Authentication method and device and related equipment

Abstract

The invention provides an authentication method and related equipment to improve the authentication efficiency and reduce the burden of an authentication server. The method comprises the steps that a first wireless controller receives a request message from an AP, the request message is used for requesting association between target terminal equipment and the AP, and the request message comprises an MAC address of a terminal; the first wireless controller judges whether a portal authentication-free list stored in the first wireless controller comprises the MAC address of the target terminal equipment or not, wherein the portal authentication-free list comprises the MAC address of the terminal equipment passing the portal authentication; and when the portal-authentication-free list comprises the MAC address of the target terminal equipment, the first wireless controller determines that the target terminal equipment passes the authentication.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to an authentication method, device and related equipment. Background Art

[0002] Portal authentication is also commonly referred to as web authentication, and portal authentication websites are generally called portal pages. When users go online, they must authenticate on the portal page. If the authentication fails, they can only access specific network resources. Only after the authentication succeeds, they can access other network resources. The client does not need to install additional software and can authenticate directly on the web page. It is simple, convenient, and mature in technology, and is widely used in networks such as operators, fast food chains, hotels, and schools.

[0003] In order to avoid the user frequently performing portal authentication when the terminal device reconnects to the wireless network after being disconnected from the wireless network, the portal authentication with media access control (MAC) priority can be used to achieve the terminal device access to the network without portal authentication within the validity period. MAC priority portal authentication means that after the user successfully performs portal authentication, he disconnects from the network and reconnects within a certain period of time, and can directly access through MAC authentication without entering the username and password to re-authenticate the portal. Specifically, when the client user authenticates for the first time, the access device will send the client's MAC address to the authentication server for authentication, but because the authentication server does not find the MAC address information, the authentication fails, triggering the client user to perform portal authentication. After the authentication is successful, the authentication server will automatically save the client's MAC address. When the client tries to access the network again due to unstable wireless signal or leaving the wireless signal coverage area, the access device will send the client's MAC address to the RADIUS server for authentication.

[0004] The current MAC-first portal authentication has the problem of heavy load on the authentication server and long latency. In addition, the authentication server needs to support the function of caching MAC addresses. MAC-first portal authentication cannot be flexibly deployed and its application scenarios are limited. Summary of the invention

[0005] The present application provides an authentication method, apparatus and related equipment to solve the problems of heavy authentication server load, long authentication delay and limited application scenarios in the current MAC-priority portal authentication.

[0006] In the first aspect, the present application provides an authentication method. The first wireless controller receives a request message from an access point (AP), the request message is used to request to associate a target terminal device with the AP, and the request message includes the MAC address of the terminal. The first wireless controller determines whether the MAC address of the target terminal device is in the portal-free authentication list stored by the first wireless controller, and the portal-free authentication list includes the MAC addresses of terminal devices that have passed the portal authentication. That is, the MAC addresses in the portal-free authentication list are MAC addresses of terminal devices that do not require portal authentication. When the MAC address of the target terminal device is included in the portal-free authentication list, the first wireless controller determines that the target terminal device has passed the authentication. The MAC authentication of the terminal device is implemented by the wireless controller, that is, the MAC authentication function is deployed on the wireless controller, and the deployment is more flexible, which can reduce the access burden of the authentication server. Since the MAC authentication in this embodiment does not require the terminal device to interact with the authentication server, it can also reduce the MAC authentication delay and improve the authentication efficiency.

[0007] In a possible implementation, the first wireless controller determines that the target terminal device has passed the authentication, including: the first wireless controller sends an indication to the AP that the target terminal device has passed the authentication. Thus, when the AP receives a hypertext transfer protocol (HTTP) request or a hypertext transfer protocol secure (HTTPS) request message from the target terminal device, it can determine whether to release the messages according to the indication.

[0008] In a possible implementation, the first wireless controller includes a built-in portal server, and the method further includes: if the first wireless controller receives a hypertext transfer protocol HTTP / secure hypertext transfer protocol HTTPS request message from a target terminal device, the first wireless controller sends an HTTP / HTTPS response message to the target terminal device, and the HTTP / HTTPS response message includes a portal authentication page. Thus, when the target terminal device fails to pass the authentication, the mandatory portal authentication of the target terminal device is implemented, thereby improving the security of the network.

[0009] In a possible implementation, the method further includes: if the user information of the target terminal device passes the portal authentication, the first wireless controller adds the MAC address of the target terminal device to the portal authentication-free list, and the user information is collected through the portal authentication page. After the target terminal device passes the portal authentication, the MAC address of the target terminal device is added to the portal authentication-free list, so that when the target terminal device re-accesses the wireless network, it can be determined whether the terminal device still needs to perform portal authentication based on the portal authentication-free list. When the MAC address of the target terminal device still exists in the portal authentication-free list, the target terminal device does not need to perform portal authentication, and the user does not need to enter user information on the portal authentication page, thereby achieving seamless access.

[0010] In a possible implementation, the method further includes: when the time length of the target terminal device's MAC address being added to the portal-free authentication list exceeds a preset time length, the first wireless controller deletes the target terminal device's MAC address from the portal-free authentication list. A validity period is set for the MAC address in the portal-free authentication list, and when the time length of the target terminal device's MAC address being added to the portal-free authentication list (i.e., the time length from the target terminal device's last portal authentication) exceeds a preset time length, the target terminal device's MAC address in the portal-free authentication list is deleted. Thus, when the target terminal device accesses again, if the target terminal device's MAC address does not exist in the portal-free authentication list, the target terminal device needs to perform portal authentication, thereby improving the integrity of the network.

[0011] In a possible implementation, after the first wireless controller determines that the target terminal device has passed the portal authentication, the first wireless controller further includes: sending the MAC address of the target terminal device to the second wireless controller. Or the first wireless controller sends the MAC address of the target terminal device and the portal cache remaining time of the target terminal device to the second wireless controller. Thus, when the target terminal device accesses the AP managed by the second wireless controller, it can also access without portal authentication, which can improve the coverage of portal authentication-free access.

[0012] The remaining cache time is the remaining retention time of the MAC address of the target terminal device in the portal-free authentication list. The remaining cache time is variable and decreases over time. When the remaining cache time corresponding to the MAC address of the target terminal device is 0 at a certain moment, the function of the MAC address for portal-free authentication fails, and the first wireless controller deletes the MAC address of the target terminal device in the portal-free authentication list. The remaining cache time can shield the influence of clock asynchrony between different wireless controllers, so that different wireless controllers delete the MAC addresses in their respective portal-free authentication lists at the same time as possible.

