Network authentication method, client, device, storage medium and program product

Abstract

The present application provides a network authentication method, client, device, storage medium and program product. The authentication client obtains a network authentication request of a terminal device carrying a network identifier bound to a specified account, and the network authentication request is obtained by triggering preset authentication information provided by the specified account; when the terminal device accesses a wireless local area network mapped with the network identifier, an identity authentication request is sent to an authentication server so that the authentication server performs identity verification on the terminal device; access authorization information is received from the authentication server, and access authorization information is sent to a wireless controller of the wireless local area network so that the wireless controller releases the network access request of the terminal device based on the access authorization information. The network authentication process can be automatically triggered and completed by the user performing a simple trigger operation on the preset authentication information of the specified account, which can effectively reduce user operations during the network authentication process, simplify the network authentication process, and improve the efficiency of network authentication.

Description

Technical Field

[0001] The present invention relates to the field of Internet technology, and in particular to a network authentication method, a client, a device, a storage medium and a program product. Background Art

[0002] With the widespread use of wireless networks, wireless LANs have become an indispensable part of users' daily lives. In order to ensure network security, especially the security of public networks, and prevent unauthorized terminals from accessing the network, it is usually necessary to authenticate the terminal devices that access the network.

[0003] The inventors have discovered that in the relevant network authentication process, especially in public areas or environments where large numbers of users access the network, the network authentication process often requires users to input various authentication information. User operations are complicated and the authentication process is cumbersome, resulting in low efficiency of network authentication. Summary of the invention

[0004] The present invention provides a network authentication method, a client, a device, a storage medium and a program product to solve the problem of low efficiency of network authentication caused by complex user operations and cumbersome authentication procedures in the relevant network authentication process.

[0005] In a first aspect, an embodiment of the present application provides a network authentication method, which is applied to an authentication client on a terminal device, including:

[0006] The authentication client obtains a network authentication request from the terminal device. The network authentication request carries a network identifier bound to a specified account. The network authentication request is obtained by triggering preset authentication information provided by the specified account.

[0007] When the terminal device accesses the wireless local area network to which the network identifier is mapped, the authentication client sends an identity authentication request to the authentication server, so that the authentication server performs identity verification on the terminal device based on the identity information of the terminal device in the identity authentication request;

[0008] The authentication client receives access authorization information from the authentication server after identity verification;

[0009] The authentication client sends access authorization information to the wireless controller of the wireless local area network, so that the wireless controller releases the network access request of the terminal device based on the access authorization information.

[0010] Optionally, when the terminal device accesses the wireless local area network corresponding to the network identifier, the authentication client sends an identity authentication request to the authentication server, including:

[0011] The authentication client sends a local area network information request including a network identifier to the authentication server, so that the authentication server responds to the local area network information request and determines a service set identifier bound to the network identifier, where the service set identifier is a unique identifier of the wireless local area network;

[0012] The authentication client receives the service set identifier from the authentication server;

[0013] When the terminal device is not connected to the wireless local area network corresponding to the service set identifier, the authentication client attempts to access the wireless local area network corresponding to the service set identifier;

[0014] When the terminal device accesses the wireless local area network corresponding to the service set identifier, the authentication client sends an identity authentication request to the authentication server, and the identity authentication request includes the identity information of the terminal device.

[0015] Optionally, before the authentication client sends the identity authentication request to the authentication server, the method further includes:

[0016] The authentication client sends an address information request of the terminal device to the Internet Protocol address of the wireless controller, so that the wireless controller obtains the address information of the terminal device in response to the address information request;

[0017] The authentication client receives the address information of the terminal device from the wireless controller, and determines the identity information of the terminal device according to the address information.

[0018] Optionally, before the authentication client sends an address information request of the terminal device to the Internet Protocol address of the wireless controller, the method further includes:

[0019] The authentication client sends an authentication point confirmation request of a preset domain name, so that the access point device of the wireless local area network intercepts the authentication point confirmation request and resolves the preset domain name to obtain the Internet Protocol address of the wireless controller;

[0020] The authentication client receives the Internet Protocol address of the wireless controller from the access point device.

[0021] Optionally, the preset authentication information provided by the designated account includes a network authentication link and an authentication identification code, and the authentication client obtains a network authentication request of the terminal device, including:

[0022] Upon receiving a trigger signal for a network authentication link from a terminal device, or upon receiving an identification signal for an authentication identification code from a terminal device, the authentication client determines that a network authentication request from the terminal device has been obtained;

[0023] Among them, the trigger signal is triggered and sent by the terminal device when detecting a click operation on the network authentication link; the identification signal is triggered and sent by the terminal device when detecting a scan operation on the authentication identification code.

[0024] Optionally, the method further comprises:

[0025] When the terminal device detects that the user has completed the preset operation on the designated account, it displays the network authentication link of the designated account and prompts the user to operate the network authentication link to perform network authentication;

[0026] When the terminal device detects a click operation on the network authentication link, it triggers and sends a trigger signal for the network authentication link to the authentication client.

[0027] Optionally, before the terminal device detects that the user completes a preset operation on the designated account, the method further includes:

[0028] The terminal device displays a redirection page from the access point device, which is generated after the access point device intercepts the terminal device's illegal network access request;

[0029] When the terminal device detects the triggering operation of the jump control in the redirection page, it jumps to the preset page, and the preset page displays the identification information of the specified account;

[0030] When the terminal device detects a trigger operation on the identification information of the specified account in the preset page, it jumps to the information operation interface of the specified account and prompts the user to complete the preset operation on the specified account.

[0031] Optionally, a digital certificate authorized by a certificate authority is stored in the wireless controller. Based on the digital certificate, the wireless controller communicates with an authentication client on the terminal device using the Hypertext Transfer Protocol Secure Sockets Layer (HTTP Secure Sockets Layer).

[0032] Optionally, a digital certificate authorized by a certificate authority is stored in the wireless controller, and the method further includes:

[0033] The certificate synchronization device receives a certificate query request from the wireless controller, where the certificate query request includes first identification information of the digital certificate in the wireless controller;

[0034] The certificate synchronization device determines, in response to the certificate query request, that the first identification information is consistent with the second identification information of the latest version of the digital certificate in the server;

[0035] When determining that the first identification information is inconsistent with the second identification information, the certificate synchronization device sends a certificate inconsistency result to the wireless controller;

[0036] The certificate synchronization device receives a certificate download request from the wireless controller, and in response to the certificate download request, sends the latest version of the digital certificate to the wireless controller, so that the wireless controller receives and configures the latest version of the digital certificate.

[0037] In a second aspect, an embodiment of the present application provides an authentication client, which is applied to a terminal device, including:

[0038] An acquisition module is used to acquire a network authentication request of a terminal device, the network authentication request carries a network identifier bound to a specified account, and the network authentication request is obtained by triggering preset authentication information provided by the specified account;

[0039] A sending module, used to send an identity authentication request to an authentication server when accessing a wireless local area network mapped with a network identifier, so that the authentication server performs identity verification on the terminal device based on the identity information of the terminal device in the identity authentication request;

[0040] A receiving module, used to receive access authorization information from an authentication server after identity verification passes;

[0041] The sending module is also used to send access authorization information to the wireless controller of the wireless local area network, so that the wireless controller releases the network access request of the terminal device based on the access authorization information.

[0042] In a third aspect, an embodiment of the present application provides a terminal device, including an authentication client, which is used to implement the steps of a network authentication method.

[0043] In a fourth aspect, an embodiment of the present application provides a network authentication system, including a terminal device, an authentication server and a wireless controller, wherein an authentication client is applied on the terminal device, and the authentication client is used to implement the steps of the above-mentioned network authentication method.

[0044] In a fifth aspect, an embodiment of the present application provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the above-mentioned network authentication method when executing the computer program.

