sent by the terminal to detect the service network and responding;

[0008] The receiving terminal initiates an authentication request for accessing the service network according to the executable script or the QR code, and forwards the authentication request to the authentication server via the wireless controller for secondary authentication.

[0009] In one example, after the step of forwarding the authentication success confirmation information sent by the wireless controller from the authentication server to the terminal, the method further includes:

[0010] The authentication information of the terminal generated by the authentication server and forwarded by the wireless controller is received and stored in the authenticated terminal list, wherein the authentication information includes the MAC address of the authenticated terminal.

[0011] In an example, the receiving a detection frame sent by the terminal to detect the service network and responding specifically includes:

[0012] Determine whether the current terminal is in the authenticated terminal list according to the terminal's MAC address in the detection frame. If so, respond to the detection frame sent by the terminal to detect the service network; otherwise, do not respond to the detection frame sent by the terminal to detect the service network.

[0013] It should be further explained that the technical features corresponding to the above-mentioned embodiments can be combined or replaced with each other to form a new technical solution.

[0014] The present invention also includes a wireless access point, which is used to execute the steps of the wireless local area network access control method formed by any one embodiment or a combination of multiple embodiments using the wireless access point as the execution subject.

[0015] A wireless local area network access control method is applied to a wireless controller, and the method comprises the following steps:

[0016] Distribute the configured dedicated authentication network and business network to all wireless access points;

[0017] Receive an authentication request for accessing a dedicated authentication network initiated by a terminal forwarded by any wireless access point, and forward the authentication request to an authentication server for access authentication, wherein the dedicated authentication network is only used for authentication of terminal access to a wireless network;

[0018] Forwarding confirmation information of successful authentication to any of the wireless access points, and then forwarding the confirmation information of successful authentication to the terminal through any of the wireless access points; the confirmation information is an executable script or a QR code required for access to the service network authentication, and the executable script or QR code is generated based on the service network information to which the terminal belongs, the authentication method, and a random key; the service network is a wireless network configured on the wireless access point for service data communication and with a hidden service set identifier, and only responds to the detection frame of the terminal that has successfully authenticated the dedicated authentication network;

[0019] The authentication request for accessing the service network initiated by the terminal according to the executable script or the QR code and forwarded by any wireless access point is received, and sent to the authentication server for secondary authentication.

[0020] In one example, after the step of forwarding the confirmation information of successful authentication to any one of the wireless access points, the method further includes:

[0021] Authentication information of a terminal generated by an authentication server is received and sent to any one of the wireless access points, wherein the authentication information includes a MAC address of the authenticated terminal.

[0022] It should be further explained that the technical features corresponding to the above-mentioned embodiments can be combined or replaced with each other to form a new technical solution.

[0023] The present invention also includes a wireless controller for executing the steps of the wireless local area network access control method formed by any one embodiment or a combination of multiple embodiments using the wireless controller as the execution subject.

[0024] A wireless local area network access control method, characterized in that the method comprises the following steps:

[0025] A dedicated authentication network and a service network are configured on the wireless controller and sent to all wireless access points. The dedicated authentication network is only used for authentication of terminal access to the wireless network. The service network is a wireless network configured on the wireless access point for service data communication and with a hidden service set identifier. The service network only responds to detection frames of terminals that have successfully authenticated the dedicated authentication network.

[0026] The terminal initiates a first authentication request for accessing a dedicated authentication network to the wireless access point to which it is accessed; the wireless access point receives the first authentication request and forwards it to the wireless controller;

[0027] The wireless controller receives the first authentication request forwarded by the wireless access point, and forwards the first authentication request to the authentication server for access authentication; the authentication server performs access authentication on the terminal according to the first authentication request, and returns confirmation information of successful authentication; the wireless controller forwards the confirmation information to the wireless access point; the confirmation information is an executable script or a QR code required for access service network authentication, and the executable script or the QR code is generated based on the service network information to which the terminal belongs, the authentication method, and the random key;

[0028] The wireless access point forwards the confirmation information to the terminal; the terminal sends a detection frame for detecting the service network; the wireless access point receives the detection frame and responds; the terminal initiates a second authentication request for accessing the service network according to an executable script or a QR code; the wireless access point receives the second authentication request and forwards it to the wireless controller; the wireless controller receives the second authentication request and sends it to the authentication server for secondary authentication.