[0013] The second aspect provides a communication device. The communication device is applied to a wireless controller. The device includes a transceiver module and a processing module. The transceiver module is used to receive a request message from an AP, the request message is used to request to associate a target terminal device with an AP, and the request message includes a media access control MAC address of the terminal. The processing module is used to determine whether the MAC address of the target terminal device is in a portal-free authentication list stored in a first wireless controller, the portal-free authentication list includes the MAC addresses of terminal devices that have passed portal authentication. The processing module is used to determine that the target terminal device has passed authentication when the MAC address of the target terminal device is included in the portal-free authentication list.

[0014] In a possible implementation, the transceiver module is further configured to send an indication to the AP that the target terminal device has passed authentication.

[0015] In a possible implementation, the wireless controller includes a built-in portal server. The transceiver module is further configured to send a HTTP / HTTPS response message to the target terminal device upon receiving a Hypertext Transfer Protocol (HTTP) / Secure Hypertext Transfer Protocol (HTTPS) request message from the target terminal device, wherein the HTTP / HTTPS response message includes a portal authentication page.

[0016] In a possible implementation, the processing module is used to add the MAC address of the target terminal device to the portal authentication-free list when the user information of the target terminal device passes the portal authentication, and the user information is collected through the portal authentication page.

[0017] In a possible implementation, the processing module is configured to delete the MAC address of the target terminal device from the portal-free authentication list when the duration for which the MAC address of the target terminal device has been added to the portal-free authentication list exceeds a preset duration.

[0018] In a possible implementation, the transceiver module is further used to send the MAC address of the target terminal device to the second wireless controller. Or the transceiver module is further used to send the MAC address of the target terminal device and the portal cache remaining time of the target terminal device to the second wireless controller.

[0019] A third aspect provides a network device, which includes a processor and a memory, wherein the processor is coupled to the memory, and the processor is configured to execute the authentication method in the first aspect or any possible implementation of the first aspect based on instructions stored in the memory.

[0020] A fourth aspect provides a computer-readable storage medium, which includes instructions, and when the computer-readable storage medium is executed on a network device, the network device executes the authentication method in the first aspect or any possible implementation of the first aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] Figure 1 A schematic diagram of the architecture of a WLAN system provided in this application;

[0022] Figure 2 A network diagram of a portal authentication system provided for this application;

[0023] Figure 3 A flow chart of a portal authentication method provided for this application;

[0024] Figure 4a A network diagram of an authentication system provided for this application;

[0025] Figure 4b Network diagram of another authentication system provided for this application

[0026] Figure 5 A schematic diagram of the interaction process of an authentication method provided for this application;

[0027] Figure 6 A schematic diagram of the interaction flow of another authentication method provided for this application;

[0028] Figure 7 A schematic diagram of the structure of a communication device provided by the present application;

[0029] Figure 8 A schematic diagram of the structure of a network device provided for this application. DETAILED DESCRIPTION

[0030] The present application provides an authentication method and related equipment to improve authentication efficiency.

[0031] The following describes the embodiments of the present application in conjunction with the accompanying drawings. Obviously, the described embodiments are only embodiments of a part of the present application, rather than all embodiments. It is known to those skilled in the art that with the development of technology and the emergence of new scenarios, the technical solutions provided by the present application are also applicable to similar technical problems.

[0032] The terms "first", "second", etc. in the specification and claims of this application and the above drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. In the description of this application, unless otherwise specified, the meaning of "plurality" refers to two or more.

[0033] The word “exemplary” is used exclusively herein to mean “serving as an example, example, or illustration.” Any embodiment described herein as “exemplary” is not necessarily to be construed as preferred or advantageous over other embodiments.

[0034] Wireless local area network (WLAN) is a wireless computer network that uses wireless channels instead of wired transmission media to connect two or more devices to form a local area network (LAN). In recent years, with the explosive growth of wireless terminal devices such as smart phones, laptops, tablet computers and smart home appliances, WLAN has been widely used in homes, campuses, corporate offices, industrial manufacturing sites, hotels, scenic spots, stadiums, waiting halls and airport lounges. WLAN access has become one of the main ways to access the Internet, and users can easily access the Internet through WLAN.

[0035] like Figure 1 As shown, Figure 1 This is a schematic diagram of the architecture of a WLAN system provided in this application. It can be understood that Figure 1 The number of APs, wireless controllers and terminal devices is only an example. The WLAN system includes one or more wireless access points (APs). AP is an access device in the WLAN, which is used to provide wireless access services for terminal devices (also called workstations (STA) in the WLAN). Since the wireless signal coverage of a single AP is small, multiple APs need to be deployed in large-scale places such as campuses, hotels, office buildings, parks, scenic spots, stadiums, waiting halls and airport lounges to ensure large-scale coverage of wireless signals. Therefore, the WLAN system may also include one or more wireless controllers. In the scenario of multiple AP networking, the AP can work in the thin AP (fit AP) mode, and the wireless controller can uniformly manage and control these APs. Specifically, the wireless controller can control parameters such as the operating frequency, power, channel allocation and data transmission rate of the AP, and can also provide functions such as network access control to ensure network security. The wireless controller can configure multiple APs in batches, without the need to configure the APs one by one, which can reduce the management and maintenance costs of the WLAN.

[0036] STA and AP send and receive data through wireless channels, and the wireless channels are open, which leads to certain security risks in WLAN. In order to ensure the security of WLAN and manage the access users such as authorization and billing, WLAN can be configured with user access authentication. The device that manages user access authentication can be called an authentication control point. The authentication control point in WLAN can be an AP. When the WLAN includes a wireless controller, the authentication control point can also be a wireless controller. User access authentication is used to authenticate the wireless access users of WLAN. Users who fail to pass the user access authentication can only access the specified network resources, and users who pass the user access authentication can access other network resources, ensuring that the security risks of WLAN are controllable. User access authentication includes authentication methods such as 802.1x authentication, portal authentication, and media access control (MAC) authentication. In practice, one of the authentication methods can be selected according to business needs to implement user access authentication, or multiple authentication methods can be selected to combine to implement user access authentication.

[0037] Among them, portal authentication is also called web authentication. The portal authentication website is generally called a portal page. When users go online, they must authenticate on the portal page. If the authentication fails, they can only access specific network resources. Only after the authentication succeeds, can they access other network resources. Users can authenticate through the portal authentication page displayed on the STA's browser. There is no need to install additional software on the STA. The authentication method is simple and flexible. In addition, the portal authentication page can be customized. For example, advertisements, corporate promotions, and information prompts can be pushed through the portal authentication page. Therefore, portal authentication is widely used in operator WLANs, as well as WLANs in enterprises, institutions, catering places, hotels, and schools.