[0045] In a sixth aspect, an embodiment of the present application provides a readable storage medium, which stores a computer program, and when the computer program is executed by a processor, the steps of the above-mentioned network authentication method are implemented.

[0046] In a seventh aspect, an embodiment of the present application provides a computer program product, which includes a computer program, and when the computer program is executed by a processor, it implements the steps of the above-mentioned network authentication method.

[0047] In a solution provided by the above-mentioned network authentication method, client, device, storage medium and program product, the authentication client on the terminal device obtains a network authentication request of the terminal device, the network authentication request carries a network identifier bound to a specified account, and the network authentication request is obtained by triggering preset authentication information provided by the specified account; when the terminal device accesses a wireless local area network mapped with the network identifier, an identity authentication request is sent to an authentication server, so that the authentication server performs identity verification on the terminal device based on the identity information of the terminal device in the identity authentication request; access authorization information is received from the authentication server after the identity verification passes; and access authorization information is sent to a wireless controller of the wireless local area network, so that the wireless controller releases the network access request of the terminal device based on the access authorization information. In this embodiment, the authentication client on the terminal device can automatically trigger a network authentication request based on the relevant operations (such as scanning code operations) of the preset authentication information provided by the user for the designated account, automatically connect to the wireless local area network based on the authentication identification code of the designated account in the network authentication request, and automatically interact with the authentication server and the wireless controller through the identity information of the terminal device to realize the identity authentication of the terminal device for normal access to the network; the user can automatically trigger and complete the network authentication process by performing a simple trigger operation on the preset authentication information of the designated account, which can effectively reduce user operations during the network authentication process, simplify the network authentication process, and improve the efficiency of network authentication. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments of the present invention will be briefly introduced below. Obviously, the accompanying drawings in the following description are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative labor.

[0049] Figure 1 is a schematic diagram of a structure of a network authentication system in one embodiment of the present invention;

[0050] Figure 2 is a signaling interaction diagram of a network authentication method in one embodiment of the present invention;

[0051] Figure 3 yes Figure 2 A schematic diagram of an implementation process of step S10;

[0052] Figure 4 yes Figure 2 A schematic diagram of an implementation process of step S20;

[0053] Figure 5 is a flow chart of a network authentication method in one embodiment of the present invention;

[0054] Figure 6This is a signaling interaction diagram for performing network authentication by scanning a code in one embodiment of the present invention;

[0055] Figure 7 This is a signaling interaction diagram for performing network authentication by clicking on a public account link in one embodiment of the present invention;

[0056] Figure 8 is a signaling interaction diagram of a wireless controller updating a digital certificate in one embodiment of the present invention;

[0057] Fig. 9 yes Figure 1 A structural diagram of the authentication client;

[0058] Fig.10 It is a schematic diagram of the structure of an electronic device in one embodiment of the present invention. DETAILED DESCRIPTION

[0059] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0060] It should be understood that when used in the present specification and the appended claims, the term "comprising" indicates the presence of the described features, integrals, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components and / or their collections. It should also be understood that the term "and / or" used in the present specification and the appended claims refers to any combination of one or more of the associated listed items and all possible combinations, and includes these combinations.

[0061] In addition, in the description of the present specification and the appended claims, the terms "first", "second", "third", etc. are only used to distinguish the descriptions and cannot be understood as indicating or implying relative importance.

[0062] References to "one embodiment" or "some embodiments" etc. described in the present specification mean that one or more embodiments of the present invention include specific features, structures or characteristics described in conjunction with the embodiment. Therefore, the statements "in one embodiment", "in some embodiments", "in some other embodiments", "in some other embodiments", etc. that appear in different places in this specification do not necessarily refer to the same embodiment, but mean "one or more but not all embodiments", unless otherwise specifically emphasized in other ways. The terms "including", "comprising", "having" and their variations all mean "including but not limited to", unless otherwise specifically emphasized in other ways.

[0063] It should be understood that the order of execution of the steps in the following embodiments does not imply a precedence of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0064] In order to illustrate the technical solution of the present invention, specific embodiments are provided below for illustration.

[0065] The network authentication method provided by the embodiment of the present invention can be applied in Figure 1 In the network authentication system shown, the network authentication system includes an authentication server, a wireless controller and a terminal device. Among them, an authentication client is applied on the terminal device, and the authentication client can provide network authentication services for the terminal device. The authentication client communicates with the authentication server through a mobile network, and the authentication client communicates with the wireless controller through a local area network. Among them, the authentication server can provide a network authentication function for the terminal device, and the network authentication function can be called by a small program or by an application.

[0066] Specifically, the authentication client on the terminal device obtains a network authentication request of the terminal device. The network authentication request carries a network identifier bound to a specified account. The network authentication request is obtained by triggering preset authentication information provided by the specified account. For example, the network authentication request can be triggered by scanning the authentication identifier code of the specified account; when the terminal device accesses a wireless local area network mapped with the network identifier, an identity authentication request is sent to an authentication server, so that the authentication server performs identity verification on the terminal device based on the identity information of the terminal device in the identity authentication request; access authorization information is received after the identity verification is passed from the authentication server; access authorization information is sent to a wireless controller of the wireless local area network, so that the wireless controller releases the network access request of the terminal device based on the access authorization information, so that the terminal device can access the network normally.

[0067] In this embodiment, the authentication client on the terminal device can automatically trigger a network authentication request based on the relevant operations (such as scanning operations) of the preset authentication information provided by the user for the designated account, and automatically connect to the wireless local area network based on the authentication identification code of the designated account in the network authentication request, and automatically interact with the authentication server and the wireless controller through the identity information of the terminal device to realize the identity authentication of the terminal device for normal access to the network; the user can automatically trigger and complete the network authentication process by performing a simple trigger operation on the preset authentication information of the designated account, which can effectively reduce user operations in the network authentication process, simplify the network authentication process, and improve the efficiency of network authentication; at the same time, it can also improve the user experience in the network authentication process, reduce user loss caused by cumbersome operations and low authentication efficiency, and improve the designated account (such as a merchant) The effect of attracting users.

[0068] The authentication client, also known as the user end, refers to a program that corresponds to the authentication server and provides local network authentication services to customers. The authentication client can be a small program or an application. The authentication client can be installed on, but not limited to, various terminal devices such as personal computers, laptops, smart phones, tablets, and portable wearable devices. The authentication server can be implemented as an independent server or a server cluster consisting of multiple servers.

[0069] In one embodiment, if Figure 2 As shown, a network authentication method is provided, which is applied in Figure 1 The network authentication system in is used as an example to illustrate, including the following steps:

[0070] S10: The authentication client obtains a network authentication request from the terminal device, where the network authentication request carries a network identifier bound to a specified account.

[0071] It should be understood that the designated account can be an account pre-registered by a designated user such as a merchant, enterprise or individual in a preset service platform. After the designated account is registered in the preset service platform, the preset service platform assigns a network identifier to the registered designated account, and the preset service platform and the authentication server share the network identifier (as well as the association between the network identifier and the wireless local area network) through internal communication. According to the location of the designated account, the network identifier of the designated account can be associated with one or more wireless local area networks. The authentication identification code is a unique identification code (such as a QR code) assigned by the authentication client to the designated account and carrying the network identifier of the designated account; the network authentication request is obtained by triggering the preset authentication information provided by the designated account. For example, the preset authentication information can be an authentication identification code (such as a QR code, a mini program code) provided by the designated account, and the authentication identification code carries the network identifier of the designated user. The user can trigger the network authentication request by scanning the authentication identification code of the designated account.

[0072] In actual application, when the user's terminal device has a LAN networking requirement, the user can use the terminal device to scan the authentication identification code of the specified account, and trigger the network authentication request by scanning the authentication identification code of the specified account. The terminal device (such as using a certain instant messaging software) scans and identifies the authentication identification code, and the authentication client obtains a network authentication request including the network identification bound to the specified account. In other embodiments, the preset authentication information can also be a network authentication link, which carries the network identification of the specified user. The network authentication request can also be triggered by clicking on the network authentication link of the specified account, which will not be repeated here.