[0029] The present invention also includes a storage medium storing computer instructions, which, when executed, execute the steps of the wireless local area network access control method formed by any one embodiment or a combination of multiple embodiments using a wireless access point or a wireless controller as the execution subject.

[0030] The present invention also includes a network communication device, including a memory and a processor, wherein the memory stores computer instructions that can be executed on the processor, and when the processor executes the computer instructions, the steps of the wireless local area network access control method formed by any one of the above embodiments or a combination of multiple embodiments are executed.

[0031] Compared with the prior art, the present invention has the following beneficial effects:

[0032] A dedicated authentication network that does not require business data communication only performs identity authentication on terminals. A business network that is configured with a hidden SSID and performs business data communication only responds to terminals that have passed identity authentication, which can avoid the risk of business network exposure. A script or QR code for accessing the business network is generated based on random passwords and other information. The business network is accessed by automatically executing the script or scanning the QR code without the user's awareness. This can effectively prevent the risk of password leakage and improve the user experience. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] The specific implementation methods of the present invention are further described in detail below in conjunction with the accompanying drawings. The accompanying drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The same reference numerals are used in these drawings to represent the same or similar parts. The schematic embodiments of the present application and their descriptions are used to explain the present application and do not constitute improper limitations on the present application.

[0034] Figure 1 A flow chart of a method applied to a wireless access point provided by an embodiment of the present invention;

[0035] Figure 2 A diagram of a dedicated authentication network architecture provided by an embodiment of the present invention;

[0036] Figure 3 A flow chart of a method applied to a wireless controller provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0037] The technical solution of the present invention is described clearly and completely below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0038] In the description of the present invention, it should be noted that, unless otherwise clearly specified and limited, "connected" and "connection" should be understood in a broad sense, for example, it can be directly connected, or indirectly connected through an intermediate medium, or it can be the internal connection of two components. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0039] In addition, the technical features involved in the different embodiments of the present invention described below can be combined with each other as long as they do not conflict with each other.

[0040] In one embodiment, if Figure 1 As shown, a wireless local area network access control method is applied to a wireless access point, and the method includes the following steps:

[0041] S10: receiving an authentication request initiated by a terminal for accessing a dedicated authentication network, and forwarding it to a wireless controller; configuring a dedicated authentication network and a service network on the wireless controller and sending them to all wireless access points, wherein the dedicated authentication network is only used for authentication of terminal access to a wireless network.

[0042] like Figure 2As shown, the dedicated authentication network includes an authentication server AAA, a wireless controller (Wireless Access Point Controller, AC for short), and multiple wireless access points (Wireless Access Point, AP for short). The authentication server AAA is connected to the AC. Optionally, the authentication server AAA and the AC can be the same device. The AC is connected to multiple APs, and the terminal (Station, STA for short) communicates with the AP. The dedicated authentication network is broadcast externally, and all terminals can scan and discover the dedicated authentication network. The dedicated authentication network is not connected to any business network and is only used for terminal access authentication. The authentication method deployed by the dedicated authentication network can be PSK authentication, Portal authentication, or a combination of the two. Of course, PSK authentication can also be replaced by PPSK authentication. In this embodiment, the authentication method of the dedicated authentication network is preferably PSK authentication + Portal authentication, wherein PSK authentication is used to encrypt air interface data to avoid leakage of user data through air interface packet capture, and Portal authentication is used for identity authentication and business network attribution confirmation. When deploying a dedicated authentication network, configure the wireless network as a dedicated network for access authentication on the AC, set the network authentication mode to PSK+Portal, set the PSK password and Portal server, and send the configuration to the APs managed by the AC to take effect. When a terminal accesses the dedicated authentication network marked as access authentication, the AP only allows the traffic from the terminal to the Portal server and blocks other traffic.