[0038] Portal authentication includes active portal authentication and captive portal authentication. Active portal authentication means that the user actively visits a known portal authentication website and enters user information such as username and password on the portal authentication page provided by the portal authentication website for authentication. Captive portal means that when a user attempts to access other unauthorized websites through a hypertext transfer protocol (HTTP) request or a hypertext transfer protocol secure (HTTPS) request, he will be redirected to a portal page. If the portal page is an authentication page, the portal authentication process begins, that is, the user is forced to visit the portal authentication website for portal authentication.

[0039] like Figure 2 As shown, Figure 2A network diagram of a portal authentication system provided for this application. The portal authentication system includes a client, an access device, a portal server, and an authentication server. Among them, the client is a host installed with a browser running the HTTP / HTTPS protocol, which is used to initiate HTTP / HTTPS requests. When the portal authentication system is deployed in a WLAN, the client is a STA in the WLAN. The portal server is used to receive client authentication requests and provide a portal authentication page for the client. The client is also used to send a portal authentication request based on the user information entered by the user on the portal authentication page. The authentication server is used to complete user identity authentication based on user information, as well as user authorization and billing after the user authentication is passed. The access device is a general term for devices such as APs and wireless controllers in WLAN. Before authentication, the access device is used to redirect HTTP / HTTPS requests from the client to the portal server. During the authentication process, the access device interacts with the portal server and the authentication server to complete user identity authentication, authorization and billing. After the authentication is passed, the access device allows the client to access network resources authorized by the authentication server.

[0040] Specifically, Figure 3 shown. Figure 3 A flowchart of a portal authentication method provided for this application. Figure 3 The illustrated example is a mandatory portal authentication process. The active portal authentication process does not have any redirection-related steps, and the client actively sends an HTTP / HTTPS request message to the portal server. Figure 3The AP and AC are access devices. Before authentication, a pre-connection has been established between the client and the AP, that is, the client user has established a user online table entry on the AP before the authentication is successful, and has only partial network access rights. The specific process of portal authentication is that the client initiates an HTTP / HTTPS request. When the AP determines that the received message is an HTTP / HTTPS request message based on the message port number (for example, the port number of the HTTP request message is 80, and the port number of the HTTPS request message is 443), if it is an HTTP / HTTPS request message to access the portal server or an authentication-free network resource, the AP allows it to pass; if it is an HTTP / HTTPS request message to access other addresses, the AP sends an HTTP / HTTPS redirect message to the client, and the HTTP / HTTPS redirect message includes the uniform resource locator (URL) address or IP address of the portal server to redirect the client's HTTP / HTTPS request message to the portal server. The client initiates an HTTP / HTTPS request to the portal server based on the URL address or IP address in the HTTP / HTTPS redirect message returned by the AP. The portal server returns the portal authentication page to the client. After the user enters user information such as username and password on the portal authentication page, the client initiates a portal authentication request to the portal server. The portal authentication request includes the user information entered by the user on the portal authentication page. After the portal server receives the portal authentication request, it sends the portal authentication request to the wireless controller based on CHAP authentication or PAP authentication. The wireless controller sends a 3A authentication request to the authentication server based on the user information obtained from the portal authentication request. The authentication server authenticates the user information, obtains an authentication result indicating whether the authentication is passed, and sends the authentication result to the wireless controller. If the authentication result indicates that the user information has passed the authentication, the wireless controller can open the user's network access rights, allow the corresponding client to access other network resources, and send the portal authentication success page to the client through the AP. If the authentication result indicates that the user information has not passed the authentication, the corresponding client is denied access to other network resources.

[0041] When the client repeatedly leaves and enters the wireless signal coverage area of ​​the AP due to location movement, the portal authentication process will be triggered each time the client re-accesses the AP. If you do not want to perform portal authentication frequently within a certain period of time, you can configure the MAC-prioritized portal authentication function for the WLAN. The so-called MAC-prioritized portal authentication means that when authenticating a user, MAC authentication will be performed first, and when MAC authentication fails, portal authentication will be performed. Specifically, the process of MAC-prioritized portal authentication is that when the client user authenticates for the first time, the wireless controller will send the client's MAC address to the authentication server for authentication (MAC authentication stage), but because the authentication server does not find the MAC address information, the MAC authentication fails. In response to the client MAC authentication failure, the wireless controller redirects the client's HTTP / HTTPS request to the portal server, triggering the client user to perform portal authentication (portal authentication stage). After the portal authentication is successful, the authentication server will save the client's MAC address. When the client tries to access the AP again due to unstable wireless signal or leaving the AP wireless signal coverage area, causing the client to drop offline, the wireless controller will send the client's MAC address to the authentication server for authentication (MAC authentication stage). If the client's MAC address is still saved in the authentication server, the authentication server will verify the MAC address and directly authorize the user. After the user is authorized, he can directly access the network without having to go through the portal authentication again and enter the username and password for authentication. If the client's MAC address has expired in the authentication server, the authentication server will delete the saved client's MAC address. After the MAC address authentication fails, the wireless controller redirects the client's HTTP / HTTPS request to the portal server, triggering the client user to perform portal authentication.

[0042] MAC-first portal authentication requires frequent interactions between the wireless controller and the portal server and authentication server. On the one hand, the interaction between the access device and the external server (an independent entity outside the wireless controller) will increase the authentication, and on the other hand, it will increase the number of visits to the authentication server, resulting in a heavy load on the authentication server. How to reduce the latency and load of the MAC-first portal authentication process has become an urgent problem to be solved.

[0043] In order to solve the above problems, the present application provides the following embodiments.

[0044] like Figure 4a and Figure 4b As shown, Figure 4a A network diagram of an authentication system provided for this application; Figure 4bA network diagram of another authentication system provided in this application. The authentication system is used to implement wireless access authentication in a WLAN scenario. In this embodiment, the authentication system includes a wireless controller and an AP. The wireless controller is used to complete security, control, and management functions, such as mobility management, identity authentication, and radio frequency resource management. The wireless controller can be directly connected in the authentication system, such as Figure 4a The wireless controller can also be a side-mounted network, such as Figure 4b As shown in the figure, AP is used to complete the wireless radio access function and provide wireless access services for terminal devices, such as wireless signal transmission and detection response, data encryption and decryption, data transmission confirmation, etc.

[0045] The wireless controller can manage and control one or more APs. Optionally, when the wireless controller manages multiple APs, the authentication system may further include a switch (not shown), and multiple APs may be connected to the wireless controller through the switch. In one possible implementation, the authentication system may further include an authentication server. The authentication server is used to authenticate the user identity according to the user information during the portal authentication process. The authentication server may be a remote authentication dial-In user service (RADIUS) server, a terminal access controller access-control system (TACACS), an HWTACACS server, a Lightweight Directory Access Protocol (LDAP) server, a Diameter server, etc. In another possible implementation, the authentication system may also not include an authentication server, and the wireless controller stores user information for user identity authentication. During the portal authentication process, the wireless controller performs local authentication of the user identity according to the stored user information.