[0073] For example, when a user uses an instant messaging software in a terminal device to scan and identify the authentication identification code, the authentication client is triggered, and the authentication client determines that it has received a network authentication request from the terminal device. Alternatively, when the user uses the instant messaging software in the terminal device, he enters the public account of a specified account in the instant messaging software and clicks on the network authentication link of the specified account on the public account. The authentication client is triggered, and the authentication client determines that it has received a network authentication request from the terminal device.

[0074] S20: When the terminal device accesses the wireless local area network mapped with the network identifier, the authentication client sends an identity authentication request to the authentication server.

[0075] The authentication client obtains a network authentication request from the terminal device, and then the authentication client determines the wireless local area network mapped with the network identifier, and when it is determined that the terminal device has not accessed the wireless local area network mapped with the network identifier, controls the terminal device to access the wireless local area network mapped with the network identifier. When it is determined that the terminal device has accessed the wireless local area network mapped with the network identifier, the authentication client obtains the identity information of the terminal device, which may include the hardware address of the terminal device, i.e., the MAC (Media Access Control Address) address, and / or the static Internet Protocol address, i.e., the static IP (Internet Protocol Address); then, an identity authentication request including the identity information is sent to the authentication server.

[0076] S30: The authentication server performs identity verification on the terminal device based on the identity information of the terminal device in the identity authentication request.

[0077] The authentication server receives the identity authentication request sent by the authentication client, and performs identity verification on the terminal device based on the identity information of the terminal device in the identity authentication request.

[0078] For example, the authentication server can determine, in response to an identity authentication request, whether the MAC address of the terminal device in the identity information is in a preset blacklist. If the MAC address (or static IP address) of the terminal device is in the preset blacklist, the identity verification fails; if the MAC address (and static IP address) of the terminal device is not in the preset blacklist, the identity verification passes.

[0079] After the identity verification of the terminal device is passed, the authentication server generates access authorization information for the terminal device, which includes network access duration (release duration) of the terminal device, network uplink and downlink bandwidth restrictions and other information, and sends the access authorization information of the terminal device to the authentication client.

[0080] S40: The authentication client receives access authorization information from the authentication server after identity verification.

[0081] The authentication client receives access authorization information from the authentication server after the identity verification is passed. Among them, the access authorization information of the terminal device includes the network access duration of the terminal device (release duration), the network uplink and downlink bandwidth limit (can be set by a specified account, such as a merchant setting), the address information of the terminal device, timestamp, random string and other access information, as well as hash digital signature and other information. Among them, the random string and hash signature and other information are used by the wireless controller to verify the access authorization information of the terminal device. The network access duration of the terminal device, the network uplink and downlink bandwidth limit, the address information and timestamp of the terminal device are used to impose time and traffic restrictions on the network access request of the terminal device. The hash digital signature is a digital signature obtained by the authentication server through hash calculation based on a preset signature algorithm and a preset key.

[0082] S50: The authentication client sends access authorization information to the wireless controller of the wireless LAN.

[0083] The authentication client sends the access authorization information of the terminal device to the wireless controller of the wireless LAN to which it is connected.

[0084] S60: The wireless controller releases the network access request of the terminal device based on the access authorization information.

[0085] The wireless controller releases the network access request of the terminal device based on the access authorization information of the terminal device. The wireless controller receives the access authorization information of the terminal device sent by the authentication client, and verifies the access authorization information based on the same preset signature algorithm and preset key. If the information verification is determined to be passed, the network access request of the terminal device is released based on the network access duration in the access authorization information and the network uplink and downlink bandwidth restrictions. After the network access duration of the terminal device reaches the network access duration in the access authorization information, steps S10 to S50 are re-executed to perform network authentication again and access the network normally.

[0086] In this embodiment, the authentication client on the terminal device can automatically trigger a network authentication request based on the relevant operations of the user on the preset authentication information provided by the designated account, and automatically connect to the wireless local area network based on the authentication identification code of the designated account in the network authentication request, and automatically interact with the authentication server and the wireless controller through the identity information of the terminal device to realize the identity authentication of the terminal device to access the network normally; the user performs a simple trigger operation on the preset authentication information of the designated account, such as scanning the authentication identification code, which can automatically trigger and complete the network authentication process, which can effectively reduce user operations in the network authentication process, simplify the network authentication process, and improve the efficiency of network authentication; at the same time, it can also improve the user experience in the network authentication process, reduce user loss caused by cumbersome operations and low authentication efficiency, and improve the designated account (such as a merchant) The effect of attracting users.

[0087] In one embodiment, the preset authentication information provided by the designated account includes the authentication identification code of the designated account. Figure 3 As shown, step S10, that is, the authentication server obtains the network authentication request of the terminal device, specifically includes the following steps:

[0088] S11: The authentication client determines whether a recognition signal for the authentication identification code is received from the terminal device.

[0089] The user uses the terminal device to scan the authentication identification code (such as a mini program code or a QR code) provided by the specified account. When the terminal device detects the user's scanning operation of the authentication identification code, it triggers and sends an identification signal of the authentication identification code to the authentication client. That is, the identification signal is triggered and sent by the terminal device when it detects the scanning operation of the authentication identification code.

[0090] The authentication client determines whether a recognition signal for the authentication identification code is received from the terminal device.

[0091] S12: When receiving an identification signal of the authentication identification code from the terminal device, the authentication client determines that a network authentication request from the terminal device is obtained.

[0092] When the authentication client receives the identification signal of the authentication identification code from the terminal device, it determines that the network authentication request from the terminal device is obtained.

[0093] In this embodiment, when the terminal device detects the scanning operation of the authentication identification code, it triggers and sends the recognition signal of the authentication identification code. When the authentication client receives the recognition signal of the authentication identification code from the terminal device, it determines that the network authentication request from the terminal device has been obtained. The user can send the network authentication request and trigger the automatic network authentication process through a simple scanning action. It is simple and convenient, without too much operation, which can reduce the loss of users caused by cumbersome operation and low authentication efficiency, and improve the drainage effect of the designated account (such as a merchant) on users.

[0094] In one embodiment, the preset authentication information provided by the designated account includes a network authentication link. Step S10, that is, the authentication server obtains the network authentication request of the terminal device, specifically includes the following steps:

[0095] S101: The authentication client determines whether a trigger signal for a network authentication link is received from a terminal device.

[0096] The user can click on the network authentication link provided by the designated account displayed on the terminal device. When the terminal device detects the user's click operation on the network authentication link, it triggers and sends an identification signal of the authentication identification code to the authentication client, that is, the trigger signal is triggered and sent by the terminal device when the user detects the click operation on the network authentication link. The network authentication link carries the network identification of the designated account. In other embodiments, the network authentication link carries the key information allocated by the designated account to the terminal device.

[0097] The authentication client determines whether a trigger signal for a network authentication link is received from the terminal device.

[0098] S102: When receiving a trigger signal for a network authentication link from a terminal device, the authentication client determines that a network authentication request from the terminal device is obtained.

[0099] When receiving a trigger signal for a network authentication link from a terminal device, the authentication client determines that a network authentication request from the terminal device is obtained.

[0100] In this embodiment, when the terminal device detects a click operation on the network authentication link, it triggers and sends a trigger signal for the network authentication link. When the authentication client receives the trigger signal for the network authentication link from the terminal device, it determines that the network authentication request from the terminal device has been obtained. The user can send a network authentication request and trigger an automatic network authentication process through a simple link click action. It is simple and convenient, does not require too much operation, and can be applied to network authentication scenarios on public accounts. It can reduce user loss caused by cumbersome operations and low authentication efficiency, and improve the drainage effect of designated accounts (such as merchants) on users.

