Access authentication method and device and related equipment

Abstract

The invention relates to the technical field of network security, in particular to an access authentication method and device and related equipment. The access authentication method is applied to an authentication server. The method comprises the following steps: acquiring an IP address of a terminal computer initiating access authentication, and establishing communication connection with the terminal computer based on the IP address; acquiring login account information of the terminal computer based on the communication connection; recording the charging start time of the terminal computer and the charging end time of the terminal computer; and storing the computer name, the login account information, the charging starting time and the charging ending time of the terminal computer in an access detail list.

Description

TECHNICAL FIELD

[0001] The present application relates to the network security technical field, in particular to an access authentication method and device and related equipment. BACKGROUND

[0002] Currently, some enterprises use thin terminals as office clients, at this time, the terminal is only used as a network access medium, and the final office is completed on the cloud, therefore, only the terminal name (such as the computer name) is used for authentication to realize network access during access authentication. The 3A (authentication, authorization, and accounting) server will only save the computer name information as the history record of access. When problems need to be traced back to the login account, the accurate account information cannot be found through the 3A server, therefore, the account information of the login computer during access authentication needs to be obtained.

[0003] Therefore, how to obtain the account of the user logging in the terminal during terminal access authentication becomes a problem to be solved. SUMMARY

[0004] The present application provides an access authentication method, device and related equipment.

[0005] In a first aspect, the present application provides an access authentication method applied to an authentication server; the method comprises:

[0006] obtaining the IP address of a terminal computer initiating access authentication, and establishing a communication connection with the terminal computer based on the IP address;

[0007] obtaining the login account information of the terminal computer based on the communication connection;

[0008] recording the charging start time of the terminal computer and the charging end time of the terminal computer;

[0009] saving the computer name, login account information, charging start time and charging end time of the terminal computer into an access detail list.

[0010] Optionally, the step of obtaining the IP address of the terminal computer initiating access authentication comprises:

[0011] if the IP address of the terminal computer is a statically configured IP address, obtaining the IP address of the terminal computer when receiving the authentication request initiated by the terminal computer, wherein the authentication request message sent by the terminal computer carries the IP address of the terminal computer;

[0012] If the IP address of the terminal computer is a dynamically allocated IP address, the IP address of the terminal computer is obtained when a charging message initiated by the terminal computer is received, wherein the terminal computer initiates a charging request message to the authentication server after passing the access authentication and obtaining the IP address through the DHCP mode, and the charging request message sent by the terminal computer carries the IP address of the terminal computer.

[0013] Optionally, the step of obtaining the login account information of the terminal computer based on the communication connection comprises:

[0014] After determining that the access authentication of the terminal computer is passed and obtaining the IP address of the terminal computer, a request for obtaining the login account information is sent to the terminal computer.

[0015] The response carrying the login account information fed back by the terminal computer is received.

[0016] Optionally, each computer name and the corresponding domain attribute maintained in a domain server are synchronized to the authentication server in advance, the domain server is used for access authentication of each terminal computer, the authentication server maintains authorization information corresponding to each type of domain attribute, and the method further comprises:

[0017] After receiving the access authentication request message sent by the terminal computer, the access authentication request message is sent to the domain server for access authentication.

[0018] After receiving the access authentication success response fed back by the domain server, the corresponding authorization information is determined according to the domain attribute corresponding to the computer name of the terminal computer, and the authorization information is issued to the access device of the terminal computer.

[0019] In a second aspect, the application provides an access authentication device applied to an authentication server, and the device comprises:

[0020] An obtaining unit is configured to obtain the IP address of a terminal computer initiating access authentication and establish a communication connection with the terminal computer based on the IP address.

[0021] The obtaining unit is further configured to obtain the login account information of the terminal computer based on the communication connection.

[0022] A recording unit is configured to record the charging start time of the terminal computer and the charging end time of the terminal computer.

[0023] A maintaining unit is configured to save the computer name, the login account information, the charging start time and the charging end time of the terminal computer into an access detail list.

[0024] Optionally, when the IP address of the terminal computer initiating the access authentication is acquired, the acquiring unit is specifically configured to:

[0025] If the IP address of the terminal computer is a statically configured IP address, the IP address of the terminal computer is acquired when the authentication request initiated by the terminal computer is received, wherein the authentication request message sent by the terminal computer carries the IP address of the terminal computer.