[0043] In this step, the AP receives the authentication request initiated by the terminal to access the dedicated authentication network, and forwards it to the authentication server through the AC for PSK authentication and Portal authentication. After the authentication server passes the authentication, it sends the confirmation information of successful authentication to the AC.

[0044] S20: forwarding the confirmation information of successful authentication sent by the wireless controller from the authentication server to the terminal; the confirmation information is an executable script or a QR code required for access to the service network authentication, and the executable script or the QR code is generated based on the service network information to which the terminal belongs, the authentication method and the random key; the service network is a wireless network configured on the wireless access point for service data communication and hiding the service set identifier, and only responds to the detection frame of the terminal that has successfully authenticated the dedicated authentication network.

[0045] Among them, the service network is a wireless network provided to the terminal for wireless data communication. It is the same as the dedicated authentication network architecture, and also includes an authentication server AAA, a wireless controller AC, and multiple wireless access points AP. In this embodiment, the dedicated authentication network and the service network are preferably configured through the AC to achieve isolation of the two networks. Of course, the service network and the dedicated authentication network can also be isolated using different network communication devices (AC, AP, etc.). In this embodiment, the service network is configured on the AC to use PPSK password deployment to ensure the security of access. Of course, the service network can also be configured to use PSK password deployment. At the same time, the service network is configured on the AC to hide the SSID and the service network does not respond to active scanning for unauthenticated terminals. Finally, the AC sends the relevant configuration to the AP to take effect, so that the AP only responds to the detection frame initiated by the terminal that has successfully authenticated the dedicated authentication network to detect the service network.

[0046] Different service networks have different network access rights. Multiple service networks can be deployed as needed. For example, service network A is deployed for intranet services, and service network B is deployed for extranet services. Different terminals need to be assigned to the corresponding service networks after being successfully authenticated by the dedicated authentication network. The authentication request initiated by the terminal is finally forwarded to the authentication server for identity authentication. The authentication server determines the service network information of the terminal based on the identity information of the terminal, that is, the binding relationship between the terminal and the service network. For example, terminal A is bound to service network A, and terminal B is bound to service network B. Of course, the terminal and the service network can also be bound according to other rules and policies, such as SMS authentication to bind the terminal to a certain service network. While the authentication server determines the service network information of the terminal based on the identity information of the terminal, it generates a random key for the terminal authenticated by the dedicated authentication network, combines the authentication method (PPSK authentication) deployed by the service network, and generates the executable script or QR code required for access to the service network authentication, and sends it to the AC. The AC forwards the executable script or QR code required for access to the service network authentication to the AP.

[0047] S30: Receive a detection frame sent by the terminal to detect the service network and respond.

[0048] In this step, the AP will not actively respond to the detection frames initiated by the terminals that have not been successfully authenticated by the dedicated authentication network, but will only respond to the detection frames of the terminals that have been authenticated by the dedicated authentication network, so that only the terminals that have been successfully authenticated can perceive the service network, thereby avoiding exposure of the service network.

[0049] S40: The receiving terminal initiates an executable script or a QR code for accessing the service network according to the executable script or the QR code, and forwards the executable script or the QR code to the authentication server via the wireless controller for secondary authentication.

[0050] In this step, the authentication server receives the executable script or QR code forwarded by the AC to perform secondary authentication on the terminal to access the service network. Since the executable script or QR code is generated by the authentication server and finally sent to the terminal, the secondary authentication can pass, and the terminal can access the service network with hidden SSID and conduct service data communication.