[0101] In one embodiment, if Figure 4 As shown, step S20, that is, when the terminal device accesses the wireless local area network mapped with the network identifier, the authentication client sends an identity authentication request to the authentication server, specifically including the following steps:

[0102] S21: The authentication client sends a local area network information request including a network identifier to the authentication server.

[0103] After obtaining the network authentication request from the terminal device, the authentication client sends a local area network information request including a network identifier to the authentication server in response to the network authentication request.

[0104] S22: The authentication server determines the service set identifier bound to the network identifier in response to the local area network information request.

[0105] The authentication server receives the LAN information request sent by the authentication client, and in response to the LAN information request, determines the service set identifier bound to the network identifier in the database, wherein the service set identifier (SSID) is the unique identifier of the wireless LAN, and the terminal device can be controlled to connect to the wireless LAN corresponding to the service set identifier through the service set identifier. The authentication server stores the network identifiers bound to different specified accounts and the service set identifiers bound to the network identifiers of different specified accounts.

[0106] The same network identifier can be bound to one or more service set identifiers, that is, the same designated account can be associated with one or more wireless local area networks. The network identifiers corresponding to the designated accounts sharing the same wireless local area network can be the same or different.

[0107] S23: The authentication client receives the service set identifier from the authentication server.

[0108] The authentication client receives a service set identifier from the authentication server, wherein the authentication client receives one or more service set identifiers bound to a network identifier from the authentication server.

[0109] S24: When determining that the terminal device has not accessed the wireless local area network corresponding to the service set identifier, the authentication client attempts to access the wireless local area network corresponding to the service set identifier.

[0110] When the authentication client determines that the terminal device has not accessed the wireless LAN corresponding to the service set identifier, the authentication client can try to access the wireless LAN corresponding to the service set identifier. Wherein, the service set identifier may include multiple, and when the authentication client determines that the terminal device has not accessed the wireless LAN corresponding to any one of the multiple service set identifiers, the authentication client can try to access the wireless LAN corresponding to any one of the service set identifiers until it accesses the wireless LAN corresponding to any one of the service set identifiers.

[0111] S25: When determining that the terminal device has accessed the wireless local area network corresponding to the service set identifier, the authentication client sends an identity authentication request to the authentication server.

[0112] When the authentication client determines that the terminal device has accessed the wireless local area network corresponding to the service set identifier, the authentication client sends an identity authentication request to the authentication server, and the identity authentication request includes the identity information of the terminal device. That is, when the authentication client determines that the terminal device has accessed the wireless local area network corresponding to any one of the multiple service set identifiers, the authentication client can send an identity authentication request to the authentication server, requesting the authentication server to verify the identity of the terminal device. The identity authentication request includes at least the identity information of the terminal device.

[0113] In this embodiment, the terminal device can be automatically controlled to access the specified wireless LAN according to the service set identifier (SSID) provided by the authentication server, and when the terminal device accesses the wireless LAN, the authentication server is requested to verify the identity of the terminal device to ensure that only authorized devices can access network resources, thereby improving the security of the wireless LAN; through the binding relationship between the network identifier and the service set identifier, the authentication server can dynamically manage the network access policy, which is convenient for allocating different access permissions to different devices. The user does not need to manually enter or select the service set identifier of the wireless LAN, which avoids connection failures caused by user misconfiguration and improves access efficiency.

[0114] In one embodiment, if Figure 5 As shown, before step S20 or S25, that is, before the authentication client sends an identity authentication request to the authentication server, the method further specifically includes the following steps:

[0115] S201: The authentication client sends a request for address information of a terminal device to the Internet Protocol address of the wireless controller.

[0116] The authentication client determines the IP address of the wireless controller, and controls the terminal device to send an address information request of the terminal device to the IP address of the wireless controller, so as to request the wireless controller to feedback the address information of the terminal device.

[0117] S202: The wireless controller obtains address information of the terminal device in response to the address information request.

[0118] After the wireless controller receives the address information request sent by the terminal device, it identifies the source MAC address and / or IP address of the address information request in response to the address information request. The source MAC address and / or IP address is the MAC address and / or IP address of the terminal device, and sends the identified source MAC address and / or IP address of the address information request as the address information of the terminal device to the authentication client.

[0119] S203: The authentication client receives the address information of the terminal device from the wireless controller, and determines the identity information of the terminal device according to the address information.

[0120] The authentication client receives the address information of the terminal device from the wireless controller, and determines the identity information of the terminal device according to the address information of the terminal device, wherein the address information of the terminal device sent by the wireless controller can be directly used as the identity information of the terminal device.

[0121] In this embodiment, before sending an identity authentication request to the authentication server, the authentication client sends an authentication point confirmation request with a preset domain name; the access point device of the wireless LAN intercepts the authentication point confirmation request, parses the preset domain name to obtain the Internet Protocol address of the wireless controller and feeds it back to the authentication client; the authentication client sends an address information request for the terminal device to the Internet Protocol address; the wireless controller obtains the address information of the terminal device in response to the address information request; the authentication client receives the address information of the terminal device from the wireless controller, and determines the identity information of the terminal device based on the address information. In this solution, the authentication client can automatically complete the address information query and identity information confirmation of the terminal device by cooperating with the wireless LAN device without user intervention, which greatly improves the automation level and user experience of the authentication process and significantly improves the authentication efficiency.

[0122] In one embodiment, before step S201, that is, before the authentication client sends a request for address information of the terminal device to the Internet Protocol address of the wireless controller, the method further specifically includes the following steps:

[0123] SA01: The authentication client sends an authentication point confirmation request with a preset domain name.

[0124] When the authentication client determines that the terminal device has accessed the wireless local area network corresponding to the service set identifier, it can send an address information request to the wireless controller of the wireless local area network to request the address information of the terminal device so as to identify the identity of the terminal device through address information such as the MAC address. The preset domain name can be ac.tpauth.cn.

[0125] Since the IP address of the wireless controller in the wireless LAN may be a dynamic IP address, that is, the IP address of the wireless controller may be modified or changed at any time, the authentication client cannot know the changed IP address of the wireless controller. Therefore, when the authentication client sends an authentication point confirmation request, it does not directly send the authentication point confirmation request to the wireless controller in the wireless LAN, but sends an authentication point confirmation request with a preset domain name through the wireless LAN.

[0126] SA02: The access point device of the wireless LAN intercepts the authentication point confirmation request, resolves the preset domain name to obtain the Internet Protocol address of the wireless controller and feeds it back.

[0127] Since the access point device (AP) in the wireless LAN knows the IP address of the wireless controller (that is, the authentication point of the wireless LAN) in the same wireless LAN; after the authentication client sends an authentication point confirmation request of a preset domain name through the wireless LAN, the access point device of the wireless LAN (will intercept the authentication point confirmation request of the preset domain name, and parse the preset domain name to obtain the Internet Protocol address of the wireless controller, that is, the IP address of the wireless controller, such as 192.168.1.253; and then feed back the IP address of the wireless controller to the authentication client.

[0128] SA03: The authentication client receives the Internet Protocol address of the wireless controller from the access point device.

[0129] The authentication client receives the Internet Protocol address of the wireless controller from the access point device, so as to send an address information request of the terminal device to the Internet Protocol address of the wireless controller.

[0130] In this embodiment, before sending an identity authentication request to the authentication server, the authentication client sends an authentication point confirmation request with a preset domain name; the access point device of the wireless LAN intercepts the authentication point confirmation request, resolves the preset domain name to obtain the Internet Protocol address of the wireless controller and feeds it back to the authentication client; the authentication client receives the Internet Protocol address of the wireless controller from the access point device, and sends an address information request of the terminal device to the Internet Protocol address to request the address information of the terminal device. By using the AP to intercept the authentication point confirmation of the preset domain name and perform domain name resolution, the IP address of the wireless controller in the wireless LAN can be quickly and accurately determined, and the communication between the terminal and the authentication point can be realized without additional complex configuration or query process, and the address information confirmation process of the terminal device can be realized; the authentication client collaborates with the wireless LAN device through the preset domain name, and can automatically complete the address information query and identity information confirmation of the terminal device without user intervention, which greatly improves the automation level and user experience of the authentication process and significantly improves the authentication efficiency.