[0026] If the IP address of the terminal computer is a dynamically allocated IP address, the IP address of the terminal computer is acquired when the charging message initiated by the terminal computer is received, wherein the terminal computer initiates a charging request message to the authentication server after obtaining the IP address by the DHCP mode after the access authentication is passed, and the charging request message sent by the terminal computer carries the IP address of the terminal computer.

[0027] Optionally, when the login account information of the terminal computer is acquired based on the communication connection, the acquiring unit is specifically configured to:

[0028] After it is determined that the access authentication of the terminal computer is passed and the IP address of the terminal computer is acquired, a request for acquiring login account information is sent to the terminal computer;

[0029] A response carrying login account information fed back by the terminal computer is received.

[0030] Optionally, each computer name and corresponding domain attribute maintained in a domain server are synchronized to the authentication server in advance, the domain server is configured to perform access authentication on each terminal computer, and the authentication server maintains authorization information corresponding to each type of domain attribute; the apparatus further includes:

[0031] The sending unit is configured to send the access authentication request message sent by the terminal computer to the domain server for access authentication after the access authentication request message is received;

[0032] The issuing unit is configured to determine the corresponding authorization information according to the domain attribute corresponding to the terminal computer name and issue the authorization information to the access device of the terminal computer after receiving the access authentication success response fed back by the domain server.

[0033] In a third aspect, an embodiment of the present application provides an access authentication apparatus, which comprises:

[0034] A memory configured to store program instructions;

[0035] A processor configured to invoke program instructions stored in the memory and perform the steps of the method according to any one of the first aspect.

[0036] In a fourth aspect, the embodiments of the present application further provide a computer readable storage medium storing computer executable instructions for causing a computer to perform the steps of the method according to any one of the first aspect.

[0037] In summary, the access authentication method provided by the embodiments of the present application is applied to an authentication server, and the method comprises the following steps: obtaining an IP address of a terminal computer initiating access authentication, and establishing a communication connection with the terminal computer based on the IP address; obtaining login account information of the terminal computer based on the communication connection; recording a charging start time of the terminal computer and a charging end time of the terminal computer; and saving a computer name, the login account information, the charging start time and the charging end time of the terminal computer into an access detail list.

[0038] By using the access authentication method provided by the embodiments of the present application, the login account information of the terminal computer performing Radius authentication through a computer name is obtained through the interaction between the authentication server and the terminal computer, and the time period of using network resources by the login account is recorded, so that the exact user information of using network resources can be found in subsequent problem positioning and tracking backtracking. BRIEF DESCRIPTION OF DRAWINGS

[0039] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the drawings needed in the description of the embodiments of the present application or the prior art will be briefly introduced. Obviously, the drawings in the following description are only some embodiments described in the present application, and other drawings can also be obtained by those skilled in the art according to these drawings of the embodiments of the present application.

[0040] Figure 1 A detailed flowchart of an access authentication method provided by the embodiments of the present application;

[0041] Figure 2 A networking schematic diagram of an access authentication method provided by the embodiments of the present application;

[0042] Figure 3 A structural schematic diagram of an access authentication device provided by the embodiments of the present application;

[0043] Figure 4 A hardware architecture schematic diagram of an access authentication device provided by the embodiments of the present application. DETAILED DESCRIPTION

[0044] The terminology used in the description of the application herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the application. As used in the description of the application and the appended claims, the singular forms "a", "an" and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise. It also will be understood that the term "and / or" as used herein refers to and encompasses any and all possible combinations of one or more of the associated listed items.

[0045] It is to be understood that the singular forms "a", "an" and "the" include plural referents unless the context clearly dictates otherwise. Pronouns in the masculine form include the feminine and neuter forms as well, and vice versa, and the use of the negative "not" before a term means only that a variable and / or feature so described is excluded and does not imply that any other variable and / or feature is implied unless the context clearly indicates otherwise. It is to be understood that the terms "including", "comprising", "consisting" and "consisting essentially of" when used in the specification, including the claims, denote non- limiting inclusion of a process step, an ingredient, a composition of matter, or a method of operation, and allow for embodiments having "only the specified steps, ingredients, compositions or operations."

[0046] By way of example, Figure 1 As shown in FIG. 1, a detailed flowchart of an access authentication method provided by the embodiments of the present application is shown, which comprises the following steps:

[0047] Step 100: Obtain the IP address of a terminal computer initiating access authentication, and establish a communication connection with the terminal computer based on the IP address.