[0046] The wireless controller and AP can communicate through the control and provisioning of wireless access points (CAPWAP) protocol or other protocols (such as the Generic Routing Encapsulation (GRE) protocol). The wireless controller can centrally manage and control its associated APs through the CAPWAP protocol. The CAPWAP protocol includes two types of messages: management messages (control messages) and data messages. Management messages mainly carry information elements, which are used for AC configuration of AP working parameters and maintenance of CAPWAP tunnels. Data messages mainly carry data messages sent by terminal devices and are used to transmit upper-layer data of terminal devices. Management messages are forwarded through the CAPWAP control tunnel. User data messages include tunnel forwarding (also known as "centralized forwarding") and direct forwarding (also known as "local forwarding"). The tunnel forwarding method means that after the user's data message reaches the AP, it needs to be encapsulated in the CAPWAP data tunnel and sent to the wireless controller, and then forwarded to the upper network by the wireless controller. Direct forwarding means that after the user's data message reaches the AP, it is directly forwarded to the upper layer network without being encapsulated by the CAPWAP tunnel.

[0047] In this embodiment, the authentication control point is deployed on the wireless controller. In addition, the wireless controller includes a built-in portal server, that is, the portal server runs in the wireless controller. The built-in server in the wireless controller can provide basic functions such as going online and offline through the Web. During the portal authentication process, the built-in portal server provides the terminal device with a portal authentication page. By performing portal authentication through the built-in portal server, since there is no need to deploy an additional portal server, the authentication cost can be reduced, and the interaction delay between the wireless controller and the portal server can be reduced.

[0048] In this embodiment, the wireless controller can implement the MAC authentication function. When the terminal device accesses the WLAN, it sends an association request to the AP to request the association between the terminal device and the AP. After receiving the association request, the AP obtains the MAC address and other information of the terminal device in the association request, constructs a request message and sends it to the wireless controller through a tunnel. After receiving the request message, the wireless controller obtains the MAC address of the terminal device therein, and determines whether the MAC address exists in the portal-free authentication list stored in the wireless controller. The portal-free authentication list includes the MAC addresses of terminal devices that have passed the portal authentication. If the MAC address exists in the portal-free authentication list, the wireless controller confirms that the terminal device has been authenticated and sends an indication of the authentication of the terminal device to the AP. If the MAC address does not exist in the portal-free authentication list, it is confirmed that the terminal device has not been authenticated. When the terminal device initiates an HTTP / HTTPS request, the AP redirects the HTTP / HTTPS request to the built-in portal server in the wireless controller, triggering the portal authentication process.

[0049] Implementing the MAC-priority portal authentication function on the wireless controller, on the one hand, can solve the problem that the built-in portal server does not support any extended functions of the external independent server, such as not supporting MAC-priority portal authentication. On the other hand, in the process of implementing MAC-priority portal authentication, the wireless controller does not need to interact frequently with the authentication server during the MAC authentication stage, which can simplify the authentication process and reduce the authentication delay. On the other hand, compared with the authentication control point located at the AP, since the number of wireless controllers in the authentication system is less than that of APs, the authentication control point located at the wireless controller can greatly reduce the authentication control point, thereby reducing the configuration complexity and the difficulty of data migration. On the other hand, the access authentication of the terminal device is uniformly managed by the wireless controller, and the terminal device can realize wireless roaming between APs managed by the wireless controller. That is, when the terminal device switches AP, it can also realize seamless access based on the MAC-priority portal authentication function of the wireless controller, without the need for the terminal device to re-authenticate the portal.

[0050] like Figure 5 As shown, Figure 5 This is a schematic diagram of an interactive process of an authentication method provided by this application. This embodiment includes the following steps:

[0051] S501: The AP receives an association request message or a re-association request message from a target terminal device.

[0052] Whether the terminal device accesses the AP for the first time or re-accesses the AP after being disconnected from the AP, a series of access interactions are required between the terminal device and the AP to complete the access of the terminal device. The situation where the terminal device re-accesses the AP after being disconnected from the AP includes, for example, the terminal device re-enters the coverage of the AP after leaving the coverage of the AP's wireless signal, and the terminal device actively goes offline and then goes online again. When multiple virtual access points (VAPs) are created on the AP, switching between different VAPs of the AP may also require re-access. For example, a first VAP and a second VAP are created on the AP. If the service set identifiers (SSIDs) of the first VAP and the second VAP are different, if the terminal device accesses the first VAP of the AP and then switches to the second VAP of the AP, access interactions are also required between the terminal device and the AP before the terminal device can access the second VAP.

[0053] The target terminal device is the terminal device to be authenticated. The process of the target terminal device accessing the wireless network includes the scanning phase, link authentication phase and association phase. In the scanning phase, the target terminal device obtains the surrounding wireless network information, such as the AP's SSID, through dominant scanning or passive scanning. In the link authentication phase, the target terminal device performs link authentication with the AP, and after the link authentication, the target terminal device and the AP establish a connection. In the association phase, the target terminal device negotiates link services with the AP. In this phase, the target terminal device sends an association request message or a reassociation request message to the AP to request the association between the AP and the target terminal device.

[0054] S502: The AP obtains a request message according to the association request message or the reassociation request message, where the request message includes a MAC address of the target terminal device.

[0055] The association request message / reassociation request message is a management message. If the AP and the wireless controller use the CAPWAP protocol to communicate, the AP can send it to the first wireless controller that manages the AP through the CAPWAP tunnel. Therefore, after the AP receives the association request message or reassociation request message from the target terminal device, it will perform CAPWAP encapsulation on the association request message or reassociation request message to obtain a request message. The request message is used to request the wireless controller to associate the target terminal device with the AP.

[0056] In this embodiment, the request message includes the MAC address of the target terminal device. The MAC address of the target terminal device in the request message can be obtained by the AP from the source MAC address field of the message header of the association request message or the reassociation request message. After the AP obtains the request message, S502 is executed.

[0057] S503: The AP sends a request message to the first wireless controller.

[0058] S504: The first wireless controller determines whether the MAC address of the target terminal device is in the portal-free authentication list stored in the first wireless controller.

[0059] Since the request message for requesting association between the AP and the target terminal device is sent to the first wireless controller during the access process of the AP target terminal device, the request message can enable the first wireless controller to perceive that the target terminal device is accessing the wireless network. The request message can trigger the first wireless controller to perform MAC authentication on the target terminal device to determine whether the target terminal device needs portal authentication for accessing the wireless network this time. MAC authentication can complete the verification based on the MAC address of the terminal device, without the user having to enter user information such as account password, etc. The authentication efficiency is high and the terminal device can be authenticated without feeling.