[0131] In one embodiment, step S203, i.e. the authentication client determines the identity information of the terminal device according to the address information, i.e. the process of obtaining the identity information of the terminal device, specifically includes the following steps:

[0132] S2031: The authentication client obtains security information of the terminal device for network authentication, where the security information includes at least one of user authorization information and authentication key information.

[0133] The authentication client obtains pre-acquired security information of the terminal device for network security authentication, wherein the security information includes at least one of user authorization information and authentication key information.

[0134] Wherein, when the network authentication request is triggered by scanning the authentication identification code of a designated account, the security information of the terminal device may be user authorization information. User authorization information is an authorization instruction for obtaining user account information (such as mobile phone number, user email address, or account information registered on a designated platform).

[0135] Among them, the user authorization information acquisition process is as follows: after detecting that the terminal device has scanned the authentication identification code of the specified account, the authentication client determines to obtain the network authentication request of the terminal device; after the authentication client obtains the network authentication request of the terminal device, an authorization prompt for the user account information is sent through the terminal device to prompt the user to authorize the authentication client to obtain the user's relevant account information, such as mobile phone number, user email address or account information registered on the designated platform; after receiving the authorization instruction to obtain the user account information, the authentication client will store the authorization token (token) for obtaining the user account information to obtain the security information of the terminal device.

[0136] In the case where the network authentication request is triggered by clicking on a network authentication link of a designated account, the security information of the terminal device may be authentication key information, which is key information for network authentication assigned to the terminal device by the designated account.

[0137] The process of obtaining the authentication key information is as follows: after the authentication client detects that the user clicks the network authentication link of the specified account through the terminal device, it determines to obtain the network authentication request of the terminal device, and allocates a preset key information for network authentication to the terminal device, and obtains the authentication key information of the terminal device. In other embodiments, when it is detected that the user performs relevant operations on the specified account through the terminal device on the relevant page of the specified account, such as following the public account page of the specified account and replying to a specific message, the authentication client allocates a preset key information for network authentication to the terminal device, and obtains the authentication key information of the terminal device.

[0138] S2032: The authentication client determines the security information of the terminal device and the address information of the terminal device as the identity information of the terminal device.

[0139] After receiving the address information of the terminal device from the wireless controller, the authentication client determines the pre-acquired security information of the terminal device and the address information of the terminal device as the identity information of the terminal device.

[0140] In this embodiment, by obtaining security information of the terminal device, the security information includes at least one of user authorization information and authentication key information, and the security information of the terminal device and the address information of the terminal device are determined as the identity information of the terminal device, thereby ensuring the diversity and security of the identity information, and facilitating the subsequent authentication server to verify the identity by not only verifying the address information of the terminal device but also the security information, thereby improving the accuracy of the identity verification and improving the security of subsequent network access.

[0141] In one embodiment, step S30, i.e., the authentication server verifies the identity of the terminal device based on the identity information of the terminal device in the identity authentication request, specifically includes the following steps:

[0142] S31: The authentication server receives the identity authentication request sent by the authentication client, and extracts the identity information in the identity authentication request.

[0143] The authentication server receives the authentication request sent by the authentication client and extracts the identity information in the authentication request. The authentication request includes the identity information of the terminal device, the relevant information for accessing the wireless LAN, and the network identifier and timestamp of the specified user. The identity information includes the address information of the terminal device and the security information used for network security authentication. The relevant information for accessing the wireless LAN includes the service set identifier for accessing the wireless LAN, the IP address of the wireless controller, the MAC address of the access device, and other information.

[0144] S32: The authentication server performs security verification on the security information in the identity information and performs address verification on the MAC address in the identity information.

[0145] After extracting the identity information in the identity authentication request, the authentication server performs a security check on the security information in the identity information, that is, performs a security check on the user authorization information or authentication key information to confirm and trace the user's identity. Wherein, in the case where the security information is the authentication key information, the authentication server matches the authentication key information in the identity authentication request with the key information in the database. If it matches the key information in the database, it is determined that the authentication key information passes the security check, that is, the security information passes the security check; if it does not match the key information in the database, it is determined that the authentication key information does not pass the security check, that is, the security information does not pass the security check. Wherein, in the case where the security information is the user authorization information, if the authentication server obtains the user account information of the terminal device (such as the user's mobile phone number) through the user authorization information, it is determined that the security information passes the security check, and generates a network access record of the user account information, so that the user's identity can be traced; if the authentication server cannot obtain the user account information of the terminal device (such as the user's mobile phone number) through the user authorization information, it is determined that the security information does not pass the security check.

[0146] At the same time, the authentication server also performs address verification on the MAC address in the identity information. The authentication server matches the MAC address of the terminal device in the identity authentication request with the MAC address in the preset blacklist in the database; if the MAC address in the preset blacklist is matched, it means that the terminal device has been blacklisted by the relevant account (such as the specified account), and it is determined that the MAC address has not passed the address verification; if the MAC address in the preset blacklist is not matched, it means that the terminal device has not been blacklisted by the relevant account (such as the specified account), and it is determined that the MAC address has passed the address verification.

[0147] S33: The authentication server confirms the network access duration of the terminal device according to the MAC address in the identity information.

[0148] At the same time, the authentication server confirms the network access time of the terminal device according to the MAC address in the identity information. The authentication server needs to determine the access time limit set for the wireless LAN by the designated account according to the relevant information of accessing the wireless LAN, and determine the network access time of the terminal device with the MAC address on the wireless LAN on that day according to the MAC address, the relevant information of accessing the wireless LAN and the timestamp, and determine whether the network access time of the terminal device exceeds the access time limit set by the designated account for the wireless LAN.

[0149] S34: When the authentication server determines that the security information has passed the security check and the address check, and the network access duration of the terminal device does not exceed the preset access duration limit, the authentication server determines that the terminal device has passed the identity check.

[0150] When it is determined that the security information of the terminal device has not passed the security verification, or the MAC address has not passed the address verification, or the network access duration of the terminal device exceeds the pre-set access duration limit, it is determined that the terminal device has not passed the identity verification and the network authentication request of the terminal device is rejected.

[0151] The authentication server determines that the terminal device has passed the security verification, the MAC address has passed the address verification, and the network access duration of the terminal device has not exceeded the preset access duration limit, that is, the network access duration of the terminal device on that day has not exceeded the access duration limit set by the designated account for the wireless local area network, and determines that the terminal device has passed the identity verification and approves the network authentication request of the terminal device. After determining that the terminal device has passed the identity verification, the authentication server generates access authorization information for the terminal device.

[0152] In this embodiment, by verifying the security information in the identity information, the forgery of identity information or tampering of data can be effectively prevented, ensuring the reliability and security of identity authentication; by verifying the MAC address, the authentication server can uniquely identify the terminal device to prevent illegal devices from fraudulently accessing by disguising the MAC address of a legitimate device; by confirming the network access duration of the terminal device, the authentication server can dynamically manage the network usage rights of the device to prevent the device from occupying network resources for a long time or abusing services. This solution combines multiple verification methods such as security information verification, address verification, and access duration control to construct a multi-level authentication mechanism, which further improves the accuracy and security of authentication.