[0051] In one embodiment, the executable script or QR code is generated based on a temporary random key with a validity period, an authentication method, and information about the service network to which the terminal belongs. When the random key expires, the terminal needs to be authenticated again by a dedicated authentication network to obtain a new random password and then re-access the service network. That is, when the random key expires, the AP needs to re-execute steps S10-S40. In this embodiment, the random password is a temporary random key with a validity period, which will become invalid after expiration, thereby reducing the risk of password cracking to a certain extent.

[0052] In one embodiment, after the step of the AP forwarding the authentication success confirmation information sent by the wireless controller from the authentication server to the terminal, the method further includes:

[0053] The authentication information of the terminal generated by the authentication server and forwarded by the wireless controller is received and stored in the authenticated terminal list, wherein the authentication information includes the MAC address of the authenticated terminal.

[0054] In this embodiment, after the terminal is successfully authenticated by the dedicated authentication network, the authentication server generates a MAC address of the authenticated terminal, that is, after the terminal is successfully authenticated by the dedicated authentication network, the authentication server generates a random password with an effective period for the terminal to access the service network, the terminal MAC address, and the service network information to which the terminal belongs. At the same time, the authentication server generates an executable script or QR code required for the terminal to perform secondary authentication based on the random password, the authentication method of the service network, and the service network information to which the terminal belongs, and sends the executable script or QR code and the terminal MAC address to the AC, which forwards the executable script or QR code and the terminal MAC address to the AP.

[0055] In one embodiment, the receiving and responding to a detection frame sent by the terminal for detecting the service network specifically includes:

[0056] Determine whether the current terminal is in the list of authenticated terminals based on the MAC address of the terminal in the detection frame. If so, the terminal has been successfully authenticated on the dedicated authentication network, and the AP responds to the detection frame sent by the terminal to detect the service network; otherwise, it does not respond to the detection frame sent by the terminal to detect the service network.

[0057] In this embodiment, if the random password generated by the authentication server is a temporary random password with an expiration date, when the validity period of the random password expires, the terminal needs to be authenticated again through the dedicated authentication network to obtain a new random password. Before the dedicated authentication network is successfully authenticated, when the terminal accesses the service network again, since the terminal is no longer in the list of authenticated terminals, the AP no longer responds to the active detection message sent by the terminal. The terminal cannot sense the existence of the service network and cannot access the service network.

[0058] The present invention also includes a wireless access point, which is used to execute the steps of the wireless local area network access control method formed by any one embodiment or a combination of multiple embodiments using the wireless access point as the execution subject.

[0059] The present invention provides a wireless local area network access control method, which is applied to a wireless controller, such as Figure 3 As shown, the method comprises the following steps:

[0060] S100: Send the configured dedicated authentication network and business network to all wireless access points.

[0061] The dedicated authentication network includes an authentication server AAA, a wireless controller AC, and multiple wireless access points AP. The authentication server AAA is connected to the AC. Optionally, the authentication server AAA and the AC can be the same device. The AC is connected to multiple APs, and the terminal STA communicates with the AP. The AP broadcasts the dedicated authentication network to the outside world, and all terminals can scan and discover the dedicated authentication network. The dedicated authentication network is not connected to any business network and is only used for terminal access authentication. The business network is a wireless network provided to the terminal for wireless data communication. In this embodiment, the dedicated authentication network and the business network are preferably configured through the AC to achieve isolation of the two networks.

[0062] S200: receiving an authentication request for accessing a dedicated authentication network initiated by a terminal and forwarded by any wireless access point, and forwarding the authentication request to an authentication server for access authentication, wherein the dedicated authentication network is only used for authentication of terminal access to a wireless network.