[0060] Specifically, in this embodiment, the first wireless controller stores a portal-free authentication list. The portal-free authentication list includes MAC addresses of terminal devices that do not currently need portal authentication. The MAC addresses in the portal-free authentication list are MAC addresses of terminal devices that have passed portal authentication. Optionally, in order to improve the security of the WLAN, a validity period can be set for the MAC addresses in the portal-free authentication list. Specifically, when the time length of the MAC address being added to the portal-free authentication list is greater than a preset time length, that is, when the time interval from the last portal authentication of the terminal device is greater than the preset time length, the MAC address is confirmed to be invalid, and the MAC address is deleted from the portal-free authentication list, thereby ensuring that the MAC addresses in the portal-free authentication list are all MAC addresses within the validity period. It should be noted that the portal-free authentication list refers to a collection of MAC addresses of terminal devices that do not currently need portal authentication, rather than limiting the MAC addresses of terminal devices that do not currently need portal authentication to be stored in a data structure such as a list.

[0061] The MAC addresses in the portal-free authentication list may include the MAC addresses of terminal devices that have passed portal authentication via the first wireless controller. Passing portal authentication via the first wireless controller means that the terminal device has accessed the AP managed by the first wireless controller, and then the first wireless controller, as an access device in the authentication system, participates in completing the portal authentication of the terminal device. Since the first wireless controller manages multiple APs, the MAC addresses in the portal-free authentication list may include the MAC addresses of terminal devices associated with multiple APs managed by the first wireless controller. The MAC address of the terminal device in the portal-free authentication list may not be bound to the AP associated with the terminal device, so that the terminal device roams between different APs managed by the first wireless controller, and when the MAC address of the terminal device is included in the portal-free authentication list, the terminal device can be exempted from portal authentication.

[0062] Optionally, the MAC addresses in the portal-free authentication list may also include MAC addresses of terminal devices that have passed portal authentication via other wireless controllers. For example, a WLAN includes multiple wireless controllers, and the multiple wireless controllers in the WLAN are divided into wireless roaming groups, and the wireless roaming group includes at least two wireless controllers. When a terminal device accessing an AP managed by a wireless controller passes portal authentication, the wireless controller will not only add the MAC address of the terminal device to its own stored portal-free authentication list, but also send the MAC address of the terminal device to other wireless controllers in the same wireless roaming group. After receiving the MAC address of the terminal device, the other wireless controllers in the wireless roaming group will add it to their own stored portal-free authentication list. The wireless controllers in the wireless roaming group share the portal-free authentication list, so that the terminal device roams between different wireless controllers in the same roaming group, and when the portal-free authentication list of the wireless controller newly associated with the terminal device includes the MAC address of the terminal device, the terminal device can be exempted from portal authentication.

[0063] Optionally, when the wireless controller sends the MAC address of the terminal device that has passed the portal authentication to other wireless controllers in the same wireless roaming group, it may also send the remaining cache time of the terminal device, so that other wireless controllers can manage the MAC address of the terminal device in the portal authentication-free list according to the remaining cache time of the terminal device, and delete it from the portal authentication-free list when the remaining cache time is 0. Alternatively, when the wireless controller sends the MAC address of the terminal device that has passed the portal authentication to other wireless controllers in the same wireless roaming group, it may not send the remaining cache time of the terminal device, but notify other wireless controllers to delete the MAC address in the portal authentication-free list when the MAC address is invalid.

[0064] The MAC address in the portal-free authentication list is configured with an expiration date, for example, and the duration of the expiration date is a preset duration. When the time after the MAC address is added to the portal-free authentication list is longer than the preset duration, the MAC address is considered to have exceeded the validity period, and the wireless controller can delete it. The remaining cache duration when the MAC address is added to the portal-free authentication list is equal to the preset duration, and then the remaining cache duration gradually decreases. The remaining cache time can be used to determine whether the current time interval from the MAC address being added to the portal-free authentication list is greater than the preset duration. When the remaining cache time is equal to 0, the current time interval from the MAC address being added to the portal-free authentication list is equal to the preset duration, and then the MAC address can be deleted.

[0065] In another implementation, the wireless controller sends the MAC address of the terminal device and the authentication passing time when the authentication is passed to other wireless controllers, so that each wireless controller calculates the time interval between the current and the authentication passing time, and compares it with the preset time length. When the time interval is greater than the preset time length, the MAC address is deleted from the portal-free authentication list. Alternatively, the wireless controller starts a timer at the time when the terminal device passes the authentication, and when the accumulated time length of the timer reaches the preset time length, the MAC address is deleted from the portal-free authentication list.

[0066] Optionally, when the terminal device has passed the portal authentication and the MAC address of the terminal device still exists in the portal-free authentication list (that is, the MAC address is still valid), the terminal device may initiate active portal authentication. After the active portal authentication is passed, the wireless controller can add the MAC address to the portal-free authentication list again, and the remaining cache time corresponding to the MAC address is updated to be equal to the preset duration. Alternatively, the wireless controller can directly modify the remaining cache time corresponding to the MAC address. Optionally, the wireless controller can also send the MAC address and the remaining cache time to other wireless controllers in the wireless roaming group so that other wireless controllers can update the remaining cache time corresponding to the MAC address.

[0067] Therefore, the MAC addresses in the portal-free authentication list stored in the first wireless controller can be updated timely and dynamically, ensuring that the MAC addresses in the portal-free authentication list are currently valid MAC addresses, thereby ensuring network security.

[0068] Optionally, the first wireless controller includes a non-volatile memory, and the portal-free authentication list is stored in the non-volatile memory, so that after the first wireless controller is powered off and restarted, the portal-free authentication list is still stored in the first wireless controller and will not be cleared, thereby improving the stability and reliability of the authentication system.

[0069] After receiving the request message, the first wireless controller obtains the MAC address of the target terminal device in the request message. Then the first wireless controller determines whether the MAC address of the target terminal device exists in the portal-free authentication list. If the portal-free authentication list includes the MAC address of the target terminal device, that is, the MAC address of the target terminal device is in the portal-free authentication list, it means that the target terminal device has previously passed the portal authentication, and this access does not require portal authentication, and S505a is executed. If the portal-free authentication list does not include the MAC address of the target terminal device, that is, the MAC address of the target terminal device is not in the portal-free authentication list, it means that the target terminal device has not previously passed the portal authentication, or the time interval between the target terminal device and the last portal authentication is long, and the MAC address of the target terminal device has been deleted from the portal-free authentication list, and S505a is executed.