[0153] In a specific embodiment, Figure 6As shown, the user scans the authentication identification code of the specified account (such as the small program code of the authentication client provided by the merchant) through the terminal device, triggering the authentication client on the terminal device, and the authentication client obtains the network authentication request, that is, the network authentication request is triggered by the terminal device's scanning operation of the authentication identification code, and the network authentication request carries the network identification for network authentication bound to the specified account. After obtaining the network authentication request, the authentication client on the terminal device sends a local area network information request to the authentication server, requesting to obtain the service set identification bound to the network identification. After receiving the local area network information request, the authentication server responds to the local area network information request, determines one or more service set identifications bound to the network identification in the local area network information request, and sends the service set identification bound to the network identification in the local area network information request to the authentication client. After receiving the service set identification, the authentication client controls the terminal device to try to connect to the wireless local area network of the service set identification, that is, to try to connect to the access point device (ie, AP) of the wireless local area network, until the terminal device accesses the wireless local area network of the service set identification, that is, successfully connects to the AP. After the terminal device accesses the wireless local area network identified by the service set, it sends an address information request to the wireless controller (i.e., the authentication point device) of the wireless local area network; the wireless controller obtains the address information of the terminal device in response to the address information request and feeds it back to the authentication client, the authentication client receives the address information of the terminal device, and determines the identity information of the terminal device based on it, and the identity information at least includes the address information. Then, the authentication client sends an identity authentication request to the authentication server based on the identity information of the terminal device; the authentication server responds to the identity authentication request, verifies the identity of the terminal device based on the identity information in the identity authentication request, and sends the access authorization information of the terminal device after the identity verification passes. The authentication client receives the access authorization information sent by the authentication server, and submits the access authorization information of the terminal device to the wireless controller of the wireless local area network, requesting the wireless controller to release the network access request of the terminal device. The wireless controller receives the access authorization information of the terminal device and verifies it, and after the verification passes, releases the network access request of the terminal device based on the access authorization information. Afterwards, the authentication client can prompt the user that the network authentication is successful, and the user can exit the authentication client to use the terminal device to access the network normally.

[0154] In one embodiment, before step S101, that is, before the authentication client determines whether a trigger signal for a network authentication link is received from the terminal device, the method further includes the following steps:

[0155] S01: When the terminal device detects that the user has completed a preset operation on a designated account, the terminal device displays a network authentication link of the designated account and prompts the user to operate the network authentication link to perform network authentication.

[0156] After the user enters the information operation interface provided by the designated account, if the terminal device is not connected to the wireless LAN, or is connected to the wireless LAN but has not passed the network authentication, the user can complete the preset operation of the designated account through the terminal device according to the relevant prompts of the designated account, such as following the public account of the designated account, collecting the public account of the designated account, or sending a designated message to the public account of the designated account. When the terminal device detects that the user has completed the preset operation of the designated account, the network authentication link of the designated account is displayed in the information operation interface provided by the designated account, and the user is prompted to click on the network authentication link to perform the network authentication.

[0157] The user can click on the network authentication link of the specified account to trigger the network authentication request.

[0158] S02: When the terminal device detects a click operation on the network authentication link, it triggers and sends a trigger signal for the network authentication link to the authentication client.

[0159] When the terminal device detects a click operation on the network authentication link, it triggers a trigger signal for the network authentication link and sends the trigger signal for the network authentication link to the authentication client. The authentication client receives the trigger signal for the network authentication link from the terminal device and determines that the network authentication request of the terminal device has been obtained.

[0160] In this embodiment, after the terminal device detects that the user has completed the preset operation on the specified account, it displays the network authentication link of the specified account and prompts the user to operate the network authentication link to perform network authentication; when a click operation on the network authentication link is detected, the terminal device triggers and sends a trigger signal for the network authentication link to the authentication client. The user can trigger the automatic network authentication process through the preset operation on the specified account, which is simple and convenient, does not require too much operation, and can be applied to the network authentication scenario on the official account.

[0161] In one embodiment, before step S01, that is, before the terminal device detects that the user completes the preset operation on the designated account, the method further includes the following steps:

[0162] S011: The terminal device displays a redirection page from the access point device.

[0163] When a user sends a network access request through a terminal device, and the terminal device accesses the wireless LAN but fails to pass the network authentication, the network access request is an illegal network access request that has not been authenticated. The access point device of the wireless LAN to which the terminal device accesses will intercept the illegal network access request of the terminal device, and after intercepting the illegal network access request of the terminal device, instruct the terminal device to jump to the redirection page.

[0164] The terminal device displays a redirection page from the access point device. The redirection page has a jump control, and prompts the user to trigger (such as click) the jump control to jump to the relevant page of the specified account.

[0165] S012: When the terminal device detects a triggering operation of a jump control in a redirection page, the terminal device jumps to a preset page.

[0166] When the terminal device detects the trigger operation of the jump control in the redirect page, it jumps to the preset page, where the preset page displays the identification information of the specified account and the trigger prompt of the identification information. The identification information can be a QR code of the specified account, and the trigger prompt of the identification information can be a long press operation prompt.

[0167] Specifically, the preset page may be a jump program page. When the terminal device detects a trigger operation (such as a click operation) of a jump control in a redirect page, the terminal device sends the trigger operation of the jump control to a jump client of the jump control, and the jump client sends the preset page to the mobile terminal in response to the trigger operation, and the terminal device receives and displays the preset page, i.e., the jump program page.

[0168] The jump client can be a separate client, such as a jump applet that provides a jump function, or an authentication client. By providing a page jump function through the jump client, the situation where H5 (i.e. HTML5) type redirect pages cannot achieve public account jumps is reduced, and the jump success rate is improved.

[0169] S013: When the terminal device detects a trigger operation on the identification information of the specified account in the preset page, it jumps to the information operation interface of the specified account and prompts the user to complete the preset operation on the specified account.

[0170] When the terminal device detects a trigger operation on the identification information of the specified account in the preset page, for example, when the terminal device detects a long press operation by the user on the identification information of the specified account in the preset page, the terminal device jumps to the information operation interface (public account interface) of the specified account and prompts the user to complete the preset operation on the specified account, such as following or collecting the public account of the specified account, or replying to the specified information in the public account of the specified account.

[0171] In this embodiment, the terminal device displays a redirection page from the access point device, and the redirection page is generated after the access point device intercepts the illegal network access request of the terminal device; when the terminal device detects the trigger operation of the jump control in the redirection page, it jumps to the preset page, and the preset page displays the identification information of the specified account;

[0172] When the terminal device detects a trigger operation on the identification information of the specified account in the preset page, it jumps to the information operation interface of the specified account and prompts the user to complete the preset operation on the specified account, and then can display the network authentication link of the specified account and prompt the user to operate the network authentication link to perform network authentication. The network authentication link of the specified account is displayed and the user is prompted to operate the network authentication link to perform network authentication. This solution can complete the process from the pop-up redirection page to the authentication and Internet access of the specified account by simply clicking a button, without the need for relatively complex operations such as screenshots, which improves the efficiency of network authentication and the user's experience.

[0173] In a specific embodiment, Figure 7 As shown, after the terminal device accesses the wireless local area network, it sends a network access request without passing the network authentication; the access point device in the wireless local area network intercepts the network access request, determines that the network access request is an illegal request, and redirects it to the specified page, that is, sends a redirect page to the terminal device. The terminal device receives and displays the redirect page from the access point device; the user can click the jump control in the redirect page through the terminal device; when the terminal device detects the click operation of the jump control in the redirect page, it sends the trigger operation of the jump control to the jump client of the jump control, and the jump client sends a preset page in response to the trigger operation, and the terminal device receives and displays the preset page. The user presses the public account QR code of the specified account in the preset page through the terminal device. When the terminal device detects the long press operation of the public account QR code in the preset page, the terminal device jumps to the public account interface of the specified account in response to the instruction of the public account background, and prompts the user to complete the relevant operations on the specified account (such as following the public account, replying to a specific message). When the terminal device detects the relevant operations of following the official account and replying to a specific message, the relevant operation information of following the official account and replying to the specific message is sent to the official account background; the official account background receives and sends the network authentication link of the specified account to the terminal device. The terminal device displays the network authentication link of the specified account, and the user clicks the network authentication link. When the terminal device detects the user's click operation on the network authentication link, it triggers and sends a trigger signal for the network authentication link to the authentication client. The authentication client receives the trigger signal for the network authentication link, obtains the network authentication request and executes the network authentication process. After the network authentication is completed, a network authentication completion prompt is sent to the terminal device to prompt the user to access the network normally.

