Network access authentication method and device, storage medium and electronic equipment

Abstract

The invention discloses a network access authentication method and device, a storage medium and electronic equipment. Relates to the field of financial science and technology, and comprises the steps that a target data packet of a network access request sent by target equipment is received, and the target data packet at least comprises bill information corresponding to the target equipment and a to-be-verified sequence code corresponding to the target equipment; verifying the bill information to obtain a first verification result; and under the condition that the first verification result represents that the verification is passed, verifying the sequence code to be verified to obtain a second verification result, and under the condition that the second verification result represents that the verification is passed, permitting the target device to access a target network. Through application of the method and the device, the problem of relatively low security caused by adopting a single factor to carry out network access authentication in related technologies is solved.

Description

Technical Field

[0001] This application relates to the field of financial technology, and more specifically, to a network access authentication method and apparatus, storage medium and electronic device. Background Technology

[0002] In today's rapidly developing information technology and increasingly severe cybersecurity threats, network access control, as a crucial component of enterprise IT infrastructure, plays a vital role in ensuring internal network security and preventing unauthorized devices from accessing the network. With the deepening of digital transformation, the domestic IT innovation initiative has driven the deployment of numerous domestically produced terminals. These terminals require an efficient and secure network access mechanism to ensure that only authenticated and legitimate devices can access network resources. Existing network access control technologies, especially authentication mechanisms for traditional terminals, largely rely on single-factor authentication, such as username / password combinations. This approach is no longer sufficient to address the complex and ever-changing security challenges.

[0003] There is currently no effective solution to the problem of low security caused by using a single factor for network access authentication in related technologies. Summary of the Invention

[0004] The main objective of this application is to provide a network access authentication method, apparatus, storage medium, and electronic device to solve the problem of low security caused by using a single factor for network access authentication in related technologies.

[0005] To achieve the above objectives, according to one aspect of this application, a network access authentication method is provided. The method includes: receiving a target data packet of a network access request sent by a target device, wherein the target data packet includes at least ticket information corresponding to the target device and a sequence code to be verified corresponding to the target device; verifying the ticket information to obtain a first verification result; and verifying the sequence code to be verified if the first verification result indicates successful verification to obtain a second verification result, wherein if the second verification result indicates successful verification, the target device is permitted to access the target network.

[0006] Furthermore, after receiving the target data packet of the network access request sent by the target device, the method further includes: performing domain name resolution on the target device to obtain a resolution result; determining a first network access authentication cluster for processing the target data packet from multiple network access authentication clusters based on the resolution result; and forwarding the target data packet to the first network access authentication cluster.

[0007] Further, verifying the ticket information to obtain a first verification result includes: determining a first load balancer based on the data processing volume of multiple load balancers in the first network access authentication cluster; sending the ticket information to a target account authentication instance in the first network access authentication cluster through the first load balancer; and verifying the ticket information through the target account authentication instance to obtain the first verification result.

[0008] Furthermore, before receiving the target data packet of the network access request sent by the target device, the method further includes: obtaining target parameter information of the target device; verifying the target parameter information, and generating the ticket information based on the target parameter information after successful verification; and returning the ticket information to the target device.

[0009] Further, verifying the sequence code to be verified to obtain a second verification result includes: determining a second load balancer based on the data processing volume of multiple load balancers in the first network access authentication cluster; sending the sequence code to be verified to a target sequence code authentication instance in the first network access authentication cluster through the second load balancer; and verifying the sequence code to be verified through the target sequence code authentication instance to obtain the second verification result.

[0010] Further, verifying the serial number to be verified through the target serial number authentication instance to obtain the second verification result includes: obtaining the cached serial number set in the target serial number authentication instance; determining whether there is a target serial number in the cached serial number set that is the same as the serial number to be verified; if there is no target serial number, determining whether there is a target serial number in the target database that is the same as the serial number to be verified, and obtaining a determination result; and obtaining the second verification result based on the determination result.

[0011] Furthermore, after determining whether there exists a target sequence code in the target database that is the same as the sequence code to be verified, and obtaining the determination result, the method further includes: if the determination result indicates that there exists a target sequence code in the target database that is the same as the sequence code to be verified, then updating the cached sequence code set of the target sequence code authentication instance based on the sequence code in the target database.

[0012] Furthermore, after determining the first network access authentication cluster for processing the target data packet from multiple network access authentication clusters based on the parsing result, the method further includes: detecting whether the first network access authentication cluster is abnormal and obtaining a detection result; if the detection result indicates that the first network access authentication cluster is abnormal, then determining a second network access authentication cluster from multiple network access authentication clusters; and determining the second network access authentication cluster as the first network access authentication cluster.

[0013] To achieve the above objectives, according to another aspect of this application, a network access authentication apparatus is provided. The apparatus includes: a receiving unit for receiving a target data packet of a network access request sent by a target device, wherein the target data packet includes at least ticket information corresponding to the target device and a sequence code to be verified corresponding to the target device; a first verification unit for verifying the ticket information to obtain a first verification result; and a second verification unit for verifying the sequence code to be verified if the first verification result indicates successful verification, to obtain a second verification result, wherein if the second verification result indicates successful verification, the target device is permitted to access the target network.