[0070] S505a: When the MAC address of the target terminal device is included in the portal-free authentication list, the first wireless controller determines that the target terminal device passes the authentication.

[0071] The first wireless controller determines that the target terminal device has passed the authentication, which may include the first wireless controller sending an indication that the target terminal device has passed the authentication to the AP, so that the AP allows the target terminal device to access the authorized network resources according to the indication. The first wireless controller sends an indication that the target terminal device has passed the authentication to the AP, which can be used to instruct the AP to cancel the pre-connection authorization of the target terminal device and open the target terminal device to access the complete network. Before portal authentication, the first wireless controller can allow the target terminal device to have partial network access rights by configuring pre-connection authorization. Partial network access rights, for example, allow the target terminal device to access network resources such as portal servers, domain name system (DNS) servers, and dynamic host configuration protocol (DHCP) servers, but not allow access to network resources other than designated network resources. Therefore, after canceling the pre-connection authorization of the target terminal device, the target terminal device has the right to access the complete network.

[0072] S505b: When the portal-free authentication list does not include the MAC address of the target terminal device, the first wireless controller determines that the target terminal device has not passed the authentication.

[0073] If the portal-free authentication list does not include the MAC address of the target terminal device, the target terminal device fails the authentication (MAC authentication fails), and the target terminal device still needs to perform portal authentication.

[0074] Optionally, the first wireless controller may send an indication to the AP that the target terminal device has not passed the authentication. The first wireless controller may send an indication to the AP that the target terminal device has not passed the authentication, which may be an indication to configure the pre-connection authorization of the target terminal device. The target terminal device is in a pre-connection state after the MAC authentication fails, and the pre-connection authorization configured on the target terminal device enables the target terminal device to have partial network access rights. That is, the target terminal device can only access the authorized part of the network, and the target terminal device has no right to access other networks.

[0075] Optionally, if the target terminal device quickly accesses the AP after disconnecting from the AP managed by the first wireless controller, the first wireless controller may not have deleted the authenticated information of the target terminal device. Therefore, before S504, after receiving the request message, the first wireless controller can also first determine whether the first wireless controller stores the authenticated information of the target terminal device based on the MAC address of the target terminal device in the request message. If the authenticated information of the target terminal device is not deleted in the first wireless controller, S504 may not be executed, and an indication of the target terminal device passing the authentication may be directly sent to the AP. This improves the authentication efficiency. If the authenticated information of the target terminal device does not exist in the first wireless controller, S504 is executed.

[0076] In this embodiment, the first wireless controller stores a portal-free authentication list, which includes the MAC addresses of terminal devices that have passed the portal authentication. During the access process of the target terminal device, when the first wireless controller receives a request message for associating the target terminal device and the AP, it triggers the first wireless controller to determine whether the MAC address of the target terminal device is in the portal-free authentication list. When the MAC address of the target terminal device is in the portal-free authentication list, when it is confirmed that the target terminal device has passed the MAC authentication, the first wireless controller sends an indication to the AP that the target terminal device has passed the authentication, so that the target terminal device does not need to perform portal authentication when accessing the network, and the non-sensing authentication of the target terminal device can be achieved. In this embodiment, the MAC authentication of the terminal device is implemented by the wireless controller, that is, the MAC authentication function is unloaded to the wireless controller, which reduces the access burden of the 3A server. Since the MAC authentication in this embodiment does not require the terminal device to interact with the 3A server, it can also reduce the MAC authentication delay and improve the authentication efficiency.

[0077] When the MAC address of the target terminal device is not included in the portal authentication-free list, portal authentication is required for the target terminal device. In this embodiment, the first wireless controller includes a built-in portal server. During the portal authentication process of the target terminal device, the built-in portal server in the first wireless controller provides portal authentication services for the target terminal device.

[0078] like Figure 6 As shown, Figure 6 This is a schematic diagram of the interaction process of another authentication method provided by this application. Figure 5 In the authentication method embodiment, similar steps are not repeated in this embodiment. This embodiment includes the following steps:

[0079] S601: The terminal device sends an association request message / reassociation request message to the AP.

[0080] S602: The AP obtains a request message according to the association request message or the reassociation request message, where the request message includes a MAC address of a target terminal device.

[0081] S603: The AP sends a request message to the first wireless controller.

[0082] S604: The first wireless controller determines whether the MAC address of the target terminal device is in the portal-free authentication list stored in the first wireless controller.

[0083] S605a: When the MAC address of the target terminal device is included in the portal-free authentication list, the first wireless controller sends an indication that the target terminal device has passed the authentication to the AP.

[0084] This step is similar to S505a and will not be described again here.

[0085] S606a: The target terminal device sends an HTTP / HTTPS request message to the AP.

[0086] S607a: The AP forwards the HTTP / HTTPS request message.

[0087] The target terminal device has passed the authentication. Therefore, when the AP receives the HTTP / HTTPS request message from the target terminal device, the AP allows the HTTP / HTTPS request message from the target terminal device to pass, that is, forwards the HTTP / HTTPS request message from the target terminal device.

[0088] The AP can forward the HTTP / HTTPS request message of the target terminal device by local forwarding or centralized forwarding, which is not limited here.

[0089] S605b: When the portal-free authentication list does not include the MAC address of the target terminal device, the first wireless controller sends an indication to the AP that the target terminal device has not passed the authentication.

[0090] This step is similar to S505b and will not be described again here.

[0091] S606b: The target terminal device sends an HTTP / HTTPS request message to the AP.

[0092] S607b: The AP redirects the address of the HTTP / HTTPS request message to the built-in portal server in the first wireless controller.

[0093] The AP sends an HTTP / HTTPS redirect message to the target terminal device, the redirect message includes the URL address or IP address of the built-in portal server, and redirects the client's HTTP / HTTPS request message to the built-in portal server.

[0094] It should be noted that if the target terminal device uses active portal authentication to access the built-in portal server in the first wireless controller, S606b and S607b are not executed, but S608b is executed after S605b.

[0095] S608b: The target terminal device sends an HTTP / HTTPS request message to the built-in portal server of the first wireless controller.

[0096] S609b: The built-in portal server of the first wireless controller sends an HTTP / HTTPS response message, where the HTTP / HTTPS response message includes a portal authentication page.

[0097] S610b: The target terminal device sends a portal authentication request message to the built-in portal server of the first wireless controller.

[0098] After the user enters user information on the portal authentication page, the target terminal device initiates a portal authentication request to the built-in portal server in the first wireless controller. The portal authentication request includes the user information filled in by the target terminal device on the portal authentication page.

[0099] The portal authentication page can be an account and password authentication page, a text message authentication page, or a WeChat authentication page, etc. There is no restriction here.