[0063] The authentication method for the dedicated authentication network deployment can be PSK authentication, Portal authentication, or a combination of the two. Of course, PSK authentication can also be replaced with PPSK authentication. In this embodiment, the authentication method of the dedicated authentication network is preferably PSK authentication + Portal authentication, where PSK authentication is used to encrypt air interface data to avoid leakage of user data through air interface packet capture, and Portal authentication is used for identity authentication and service network affiliation confirmation. When deploying a dedicated authentication network, configure the wireless network as a dedicated network for access authentication on the AC, set the network authentication method to PSK + Portal mode, set the PSK password and Portal server, and send the configuration to the AP managed by the AC to take effect. After any AP, such as AP-1, opens a dedicated authentication network, when a wireless terminal enters the signal coverage area of ​​the wireless LAN, AP-1 will receive the authentication request initiated by the terminal to access the dedicated authentication network. After the AC receives the authentication request initiated by the terminal to access the dedicated authentication network forwarded by AP-1, it forwards the authentication request to the authentication server for access authentication. When the authentication server receives the authentication request initiated by the terminal and forwarded by the AC and carrying PSK authentication information and Portal authentication information, it performs PSK authentication and Portal authentication. After the authentication is successful, the confirmation information of the successful authentication is sent to the AC.

[0064] S300: forwarding confirmation information of successful authentication to any of the wireless access points, and then forwarding the confirmation information of successful authentication to the terminal through any of the wireless access points; the confirmation information is an executable script or a QR code required for access to the service network authentication, and the executable script or the QR code is generated based on the service network information to which the terminal belongs, the authentication method, and the random key; the service network is a wireless network configured on the wireless access point for service data communication and with a hidden service set identifier, and only responds to the detection frame of the terminal that has successfully authenticated the dedicated authentication network.

[0065] In this embodiment, the service network is configured on the AC to use PPSK password deployment to ensure the security of access. Of course, the service network can also be configured to use PSK password deployment. At the same time, the service network is configured on the AC to hide the SSID and the service network does not respond to active scanning for unauthenticated terminals. Finally, the AC sends the relevant configuration to the AP to take effect, so that the AP only responds to the detection frame of the service network initiated by the terminal that has successfully authenticated the dedicated authentication network. Further, different service networks have different network access rights. Multiple service networks can be deployed as needed, such as service network A for intranet services and service network B for extranet services. After different terminals are successfully authenticated by the dedicated authentication network, they need to be assigned to the corresponding service network. The authentication request initiated by the terminal is finally forwarded to the authentication server for identity authentication. The authentication server determines the service network information to which the terminal belongs based on the identity information of the terminal, that is, the binding relationship between the terminal and the service network, such as terminal A is bound to service network A, and terminal B is bound to service network B. Of course, the terminal and the service network can also be bound according to other rules and policies, such as SMS authentication to bind the terminal to a certain service network. The authentication server determines the service network information to which the terminal belongs based on the identity information of the terminal, and generates a random key for the terminal authenticated by the dedicated authentication network. It combines the authentication method (PPSK authentication) deployed in the service network and the service network information to which the terminal belongs to generate the executable script or QR code required for access to the service network authentication, and sends it to the AC. The AC forwards the executable script or QR code required for access to the service network authentication to the AP. Continuing with the example of AP-1, AP-1 forwards the executable script or QR code to the terminal.

[0066] S400: receiving an authentication request for accessing the service network initiated by the terminal according to an executable script or a QR code and forwarded by any wireless access point, and sending the request to an authentication server for secondary authentication.

[0067] In this step, continuing with AP-1 as an example, the AC receives the authentication request for accessing the service network initiated by the terminal according to the executable script or QR code forwarded by AP-1, and forwards it to the authentication server. The authentication server receives the executable script or QR code forwarded by the AC and performs secondary authentication on the terminal for accessing the service network. Since the executable script or QR code is generated by the authentication server and finally sent to the terminal, the secondary authentication can pass, and the terminal can access the service network with the hidden SSID for service data communication.

[0068] In one embodiment, the executable script or QR code is generated based on a temporary random key with a validity period, an authentication method, and information about the service network to which the terminal belongs. When the random key expires, the terminal needs to be authenticated again by a dedicated authentication network to obtain a new random password and then re-access the service network. That is, when the random key expires, the AC needs to re-execute steps S100-S400. In this embodiment, the random password is a temporary random key with a validity period, which will become invalid after expiration, thereby reducing the risk of password cracking to a certain extent.