[0048] By way of example, Figure 2 As shown in FIG. 2, a networking architecture diagram of access authentication provided by the embodiments of the present application is shown, which comprises an authentication server (e.g., a 3A server), a domain server (e.g., an LDAP server), a terminal computer and an access device (e.g., a switch) of the terminal computer, and the access device is connected with the authentication server.

[0049] In the embodiments of the present application, the domain server is provided with domain attribute information corresponding to each computer name, and each computer name and the corresponding domain attribute information maintained in the domain server can be synchronized to the authentication server in advance. The domain server is configured to perform access authentication on each terminal computer, and the authentication server is configured to maintain authorization information corresponding to each type of domain attribute.

[0050] Then, the authentication server sends the access authentication request message to the domain server for access authentication after receiving the access authentication request message sent by the terminal computer, and determines the corresponding authorization information according to the domain attribute corresponding to the terminal computer name, and then sends the authorization information to the access device of the terminal computer after receiving the access authentication success response feedback by the domain server.

[0051] In actual application, the terminal computer initiates the terminal computer name access authentication, and the access authentication request message carries the terminal computer name and password. After receiving the access authentication request message, the access device encapsulates the access authentication request message into an authentication message in Radius format based on the Radius protocol, and sends the authentication message to the authentication server. The authentication server completes the access authentication of the terminal computer by communicating with the domain server. Specifically, the authentication server sends the terminal computer name and password to the domain server, and authenticates the terminal computer name and password with the server. After determining that the authentication is passed, the authentication server feeds back a response of successful authentication to the authentication server.

[0052] After determining that the access authentication of the terminal computer name is passed, the authentication server determines the domain attribute corresponding to the terminal computer name, determines the authorization information of the terminal computer according to the determined domain attribute, and carries the authorization information of the terminal computer in the authentication success message, and sends the authorization information to the access device of the terminal computer. Thus, the access authentication of the terminal computer is completed.

[0053] In the embodiment of the application, the authentication server needs to obtain the IP address information of the terminal computer. Specifically, in the embodiment of the application, when obtaining the IP address of the terminal computer initiating the access authentication, a preferred implementation manner is as follows:

[0054] If the IP address of the terminal computer is a statically configured IP address, the IP address of the terminal computer is obtained when the authentication request initiated by the terminal computer is received. The authentication request message sent by the terminal computer carries the IP address of the terminal computer.

[0055] That is, if the IP address of the terminal computer is statically configured by a user on the terminal computer, the access authentication request message carries the IP address when initiating the access authentication. Thus, the authentication server can obtain the IP address of the terminal computer when receiving the access authentication request message.

[0056] In the embodiment of the application, when obtaining the IP address of the terminal computer initiating the access authentication, another preferred implementation manner is as follows:

[0057] If the IP address of the terminal computer is a dynamically allocated IP address, the IP address of the terminal computer is obtained when the charging message initiated by the terminal computer is received. After the access authentication is passed, the terminal computer obtains the IP address through the DHCP mode, initiates the charging request message to the authentication server, and the charging request message sent by the terminal computer carries the IP address of the terminal computer.

[0058] That is, the terminal computer dynamically acquires the IP address, and only when the terminal computer successfully authenticates and acquires the IP address from the DHCP server, the terminal computer initiates the charging request, and carries the IP address of the terminal computer in the charging request. In this way, the authentication server can acquire the IP address of the terminal computer when receiving the charging request message.

[0059] The authentication server acquires the IP address of the terminal computer, and establishes a communication connection with the terminal computer based on the acquired IP address after the terminal computer passes the access authentication.

[0060] Step 110: acquiring login account information of the terminal computer based on the communication connection.

[0061] In the embodiment of the application, when acquiring the login account information of the terminal computer based on the communication connection, a preferred implementation manner is as follows:

[0062] After determining that the terminal computer passes the access authentication and acquiring the IP address of the terminal computer, a request for acquiring login account information is sent to the terminal computer; and a response carrying the login account information fed back by the terminal computer is received.

[0063] Specifically, the authentication server sends a wmic request message to the terminal computer; after the terminal computer receives the request message and verifies that the protocol message is correct, the wmic request content of the authentication server, i.e., the login account information of the terminal computer this time, is returned.