[0100] S611b: The first wireless controller determines whether the target terminal device passes the portal authentication according to the portal authentication request message.

[0101] If the first wireless controller is a local authentication, that is, the first wireless controller stores the user information, then after receiving the portal authentication request message, the first wireless controller obtains the user information in the portal authentication request message, and compares whether the user information in the user information stored by the first wireless controller is consistent with the user information in the portal authentication request message. If so, it is determined that the target terminal device has passed the portal authentication. If not, it is determined that the target terminal device has not passed the portal authentication.

[0102] If the authentication is performed through an external authentication server, the first wireless controller forwards the portal authentication request message to the authentication server, and the authentication server authenticates the user information. The authentication server compares whether the user information stored in the authentication server is consistent with the user information in the portal authentication request message. If it is, it is determined that the target terminal device has passed the portal authentication. If it is not, it is determined that the target terminal device has not passed the portal authentication. After obtaining the portal authentication result, the authentication server sends the portal authentication result to the first wireless controller.

[0103] S612b: If the target terminal device passes the portal authentication, the first wireless controller adds the MAC address of the target terminal device to the portal authentication-free list.

[0104] When the target terminal device passes the portal authentication, the first wireless controller adds the MAC address of the target terminal device to the portal authentication-free list. Thus, after the target terminal device disconnects from the currently associated AP and accesses the AP again, or accesses other APs managed by the first wireless controller, the first wireless controller can determine whether the target terminal device can be exempted from portal authentication based on the MAC address of the target terminal device and the portal authentication-free list.

[0105] S613b: The first wireless controller sends the portal authentication result to the target terminal device.

[0106] Optionally, after S612b, the method further includes: the first wireless controller sends the MAC address of the target terminal device to the second wireless controller.

[0107] The second wireless controller can be a backup wireless controller for the first wireless controller, so as to ensure that in the event of a failure of the first wireless controller, the second wireless controller can achieve seamless access of the terminal device corresponding to the MAC address in the portal-free authentication list, thereby ensuring the stability of the WLAN system. The second wireless controller can also be a controller belonging to the same wireless roaming group as the first wireless controller. The first wireless controller can actively send the MAC address of the target terminal device to the second wireless controller. In another implementation, the second wireless controller can also request the first wireless controller to share or synchronize its portal-free authentication list, and the first wireless controller responds to the request of the second wireless controller and sends the MAC address of the target terminal device to the second wireless controller.

[0108] After the second wireless controller receives the MAC address of the target terminal device, it adds the MAC address of the target terminal device to its own stored portal-free authentication list, and the second wireless controller manages the MAC address of the target terminal device. Thus, when the target terminal device disconnects from the currently associated AP and accesses the AP managed by the second wireless controller, the second wireless controller can determine whether the target terminal device can be portal-free authenticated based on the MAC address of the target terminal device and its own stored portal-free authentication list. That is, when the MAC address of the target terminal device exists in the portal-free authentication list of the second wireless controller, the target terminal device can access the AP managed by the second wireless controller without portal authentication, and can still access without feeling when the target terminal device roams between wireless controllers.

[0109] Optionally, the first wireless controller may also send the cache remaining time of the target terminal device to the second wireless controller, so that the second wireless controller may determine when to delete the MAC address of the target terminal device in the portal-free authentication list according to the cache remaining time.

[0110] Optionally, when the time that the MAC address of the target terminal device is added to the portal-free authentication list exceeds a preset time, that is, when the remaining cache time of the target terminal device reaches 0, the first wireless controller deletes the MAC address of the target terminal device from the portal-free authentication list stored in itself.

[0111] In this embodiment, the first wireless controller includes a built-in portal server, which has the advantages of convenient networking, low cost, and easy maintenance. However, the device with a built-in portal server can only realize simple portal server functions, and can only provide users with basic functions of going online and offline through the Web, and does not support any extended functions of an external independent server, such as supporting 3A servers such as extended RADIUS. That is, the built-in portal server does not support MAC-first portal authentication. When the terminal device reconnects to the wireless network after sleeping or disconnecting from the wireless network, it will be redirected to the authentication page of the portal server, and the user needs to re-enter the authentication information such as the account password for the built-in portal authentication. The service recovery time is long and the customer's perception of use is poor. In this embodiment, the MAC authentication function is realized by the first wireless controller, and the MAC authentication point and the portal authentication point are both located on the first wireless controller, so that the first wireless controller can realize MAC-first portal authentication, which overcomes the defect that the built-in portal server does not support MAC-first portal authentication. Therefore, in the case of a built-in portal server, user-unaware access can be achieved. At present, MAC authentication is implemented by the authentication server. During the authentication process, the access device (such as the first wireless controller) needs to frequently interact with the authentication server, which increases the access burden of the authentication server. In this embodiment, the MAC authentication of the terminal device is implemented by the wireless controller, that is, the MAC authentication function is unloaded to the wireless controller, which reduces the access burden of the authentication server. Since MAC authentication in this embodiment does not require the terminal device to interact with the authentication server, it can also reduce the MAC authentication delay and improve the authentication efficiency. In addition, the MAC-priority portal authentication implemented by the wireless controller can also realize the seamless access of the terminal device in the scenario of roaming between AP / VAP or roaming between wireless controllers, thereby improving the coverage of the portal-free authentication function.

[0112] like Figure 7 As shown, Figure 7 A schematic diagram of the structure of a communication device provided in the present application. The communication device 700 is applied to a wireless controller. The communication device 700 can be a software function module in the wireless controller, or a hardware module in the wireless controller, such as a chip. The communication device 700 of this embodiment includes a transceiver module 701 and a processing module 702.

[0113] The transceiver module 701 is used to receive a request message from the AP, the request message is used to request to associate the target terminal device with the AP, and the request message includes the media access control MAC address of the terminal. The processing module 702 is used to determine whether the MAC address of the target terminal device is in the portal-free authentication list stored in the first wireless controller, and the portal-free authentication list includes the MAC addresses of the terminal devices that have passed the portal authentication. The processing module 702 is used to determine that the target terminal device has passed the authentication when the MAC address of the target terminal device is included in the portal-free authentication list.

[0114] In a possible implementation, the transceiver module 701 is further configured to send an indication that the target terminal device has passed authentication to the AP.

[0115] In a possible implementation, the wireless controller includes a built-in portal server. The transceiver module 701 is further configured to send an HTTP / HTTPS response message to the target terminal device upon receiving a HTTP / HTTPS request message from the target terminal device, wherein the HTTP / HTTPS response message includes a portal authentication page.

[0116] In a possible implementation, the processing module 702 is used to add the MAC address of the target terminal device to the portal authentication-free list when the user information of the target terminal device passes the portal authentication, and the user information is collected through the portal authentication page.