[0174] In one embodiment, a digital certificate authorized by a certificate authority (CA) is stored in the wireless controller. Based on the digital certificate, the wireless controller communicates with the terminal device using Hypertext Transfer Protocol Secure (HTTPS).

[0175] It should be understood that users can complete network authentication operations on third-party instant messaging software, such as using instant messaging software to scan the authentication identification code of a specified account, or clicking on the network authentication link of a specified account on the instant messaging software to trigger and complete the network authentication process. Since the wireless controller of the wireless LAN is usually deployed in the local network, during the network authentication process, the wireless controller and the terminal device (or other client) usually use the LAN IP address to communicate, and the LAN IP address cannot obtain a valid certificate issued by the CA, so that the wireless controller can only use the Hypertext Transfer Protocol Secure (HTTPS) with a self-signed certificate, or use the insecure Hypertext Transfer Protocol (HTTP) to communicate, which will produce two risks: one is that the built-in browser of the instant messaging software may directly block the network authentication request because the self-signed certificate is untrustworthy; the other situation is that the wireless controller uses the insecure HTTP protocol to communicate with other devices, which will pose a data security risk.

[0176] In this embodiment, the wireless controller stores a digital certificate authorized by the CA organization. The wireless controller uses the HTTPS protocol to communicate with the terminal device based on the digital certificate, which can solve the communication security problem between the authentication client and the wireless controller and protect the security of privacy information that may be included in the communication between the authentication client and the wireless controller, such as the identity information of the terminal device, access authorization information, etc. At the same time, in the application scenario of network authentication by instant messaging software, it can also reduce or avoid the situation where the network authentication request is blocked due to insecure certificates, ensuring that the network authentication can be performed normally.

[0177] In one embodiment, the network authentication system further includes a certificate synchronization device, which can provide the latest version of the digital certificate for the wireless controller to download and update the latest version of the digital certificate in a timely manner to ensure communication security. The method further specifically includes the following steps:

[0178] S001: The wireless controller sends a certificate query request to a certificate synchronization device, where the certificate query request includes first identification information of a digital certificate in the wireless controller.

[0179] In actual application, the wireless controller sends a certificate query request to the certificate synchronization device, and the certificate query request includes the first identification information of the digital certificate in the wireless controller. The first identification information can be the signature information of the certificate, such as the information obtained by encrypting and signing the digital certificate using the encrypted hash function MD5 (Message-Digest Algorithm 5), or the information obtained by encrypting and signing the digital certificate using the hash algorithm SHA256 (Secure Hash Algorithm 256).

[0180] S002: The certificate synchronization device receives a certificate query request from the wireless controller, and in response to the certificate query request, determines the consistency between the first identification information and the second identification information of the latest version of the digital certificate in the certificate synchronization device.

[0181] The certificate synchronization device receives the certificate query request from the wireless controller, and in response to the certificate query request, determines the consistency between the first identification information and the second identification information of the latest version of the digital certificate in the certificate synchronization device. When it is determined that the first identification information is consistent with the second identification information, a certificate consistency result is sent to the wireless controller; the wireless controller receives the certificate consistency result and waits for the next time to send the certificate query request again.

[0182] S003: When determining that the first identification information is inconsistent with the second identification information, the certificate synchronization device sends a certificate inconsistency result to the wireless controller.

[0183] When determining that the first identification information is inconsistent with the second identification information, the certificate synchronization device sends a certificate inconsistency result to the wireless controller.

[0184] S004: The wireless controller receives a certificate inconsistency result and sends a certificate download request.

[0185] The wireless controller receives the certificate inconsistency result and sends a certificate download request if the certificate is inconsistent.

[0186] S005: The certificate synchronization device receives a certificate download request from the wireless controller, and sends the latest version of the digital certificate to the wireless controller in response to the certificate download request.

[0187] The certificate synchronization device receives a certificate download request from the wireless controller, and sends the latest version of the digital certificate to the wireless controller in response to the certificate download request.

[0188] S005: The wireless controller receives and configures the latest version of the digital certificate.

[0189] The wireless controller receives and configures the latest version of the digital certificate. The latest version of the digital certificate is a compressed package in tar format, which contains the key file and the digital certificate. The wireless controller decompresses the compressed package to obtain the key file and the digital certificate, and configures the HTTPS service with these two files to make them effective.

[0190] Specifically, the network authentication system also includes a cloud device (such as a cloud server), which is used to verify the identity of the wireless controller, and a certificate synchronization server (which can be a certificate synchronization server) is used to respond to the request of the wireless controller after determining that the wireless controller has passed the identity verification.

[0191] like Figure 8 As shown, the wireless controller registers with the cloud device and requests to obtain authorization information (i.e., token). The cloud device assigns an authorization information to the registered wireless controller, and the wireless controller stores the authorization information. In the actual working process, the wireless controller periodically sends a certificate query request to the certificate synchronization device, and the certificate query request includes the first identification information of the digital certificate in the wireless controller and the authorization information of the wireless controller. After receiving the certificate query request, the certificate synchronization device sends the authorization information of the wireless controller to the cloud device to request identity verification of the wireless controller. The cloud device performs identity verification on the authorization information of the wireless controller and sends the result of identity verification passing (or the result of identity verification failing) to the certificate synchronization device. After the certificate synchronization device determines that the wireless controller passes the identity verification, it responds to the certificate query request and requests to query the consistency of the digital certificate, that is, to determine the consistency of the first identification information with the second identification information of the latest version of the digital certificate in the server. When it is determined that the first identification information is inconsistent with the second identification information, the certificate inconsistency result is sent to the wireless controller. The wireless controller receives the certificate inconsistency result, and sends a certificate download request to the certificate synchronization device when the certificate is inconsistent. The certificate download request includes the authorization information of the wireless controller. The certificate synchronization device receives the certificate download request from the wireless controller, and sends the authorization information of the wireless controller to the cloud device to request identity verification of the wireless controller. The cloud device verifies the authorization information of the wireless controller and sends the result of identity verification passing (or the result of identity verification failing) to the certificate synchronization device. After the certificate synchronization device determines that the wireless controller has passed the identity verification, it responds to the certificate download request and sends the latest version of the digital certificate to the wireless controller. The wireless controller receives the latest version of the digital certificate and configures the latest version of the digital certificate. This process updates the digital certificate of the wireless controller in real time, which ensures that the digital certificate of the wireless controller is the latest version of the certificate, and also ensures the legitimacy of the wireless controller and the communication security of the wireless controller.

[0192] In this embodiment, the wireless controller sends a certificate query request to the certificate synchronization device, and the certificate query request includes the first identification information of the digital certificate in the wireless controller; the certificate synchronization device receives the certificate query request from the wireless controller, and in response to the certificate query request, determines the consistency between the first identification information and the second identification information of the latest version of the digital certificate in the certificate synchronization device, and sends the certificate inconsistency result to the wireless controller when the first identification information and the second identification information are determined to be inconsistent; the wireless controller receives the certificate inconsistency result, and sends a certificate download request when the certificate is inconsistent; receives the certificate download request from the wireless controller, and sends the latest version of the digital certificate to the wireless controller in response to the certificate download request, and the wireless controller receives and configures the latest version of the digital certificate. The communication security of the wireless controller is guaranteed.

[0193] It should be understood that the order of execution of the steps in the above embodiment does not necessarily mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiment of the present invention.