[0064] Step 120: recording a charging start time of the terminal computer and a charging end time of the terminal computer.

[0065] Specifically, the charging start represents the start of the terminal computer using the network resource, and thus the time (the charging start time) when the user logging in the terminal computer starts to use the network resource can be recorded; similarly, the charging end represents the end of the terminal computer using the network resource, and thus the time (the charging end time) when the user logging in the terminal computer ends to use the network resource can be recorded.

[0066] Step 130: saving the computer name of the terminal computer, the login account information, the charging start time and the charging end time into an access detail list.

[0067] Specifically, the computer name of the terminal computer, the login account information, the charging start time and the charging end time are maintained in the access detail list, and the user information (the login account information) of the user logging in the terminal computer in the period from the charging start time to the charging end time is obtained. In this way, the exact personnel information can be found in subsequent problem positioning and tracing back.

[0068] Based on the same inventive concept as the above-mentioned embodiments, an exemplary authentication device provided by the embodiments of the present application is shown in FIG. 1, which is applied to an authentication server and includes: Figure 3 The authentication device provided by the embodiments of the present application is shown in FIG. 1, which is applied to an authentication server and includes:

[0069] The obtaining unit 30 is configured to obtain an IP address of the terminal computer initiating the access authentication, and establish a communication connection with the terminal computer based on the IP address.

[0070] The obtaining unit 30 is further configured to obtain login account information of the terminal computer based on the communication connection.

[0071] The recording unit 31 is configured to record a charging start time of the terminal computer and a charging end time of the terminal computer.

[0072] The maintaining unit 32 is configured to save the computer name, the login account information, the charging start time and the charging end time of the terminal computer into an access detail list.

[0073] Optionally, when the IP address of the terminal computer initiating the access authentication is obtained, the obtaining unit 30 is specifically configured to:

[0074] If the IP address of the terminal computer is a statically configured IP address, the IP address of the terminal computer is obtained when an authentication request initiated by the terminal computer is received, wherein the authentication request message sent by the terminal computer carries the IP address of the terminal computer.

[0075] If the IP address of the terminal computer is a dynamically allocated IP address, the IP address of the terminal computer is obtained when a charging message initiated by the terminal computer is received, wherein the terminal computer initiates a charging request message to the authentication server after obtaining the IP address by the DHCP mode after the access authentication is passed, and the charging request message sent by the terminal computer carries the IP address of the terminal computer.

[0076] Optionally, when the login account information of the terminal computer is obtained based on the communication connection, the obtaining unit 30 is specifically configured to:

[0077] After it is determined that the access authentication of the terminal computer is passed and the IP address of the terminal computer is obtained, a request for obtaining the login account information is sent to the terminal computer.

[0078] The response carrying the login account information fed back by the terminal computer is received.

[0079] Optionally, the computer names maintained in a domain server and the corresponding domain attributes are synchronized to the authentication server in advance, the domain server is configured to perform access authentication on the terminal computer, and the authentication server maintains authorization information corresponding to various domain attributes; the device further comprises:

[0080] a sending unit configured to send the access authentication request message to the domain server for access authentication after receiving the access authentication request message sent by the terminal computer;

[0081] a sending unit configured to send the access authentication request message to the domain server for access authentication after receiving the access authentication request message sent by the terminal computer;

[0082] The above units can be one or more integrated circuits configured to implement the above method, for example, one or more application specific integrated circuits (ASICs), or one or more digital signal processors (DSPs), or one or more field programmable gate arrays (FPGAs), etc. For another example, when the above unit is implemented in the form of a processing element scheduling program code, the processing element can be a general-purpose processor, such as a central processing unit (CPU) or other processor that can invoke program code. For another example, the units can be integrated together to implement a system-on-a-chip (SOC).

[0083] Further, the access authentication device provided by the embodiments of the present application is from the hardware layer, and a hardware architecture diagram of the access authentication device can be seen from FIG. 1. Figure 4 As shown in FIG. 1, the access authentication device can include a memory 40 and a processor 41,

[0084] The memory 40 is configured to store program instructions, and the processor 41 invokes the program instructions stored in the memory 40 to perform the above method embodiments according to the obtained program instructions. The specific implementation and technical effects are similar, and will not be repeated here.

[0085] Optionally, the present application further provides an access authentication device, which comprises at least one processing element (or chip) configured to perform the above method embodiments.