[0117] In a possible implementation, the processing module 702 is configured to delete the MAC address of the target terminal device from the portal-free authentication list when the duration for which the MAC address of the target terminal device has been added to the portal-free authentication list exceeds a preset duration.

[0118] In a possible implementation, the transceiver module 701 is further configured to send the MAC address of the target terminal device to the second wireless controller. Or the transceiver module 701 is further configured to send the MAC address of the target terminal device and the portal cache remaining time of the target terminal device to the second wireless controller.

[0119] like Figure 8 As shown, Figure 8 A schematic diagram of the structure of a network device provided by the present application. In this embodiment, the network device 800 may be a wireless controller.

[0120] The network device 800 includes a bus 801, a processor 802, a communication interface 803, and a memory 804. The processor 802, the memory 804, and the communication interface 803 communicate with each other via the bus 801.

[0121] The bus 801 may be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 8 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0122] The processor 802 may be any one or more of a central processing unit (CPU), a graphics processing unit (GPU), a microprocessor (MP), or a digital signal processor (DSP).

[0123] The memory 804 may include a volatile memory, such as a random access memory (RAM). The memory 804 may also include a non-volatile memory, such as a read-only memory (ROM), a flash memory, a hard disk drive (HDD), or a solid state drive (SSD).

[0124] The memory 804 may be used to store software codes related to the network authentication method, and the processor 802 may execute the steps of the authentication method and may also schedule other units to implement corresponding functions.

[0125] It should be understood that the network device 800 can be a centralized or distributed device, and the processor 802 in the network device 800 can be a hardware circuit (such as an application specific integrated circuit (ASIC), a field-programmable gate array (FPGA), a general-purpose processor, a digital signal processor (DSP), a microprocessor or a microcontroller, etc.), or a combination of these hardware circuits. For example, the processor can be a hardware system with an instruction execution function, such as a CPU, a DSP, etc., or a hardware system without an instruction execution function, such as an ASIC, an FPGA, etc., or a combination of the above-mentioned hardware systems without an instruction execution function and hardware systems with an instruction execution function.

[0126] The present application also provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a computer, the network verification method process of any of the above method embodiments is implemented.

[0127] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0128] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical or other forms.

[0129] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0130] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0131] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, all or part of the technical solution of the present application can be embodied in the form of a software product, which is stored in a storage medium and includes a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, read-only memory), random access memory (RAM, random access memory), disk or optical disk and other media that can store program code.

Claims

1. An authentication method, characterized in that: The method comprises: The first wireless controller receives a request message from an access point AP, wherein the request message is used to request association of a target terminal device with the AP, and the request message includes a media access control MAC address of the terminal; The first wireless controller determines whether the MAC address of the target terminal device is in a portal-free authentication list stored by the first wireless controller, the portal-free authentication list including MAC addresses of terminal devices that have passed portal authentication; When the portal-free authentication list includes the MAC address of the target terminal device, the first wireless controller determines that the target terminal device passes the authentication.

2. The method according to claim 1, characterized in that The first wireless controller determining that the target terminal device passes the authentication includes: The first wireless controller sends an indication to the AP that the target terminal device has passed authentication.

3. The method according to claim 1 or 2, characterized in that: The first wireless controller includes a built-in portal server, and the method further includes: If the first wireless controller receives a Hypertext Transfer Protocol (HTTP) / Hypertext Transfer Protocol Secure (HTTPS) request message from the target terminal device, the first wireless controller sends an HTTP / HTTPS response message to the target terminal device, where the HTTP / HTTPS response message includes a portal authentication page.

4. The method according to claim 3, characterized in that: The method further comprises: If the user information of the target terminal device passes the portal authentication, the first wireless controller adds the MAC address of the target terminal device to the portal authentication-free list, and the user information is collected through the portal authentication page.

5. The method according to any one of claims 1 to 4, characterized in that The method further comprises: When the duration for which the MAC address of the target terminal device is added to the portal-free authentication list exceeds a preset duration, the first wireless controller deletes the MAC address of the target terminal device from the portal-free authentication list.

6. The method according to any one of claims 1 to 5, characterized in that After the first wireless controller determines that the target terminal device passes the portal authentication, the method further includes: The first wireless controller sends the MAC address of the target terminal device to the second wireless controller; or The first wireless controller sends the MAC address of the target terminal device and the portal cache remaining time of the target terminal device to the second wireless controller.

7. A communication device, characterized in that: The device is applied to a wireless controller, and the device includes: A transceiver module, used to receive a request message from an AP, wherein the request message is used to request to associate a target terminal device with the AP, and the request message includes a media access control MAC address of the terminal; a processing module, configured to determine whether the MAC address of the target terminal device is in a portal-free authentication list stored in the first wireless controller, wherein the portal-free authentication list includes MAC addresses of terminal devices that have passed portal authentication; The processing module is configured to determine that the target terminal device has passed the authentication when the MAC address of the target terminal device is included in the portal-free authentication list.

8. The device according to claim 7, characterized in that The transceiver module is also used to send an indication that the target terminal device has passed authentication to the AP.

9. The device according to claim 7 or 8, characterized in that The wireless controller includes a built-in portal server; The transceiver module is also used to send a Hypertext Transfer Protocol (HTTP) / Secure Hypertext Transfer Protocol (HTTPS) response message to the target terminal device when receiving a Hypertext Transfer Protocol (HTTP) / Secure Hypertext Transfer Protocol (HTTPS) request message from the target terminal device, wherein the HTTP / HTTPS response message includes a portal authentication page.

10. The device according to claim 9, characterized in that The processing module is used to add the MAC address of the target terminal device to the portal authentication-free list when the user information of the target terminal device passes the portal authentication, and the user information is collected through the portal authentication page.

11. The device according to any one of claims 7 to 10, characterized in that The processing module is configured to delete the MAC address of the target terminal device from the portal-free authentication list when the time duration for which the MAC address of the target terminal device is added to the portal-free authentication list exceeds a preset time duration.

12. The device according to any one of claims 7 to 11, characterized in that The transceiver module is further used to send the MAC address of the target terminal device to the second wireless controller; or The transceiver module is further used to send the MAC address of the target terminal device and the portal cache remaining time of the target terminal device to the second wireless controller.

13. A network device, characterized in that: The device includes a processor and a memory, wherein the processor is coupled to the memory, and the processor is configured to execute the authentication method according to any one of claims 1 to 6 based on instructions stored in the memory.

14. A computer-readable storage medium, characterized in that: The computer-readable storage medium comprises instructions, which, when the computer-readable storage medium is executed on a network device, causes the network device to execute the authentication method according to any one of claims 1 to 6.

Images