[0069] In one embodiment, after the step of forwarding the confirmation information of successful authentication to any wireless access point by the AC, the method further includes:

[0070] Authentication information of a terminal generated by an authentication server is received and sent to any one of the wireless access points, wherein the authentication information includes a MAC address of the authenticated terminal.

[0071] In this embodiment, after the terminal is successfully authenticated by the dedicated authentication network, the authentication server generates a MAC address of the authenticated terminal, that is, after the terminal is successfully authenticated by the dedicated authentication network, the authentication server generates a random password with an effective period for the terminal to access the service network, the terminal MAC address, and the service network information to which the terminal belongs. At the same time, the authentication server generates an executable script or QR code required for the terminal to perform secondary authentication based on the random password, the authentication method of the service network, and the service network information to which the terminal belongs, and sends the executable script or QR code and the terminal MAC address to the AC, which forwards the executable script or QR code and the terminal MAC address to the AP.

[0072] The present invention also includes a wireless controller for executing the steps of the wireless local area network access control method formed by any one embodiment or a combination of multiple embodiments using the wireless controller as the execution subject.

[0073] The present invention provides a wireless local area network access control method, which is applied to network communication equipment, including AP, AC, authentication server, and terminal. The method comprises the following steps:

[0074] S1: The wireless controller configures a dedicated authentication network and a service network and sends them to all wireless access points. The dedicated authentication network is only used for authentication of terminal access to the wireless network. The service network is a wireless network configured on the wireless access point for service data communication and with a hidden service set identifier. The wireless controller only responds to detection frames of terminals that have successfully authenticated the dedicated authentication network.

[0075] S2: The terminal initiates a first authentication request to the wireless access point to access the dedicated authentication network;

[0076] S3: The wireless access point receives the first authentication request and forwards it to the wireless controller;

[0077] S4: The wireless controller receives the first authentication request forwarded by the wireless access point, and forwards the first authentication request to the authentication server for access authentication;

[0078] S5: The authentication server performs access authentication on the terminal according to the first authentication request, and returns confirmation information of successful authentication to the wireless controller; the confirmation information is an executable script or a QR code required for access service network authentication, and the executable script or QR code is generated based on the service network information to which the terminal belongs, the authentication method, and the random key;

[0079] S6: The wireless controller receives and forwards the confirmation information to the wireless access point;

[0080] S7: The wireless access point forwards the confirmation information to the terminal;

[0081] S8: the terminal sends a detection frame for detecting the service network;

[0082] S9: The wireless access point receives the detection frame and responds;

[0083] S10: The terminal initiates a second authentication request for accessing the service network according to the executable script or the QR code;

[0084] S11: The wireless access point receives the second authentication request and forwards it to the wireless controller;

[0085] S12: The wireless controller receives the second authentication request and sends it to the authentication server;

[0086] S13: The authentication server performs secondary authentication. If the secondary authentication succeeds, the terminal is allowed to access the service network.

[0087] The present invention also provides a storage medium, which has the same inventive concept as the wireless local area network access control method formed by any one of the embodiments or a combination of multiple embodiments using a wireless access point or a wireless controller as the execution subject, and stores computer instructions thereon, which, when executed, execute the steps of the wireless local area network access control method formed by any one of the embodiments or a combination of multiple embodiments using a wireless access point or a wireless controller as the execution subject.

[0088] Based on such understanding, the technical solution of this embodiment, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present invention with a wireless access point or a wireless controller as the execution subject. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk, etc., various media that can store program codes.

[0089] The present invention also provides a network communication device, which has the same inventive concept as the corresponding embodiment formed by executing any one of the above examples or a combination of multiple examples, including a memory and a processor, the memory stores computer instructions that can be run on the processor, and the processor executes the steps of the wireless local area network access control method formed by any one of the above examples or a combination of multiple examples when running the computer instructions. The processor can be a single-core or multi-core central processing unit or a specific integrated circuit, or one or more integrated circuits configured to implement the present invention.