[0086] Optionally, the present application also provides a program product, for example, a computer readable storage medium, which stores computer executable instructions for causing the computer to execute the above method embodiments.

[0087] Here, the machine readable storage medium can be any electronic, magnetic, optical, or other physical storage device that contains or stores information, such as executable instructions, data, etc. For example, the machine readable storage medium can be a RAM (Random Access Memory), a volatile memory, a non-volatile memory, a flash memory, a storage drive (such as a hard drive), a solid state drive, any type of storage disk (such as a floppy disk, a DVD, etc.), or similar storage medium, or a combination thereof.

[0088] The systems, apparatuses, modules or units illustrated by the above embodiments can be specifically implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer, and the specific form of the computer can be a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an e-mail device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0089] For the convenience of description, the above apparatuses are described in various units by functions respectively when described. Of course, the functions of the units can be implemented in one or more software and / or hardware in the implementation of the present application.

[0090] Those skilled in the art should understand that the embodiments of the present application can be provided as a method, a system, or a computer program product. Therefore, the present application can take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Moreover, the embodiments of the present application can take the form of a computer program product implemented on one or more computer-usable storage media (including, but not limited to, a disk storage, a CD-ROM, an optical storage, etc.) containing computer-usable program code.

[0091] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each flow and / or block in the flowcharts and / or block diagrams, and the combination of the flows and / or blocks in the flowcharts and / or block diagrams can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing apparatus to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing apparatus produce the functions described in the flowcharts and / or block diagrams for implementing the flows and / or blocks in the flowcharts and / or block diagrams. Figure 1apparatuses that implement the functions specified in the flowchart or flowcharts and / or blocks. Figure 1

[0092] Moreover, these computer program instructions can also be stored in a computer readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer readable memory produce an article of manufacture including instructions which implement the flowchart or flowcharts and / or blocks. Figure 1 apparatuses that implement the functions specified in the flowchart or flowcharts and / or blocks. Figure 1 apparatuses that implement the functions specified in the flowchart or flowcharts and / or blocks.

[0093] The computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the flowchart or flowcharts and / or blocks. Figure 1 apparatuses that implement the functions specified in the flowchart or flowcharts and / or blocks. Figure 1 apparatuses that implement the functions specified in the flowchart or flowcharts and / or blocks.

[0094] The above description is merely illustrative of the application, and not restrictive. Since certain changes can be made in the application without departing from the spirit and scope of the application, it is intended that all of the subject matter of the above description, including the drawings, be interpreted merely as illustrative of the application and not in a limiting sense.​

Claims

1. An admission authentication method characterized by comprising: The method is applied to an authentication server, and comprises the following steps: An IP address of a terminal computer initiating access authentication is acquired, and a communication connection is established with the terminal computer based on the IP address; Login account information of the terminal computer is acquired based on the communication connection; A charging start time of the terminal computer and a charging end time of the terminal computer are recorded; A computer name of the terminal computer, the login account information, the charging start time and the charging end time are saved into an access detail list.

2. The method of claim 1, wherein, The step of acquiring the IP address of the terminal computer initiating the access authentication comprises the following steps: If the IP address of the terminal computer is a statically configured IP address, the IP address of the terminal computer is acquired when an authentication request initiated by the terminal computer is received, wherein the authentication request message sent by the terminal computer carries the IP address of the terminal computer; If the IP address of the terminal computer is a dynamically allocated IP address, the IP address of the terminal computer is acquired when a charging message initiated by the terminal computer is received, wherein the terminal computer initiates a charging request message to the authentication server after the IP address is acquired by the DHCP mode after the access authentication is passed, and the charging request message sent by the terminal computer carries the IP address of the terminal computer.

3. The method of claim 1 or 2, wherein, The step of acquiring the login account information of the terminal computer based on the communication connection comprises the following steps: After it is determined that the access authentication of the terminal computer is passed and the IP address of the terminal computer is acquired, a request for acquiring the login account information is sent to the terminal computer; A response carrying the login account information fed back by the terminal computer is received.

4. The method of claim 1, wherein, Each computer name maintained in a domain server and a corresponding domain attribute thereof are synchronized to the authentication server in advance, the domain server is used for access authentication of each terminal computer, and authorization information corresponding to each type of domain attribute is maintained on the authentication server; The method further comprises the following steps: After the access authentication request message sent by the terminal computer is received, the access authentication request message is sent to the domain server for access authentication; After a successful access authentication response fed back by the domain server is received, corresponding authorization information is determined according to the domain attribute corresponding to the computer name of the terminal computer, and the authorization information is issued to an access device of the terminal computer.