[0194] In one embodiment, an authentication client is provided, which is applied to a terminal device. The authentication client corresponds one-to-one with the network authentication method in the above embodiment. Fig. 9 As shown, the authentication client includes an acquisition module 901, a sending module 902, and a receiving module 903. The functional modules are described in detail as follows:

[0195] An acquisition module 901 is used to acquire a network authentication request of a terminal device, the network authentication request carries a network identifier bound to a specified account, and the network authentication request is obtained by triggering preset authentication information provided by the specified account;

[0196] The sending module 902 is used to send an identity authentication request to the authentication server when the terminal device accesses the wireless local area network mapped with the network identifier, so that the authentication server performs identity verification on the terminal device based on the identity information of the terminal device in the identity authentication request;

[0197] Receiving module 903, used to receive access authorization information from the authentication server after identity verification passes;

[0198] The sending module 902 is further configured to send access authorization information to a wireless controller of the wireless local area network, so that the wireless controller releases the network access request of the terminal device based on the access authorization information.

[0199] It should be noted that the information interaction, execution process, etc. between the above-mentioned devices / units are based on the same concept as the method embodiment of the present application. Their specific functions and technical effects can be found in the method embodiment part and will not be repeated here.

[0200] The technicians in the relevant field can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional units and modules is used as an example for illustration. In practical applications, the above-mentioned function allocation can be completed by different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiment can be integrated in a processing unit, or each unit can exist physically separately, or two or more units can be integrated in one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of software functional units. In addition, the specific names of the functional units and modules are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of this application. The specific working process of the units and modules in the above-mentioned system can refer to the corresponding process in the aforementioned method embodiment, which will not be repeated here.

[0201] The embodiment of the present application also provides an electronic device, which may be a terminal device, a wireless controller, an authentication server, etc. Fig.10 As shown, the electronic device includes: at least one processor, a memory, and a computer program stored in the memory and executable on the at least one processor, wherein the processor implements the steps in any of the above-mentioned method embodiments when executing the computer program, or implements the functions of the modules / units in the above-mentioned device embodiments when executing the computer program.

[0202] Exemplarily, the computer program may be divided into one or more modules / units, which are stored in the memory and executed by the processor to complete the present application. The one or more modules / units may be a series of computer program instruction segments capable of completing specific functions, which are used to describe the execution process of the computer program in the electronic device.

[0203] Those skilled in the art will understand that Fig.10 These are merely examples of the electronic device and do not constitute a limitation of the electronic device. The electronic device may include more or fewer components than those shown in the figure, or a combination of certain components, or different components. For example, the electronic device may also include input and output devices, network access devices, buses, etc.

[0204] The processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor, etc.

[0205] The memory may be an internal storage unit of the electronic device, such as a hard disk or memory of the electronic device. The memory may also be an external storage device of the electronic device, such as a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), etc. equipped on the electronic device. Furthermore, the memory may also include both an internal storage unit of the electronic device and an external storage device.

[0206] An embodiment of the present application further provides a readable storage medium, wherein the readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps in the above-mentioned method embodiments can be implemented.

[0207] An embodiment of the present application provides a computer program product. When the computer program product is run on a terminal device, the terminal device can implement the steps in the above-mentioned method embodiments when executing the computer program product.

[0208] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the present application implements all or part of the processes in the above-mentioned embodiment method, which can be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium, and the computer program can implement the steps of the above-mentioned various method embodiments when executed by the processor. Among them, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form. The computer-readable medium can at least include: any entity or device that can carry the computer program code to the camera / terminal device, recording medium, computer memory, read-only memory (ROM, Read-Only Memory), random access memory (RAM, RandomAccess Memory), electric carrier signal, telecommunication signal and software distribution medium. For example, a USB flash drive, a mobile hard disk, a magnetic disk or an optical disk. In some jurisdictions, according to legislation and patent practice, computer-readable media cannot be electric carrier signals and telecommunication signals.

[0209] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described or recorded in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0210] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0211] In the embodiments provided in the present application, it should be understood that the disclosed devices / equipment and methods can be implemented in other ways. For example, the device / equipment embodiments described above are merely schematic, for example, the division of the modules or units is only a logical function division, and there may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0212] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0213] The embodiments described above are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, a person skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. Such modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application, and should all be included in the protection scope of the present application.

Claims

1. A network authentication method, characterized in that: include: Obtaining a network authentication request of a terminal device, the network authentication request carrying a network identifier bound to a designated account, the network authentication request being obtained by triggering preset authentication information provided by the designated account; When the terminal device accesses the wireless local area network mapped with the network identifier, sending an identity authentication request to an authentication server, so that the authentication server performs identity verification on the terminal device based on the identity information of the terminal device in the identity authentication request; Receiving access authorization information from the authentication server after identity verification passes; The access authorization information is sent to a wireless controller of the wireless local area network, so that the wireless controller releases the network access request of the terminal device based on the access authorization information.

2. The network authentication method according to claim 1, characterized in that: When the terminal device accesses the wireless local area network mapped with the network identifier, sending an identity authentication request to the authentication server includes: Sending a local area network information request including the network identifier to the authentication server, so that the authentication server responds to the local area network information request and determines a service set identifier bound to the network identifier, where the service set identifier is a unique identifier of the wireless local area network; Receiving the service set identifier from the authentication server; When the terminal device is not connected to the wireless local area network corresponding to the service set identifier, try to access the wireless local area network corresponding to the service set identifier; When the terminal device accesses the wireless local area network corresponding to the service set identifier, the identity authentication request is sent to an authentication server, where the identity authentication request includes the identity information of the terminal device.

3. The network authentication method according to claim 1, characterized in that: Before sending the identity authentication request to the authentication server, the method further includes: Sending an address information request of the terminal device to the Internet Protocol address of the wireless controller, so that the wireless controller obtains the address information of the terminal device in response to the address information request; The address information of the terminal device is received from the wireless controller, and the identity information of the terminal device is determined according to the address information.

4. The network authentication method according to claim 3, characterized in that: Before sending the address information request of the terminal device to the Internet Protocol address of the wireless controller, the method further includes: Sending an authentication point confirmation request of a preset domain name, so that the access point device of the wireless local area network intercepts the authentication point confirmation request and resolves the preset domain name to obtain the Internet Protocol address of the wireless controller; An Internet Protocol address of the wireless controller is received from the access point device.

5. The network authentication method according to any one of claims 1 to 4, characterized in that: The preset authentication information provided by the designated account includes a network authentication link and an authentication identification code, and the obtaining of a network authentication request of the terminal device includes: In the case of receiving a trigger signal for the network authentication link from the terminal device, or receiving an identification signal for the authentication identification code from the terminal device, determining that a network authentication request from the terminal device is obtained; The trigger signal is triggered and sent by the terminal device when detecting a click operation on the network authentication link; the identification signal is triggered and sent by the terminal device when detecting a scan operation on the authentication identification code.

6. An authentication client, characterized in that: include: An acquisition module, used to acquire a network authentication request of a terminal device, wherein the network authentication request carries a network identifier bound to a designated account, and the network authentication request is obtained by triggering preset authentication information provided by the designated account; A sending module, configured to send an identity authentication request to an authentication server when accessing the wireless local area network mapped with the network identifier, so that the authentication server performs identity verification on the terminal device based on the identity information of the terminal device in the identity authentication request; A receiving module, used to receive access authorization information from the authentication server after identity verification passes; The sending module is further used to send the access authorization information to the wireless controller of the wireless local area network, so that the wireless controller releases the network access request of the terminal device based on the access authorization information.

7. A terminal device, characterized in that: It comprises an authentication client, and the authentication client is used to implement the steps of the network authentication method according to any one of claims 1 to 5.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the steps of the network authentication method according to any one of claims 1 to 5 are implemented.

9. A readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the steps of the network authentication method according to any one of claims 1 to 5 are implemented.

10. A computer program product, characterized in that The computer program product comprises a computer program, which, when executed by a processor, enables the steps of the network authentication method according to any one of claims 1 to 5 to be implemented.

Images