[0090] In one embodiment, the network communication device, i.e., the electronic device, is presented in the form of a general-purpose computing device, and the components of the electronic device may include but are not limited to: at least one processing unit (processor) mentioned above, at least one storage unit mentioned above, and a bus connecting different system components (including storage units and processing units).

[0091] The storage unit stores a program code, and the program code can be executed by the processing unit, so that the processing unit executes the steps of various exemplary implementations of the present invention described in the above "Exemplary Methods" section of this specification. For example, the processing unit executes a wireless local area network access control method formed by any one of the above examples or a combination of multiple examples.

[0092] The storage unit may include a readable medium in the form of a volatile storage unit, such as a random access memory unit (RAM) 3201 and / or a cache memory unit, and may further include a read-only memory unit (ROM).

[0093] The storage unit may also include a program / utility having a set (at least one) of program modules, such program modules including but not limited to: an operating system, one or more application programs, other program modules and program data, each of these embodiments or some combination may include the implementation of a network environment.

[0094] The bus may represent one or more of several types of bus structures, including a memory unit bus or memory unit controller, a peripheral bus, an accelerated graphics port, a processing unit, or a local bus using any of a variety of bus architectures.

[0095] The electronic device may also communicate with one or more external devices (e.g., keyboards, pointing devices, Bluetooth devices, etc.), may communicate with one or more devices that enable a user to interact with the electronic device, and / or may communicate with any device that enables the electronic device to communicate with one or more other computing devices (e.g., routers, modems, etc.). Such communication may be performed through an input / output (I / O) interface. Furthermore, the electronic device may also communicate with one or more networks (e.g., local area networks (LANs), wide area networks (WANs), and / or public networks, such as the Internet) through a network adapter. The network adapter communicates with other modules of the electronic device through a bus. It should be understood that other hardware and / or software modules may be used in conjunction with the electronic device, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems, etc.

[0096] Through the above description, it is easy for those skilled in the art to understand that the embodiments described here can be implemented by software or by combining software with necessary hardware. Therefore, the technical solution according to this embodiment can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, and includes several instructions to enable a computing device (which can be a personal computer, a server, a network communication device, or a network device, etc.) to execute the method of the embodiment of the present application.

[0097] The above specific implementation methods are detailed descriptions of the present invention. It cannot be determined that the specific implementation methods of the present invention are limited to these descriptions. For ordinary technicians in the technical field to which the present invention belongs, several simple deductions and substitutions can be made without departing from the concept of the present invention, which should be regarded as belonging to the protection scope of the present invention.

Claims

1. A wireless local area network access control method, characterized in that: Applied to a wireless access point, the method comprises the following steps: Receive an authentication request initiated by a terminal to access a dedicated authentication network, and forward it to a wireless controller; configure a dedicated authentication network and a service network on the wireless controller and send them to all wireless access points, wherein the dedicated authentication network is only used for authentication of terminal access to a wireless network; Forward the confirmation information of successful authentication sent by the wireless controller from the authentication server to the terminal; the confirmation information is an executable script or a two-dimensional code required for access to the service network authentication, and the executable script or the two-dimensional code is generated based on the service network information to which the terminal belongs, the authentication method and the random key; the service network is a wireless network configured on the wireless access point for service data communication and hiding the service set identifier, and only responds to the detection frame of the terminal that has successfully authenticated the dedicated authentication network; Receiving a detection frame sent by the terminal to detect the service network and responding; The receiving terminal initiates an authentication request for accessing the service network according to the executable script or the QR code, and forwards the authentication request to the authentication server via the wireless controller for secondary authentication.

2. The wireless local area network access control method according to claim 1, characterized in that: After the step of forwarding the authentication success confirmation information sent by the wireless controller from the authentication server to the terminal, the method further includes: The authentication information of the terminal generated by the authentication server and forwarded by the wireless controller is received and stored in the authenticated terminal list, wherein the authentication information includes the MAC address of the authenticated terminal.