5. An admission authentication apparatus characterized by comprising: The device is applied to an authentication server, and comprises the following steps: An acquisition unit is configured to acquire an IP address of a terminal computer initiating access authentication, and establish a communication connection with the terminal computer based on the IP address; The acquisition unit is further configured to acquire login account information of the terminal computer based on the communication connection; A recording unit is configured to record a charging start time of the terminal computer and a charging end time of the terminal computer; A maintenance unit is configured to save a computer name of the terminal computer, the login account information, the charging start time and the charging end time into an access detail list.

6. The apparatus of claim 5, wherein, When the IP address of the terminal computer initiating the access authentication is acquired, the acquisition unit is specifically configured to: If the IP address of the terminal computer is a statically configured IP address, the IP address of the terminal computer is acquired when an authentication request initiated by the terminal computer is received, wherein the authentication request message sent by the terminal computer carries the IP address of the terminal computer; If the IP address of the terminal computer is a dynamically allocated IP address, the IP address of the terminal computer is acquired when a charging message initiated by the terminal computer is received, wherein the terminal computer initiates a charging request message to the authentication server after the IP address is acquired by the DHCP mode after the access authentication is passed, and the charging request message sent by the terminal computer carries the IP address of the terminal computer. The step of acquiring the login account information of the terminal computer based on the communication connection comprises the following steps: After it is determined that the access authentication of the terminal computer is passed and the IP address of the terminal computer is acquired, a request for acquiring the login account information is sent to the terminal computer; A response carrying the login account information fed back by the terminal computer is received. Each computer name maintained in a domain server and a corresponding domain attribute thereof are synchronized to the authentication server in advance, the domain server is used for access authentication of each terminal computer, and authorization information corresponding to each type of domain attribute is maintained on the authentication server; The method further comprises the following steps: After the access authentication request message sent by the terminal computer is received, the access authentication request message is sent to the domain server for access authentication; After a successful access authentication response fed back by the domain server is received, corresponding authorization information is determined according to the domain attribute corresponding to the computer name of the terminal computer, and the authorization information is issued to an access device of the terminal computer. If the IP address of the terminal computer is a statically configured IP address, the IP address of the terminal computer is obtained when an authentication request initiated by the terminal computer is received, wherein the authentication request message sent by the terminal computer carries the IP address of the terminal computer; If the IP address of the terminal computer is a dynamically allocated IP address, the IP address of the terminal computer is obtained when a charging message initiated by the terminal computer is received, wherein the terminal computer initiates a charging request message to the authentication server after passing the access authentication and obtaining the IP address by the DHCP mode, and the charging request message sent by the terminal computer carries the IP address of the terminal computer.

7. The apparatus of claim 5 or 6, wherein, When the login account information of the terminal computer is obtained based on the communication connection, the obtaining unit is specifically configured to: after determining that the access authentication of the terminal computer is passed and obtaining the IP address of the terminal computer, sending a request for obtaining login account information to the terminal computer; receiving a response carrying login account information fed back by the terminal computer.

8. The apparatus of claim 5, wherein, Each computer name and its corresponding domain attribute maintained in a domain server are synchronized to the authentication server in advance, the domain server is used for access authentication of each terminal computer, and the authentication server maintains authorization information corresponding to each type of domain attribute; The device further comprises: a sending unit configured to send the access authentication request message to the domain server for access authentication after receiving the access authentication request message sent by the terminal computer; a delivery unit configured to determine the corresponding authorization information according to the domain attribute corresponding to the terminal computer name after receiving the access authentication success response fed back by the domain server, and deliver the authorization information to the access equipment of the terminal computer.

9. An admission authentication apparatus characterized by comprising: The access authentication device comprises: a memory configured to store program instructions; a processor configured to call the program instructions stored in the memory and execute the steps of the method according to any one of claims 1-4.

10. A computer-readable storage medium, characterized in that, The computer readable storage medium stores computer executable instructions, and the computer executable instructions are used for making the computer execute the steps of the method according to any one of claims 1-4. The computer readable storage medium stores computer executable instructions, and the computer executable instructions are used for making the computer execute the steps of the method according to any one of claims 1-4.

Images