3. The wireless local area network access control method according to claim 2, characterized in that: The receiving a detection frame sent by the terminal for detecting the service network and responding thereto specifically includes: Determine whether the current terminal is in the authenticated terminal list according to the terminal's MAC address in the detection frame. If so, respond to the detection frame sent by the terminal to detect the service network; otherwise, do not respond to the detection frame sent by the terminal to detect the service network.

4. A wireless local area network access control method, characterized in that: Applied to a wireless controller, the method comprises the following steps: Distribute the configured dedicated authentication network and business network to all wireless access points; Receive an authentication request for accessing a dedicated authentication network initiated by a terminal forwarded by any wireless access point, and forward the authentication request to an authentication server for access authentication, wherein the dedicated authentication network is only used for authentication of terminal access to a wireless network; Forwarding confirmation information of successful authentication to any of the wireless access points, and then forwarding the confirmation information of successful authentication to the terminal through any of the wireless access points; the confirmation information is an executable script or a QR code required for access to the service network authentication, and the executable script or QR code is generated based on the service network information to which the terminal belongs, the authentication method, and a random key; the service network is a wireless network configured on the wireless access point for service data communication and with a hidden service set identifier, and only responds to the detection frame of the terminal that has successfully authenticated the dedicated authentication network; The authentication request for accessing the service network initiated by the terminal according to the executable script or the QR code and forwarded by any wireless access point is received, and sent to the authentication server for secondary authentication.

5. The wireless local area network access control method according to claim 4, characterized in that: After the step of forwarding the confirmation information of successful authentication to any one of the wireless access points, the method further includes: Authentication information of a terminal generated by an authentication server is received and sent to any one of the wireless access points, wherein the authentication information includes a MAC address of the authenticated terminal.

6. A wireless local area network access control method, characterized in that: The method comprises the following steps: A dedicated authentication network and a service network are configured on the wireless controller and sent to all wireless access points. The dedicated authentication network is only used for authentication of terminal access to the wireless network. The service network is a wireless network configured on the wireless access point for service data communication and with a hidden service set identifier. The service network only responds to detection frames of terminals that have successfully authenticated the dedicated authentication network. The terminal initiates a first authentication request for accessing a dedicated authentication network to the wireless access point to which it is accessed; the wireless access point receives the first authentication request and forwards it to the wireless controller; The wireless controller receives the first authentication request forwarded by the wireless access point, and forwards the first authentication request to the authentication server for access authentication; the authentication server performs access authentication on the terminal according to the first authentication request, and returns confirmation information of successful authentication; the wireless controller forwards the confirmation information to the wireless access point; the confirmation information is an executable script or a QR code required for access service network authentication, and the executable script or the QR code is generated based on the service network information to which the terminal belongs, the authentication method, and the random key; The wireless access point forwards the confirmation information to the terminal; the terminal sends a detection frame for detecting the service network; the wireless access point receives the detection frame and responds; the terminal initiates a second authentication request for accessing the service network according to an executable script or a QR code; the wireless access point receives the second authentication request and forwards it to the wireless controller; the wireless controller receives the second authentication request and sends it to the authentication server for secondary authentication.

7. A wireless access point, characterized in that: Used to execute the steps of the wireless local area network access control method as described in any one of claims 1-3.

8. A wireless controller, characterized in that: Used to execute the steps of the wireless local area network access control method described in claim 4 or 5.

9. A storage medium having computer instructions stored thereon, characterized in that: When the computer instructions are executed, the steps of the wireless local area network access control method described in any one of claims 1 to 3 or claim 4 or 5 are executed.

10. A network communication device, comprising a memory and a processor, wherein the memory stores computer instructions that can be executed on the processor, characterized in that: When the processor runs the computer instructions, the processor performs the steps of the wireless local area network access control method described in any one of claims 1 to 3 or claim 4 or 5.

Images