[0014] Furthermore, the apparatus further includes: a resolution unit, configured to perform domain name resolution on the target device after receiving the target data packet of the network access request sent by the target device, and obtain a resolution result; a first determination unit, configured to determine a first network access authentication cluster for processing the target data packet from multiple network access authentication clusters based on the resolution result; and a forwarding unit, configured to forward the target data packet to the first network access authentication cluster.

[0015] Further, the first verification unit includes: a first determining module, used to determine a first load balancer based on the data processing volume of multiple load balancers in the first network access authentication cluster; a sending module, used to send the ticket information to a target account authentication instance in the first network access authentication cluster through the first load balancer; and a first verification module, used to verify the ticket information through the target account authentication instance to obtain the first verification result.

[0016] Furthermore, the apparatus further includes: an acquisition unit, configured to acquire target parameter information of the target device before receiving the target data packet of the network access request sent by the target device; a third verification unit, configured to verify the target parameter information and generate the ticket information based on the target parameter information after successful verification; and a return unit, configured to return the ticket information to the target device.

[0017] Furthermore, the second verification unit includes: a second determining module, configured to determine a second load balancer based on the data processing volume of multiple load balancers in the first network access authentication cluster; a sending unit, configured to send the sequence code to be verified to a target sequence code authentication instance in the first network access authentication cluster through the second load balancer; and a second verification module, configured to verify the sequence code to be verified through the target sequence code authentication instance to obtain the second verification result.

[0018] Further, the first verification module includes: an acquisition submodule, used to acquire a cached sequence code set in the target sequence code authentication instance; a first judgment submodule, used to determine whether there is a target sequence code in the cached sequence code set that is the same as the sequence code to be verified; a second judgment submodule, used to determine whether there is a target sequence code in the target database that is the same as the sequence code to be verified if the target sequence code does not exist, and obtain a judgment result; and a determination submodule, used to obtain the second verification result based on the judgment result.

[0019] Furthermore, the apparatus further includes: an update unit, configured to, after determining whether there exists a target sequence code in the target database that is the same as the sequence code to be verified, and obtaining a determination result, if the determination result indicates that there exists a target sequence code in the target database that is the same as the sequence code to be verified, then update the cached sequence code set of the target sequence code authentication instance based on the sequence code in the target database.

[0020] Furthermore, the apparatus further includes: a detection unit, configured to detect whether the first network access authentication cluster is abnormal after determining a first network access authentication cluster for processing the target data packet from multiple network access authentication clusters based on the parsing result, and obtain a detection result; a second determination unit, configured to determine a second network access authentication cluster from multiple network access authentication clusters if the detection result indicates that the first network access authentication cluster is abnormal; and a third determination unit, configured to determine the second network access authentication cluster as the first network access authentication cluster.

[0021] According to another aspect of the present invention, an electronic device is also provided, comprising: a memory storing an executable program; and a processor for running the program, wherein the program executes the network access authentication method described above during runtime.

[0022] According to another aspect of the present invention, a computer-readable storage medium is also provided, wherein the storage medium stores a program, wherein the program controls the device where the storage medium is located to execute the network access authentication method described above during runtime.

[0023] In this embodiment, the following steps are adopted: receiving a target data packet of a network access request sent by a target device, wherein the target data packet includes at least ticket information corresponding to the target device and a sequence code to be verified corresponding to the target device; verifying the ticket information to obtain a first verification result; if the first verification result indicates that the verification is successful, verifying the sequence code to be verified to obtain a second verification result, wherein if the second verification result indicates that the verification is successful, the target device is allowed to access the target network, thus solving the technical problem in related technologies where the use of a single factor for network access authentication leads to relatively low security.

[0024] In this scheme, when a target device sends a network access request, the target data packet corresponding to the request contains two parts: ticket information and a sequence code to be verified. The initial verification of the ticket information ensures the reliability of the target device's identity. Only after the ticket information is verified successfully—that is, after obtaining the first verification result indicating successful verification—will the validity of the sequence code be further checked. This dual-check strategy essentially forms two lines of defense. Even if one factor is compromised, the existence of the other factor can prevent unauthorized devices from entering the network, greatly enhancing the security of the network entry point. The verification of the sequence code to be verified, i.e., the second verification result, strengthens the physical layer authentication of the device and can effectively resist software-based attacks, such as login attempts impersonating legitimate users. This scheme improves the authentication standard, effectively avoids the security risks caused by authentication based on a single factor, enhances the security level of terminal network access authentication, and achieves more refined and comprehensive network access control, thereby achieving the technical effect of improving network and data security. Attached Figure Description

[0025] The accompanying drawings, which form part of this application, are used to provide a further understanding of this application. The illustrative embodiments and descriptions of this application are used to explain this application and do not constitute an undue limitation of this application. In the drawings:

[0026] Figure 1 A hardware structure block diagram of a computer terminal for implementing a network access authentication method is shown.

[0027] Figure 2 This is a flowchart of a network access authentication method provided according to an embodiment of this application;

[0028] Figure 3 This is a schematic diagram of the network access authentication method provided according to the embodiments of this application. Figure 1 ;

[0029] Figure 4 This is a schematic diagram of the network access authentication method provided according to the embodiments of this application. Figure 2 ;

[0030] Figure 5 This is a schematic diagram of a network access authentication device provided according to an embodiment of this application;

[0031] Figure 6 This is a structural block diagram of an electronic device according to an embodiment of this application. Detailed Implementation

[0032] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.

[0033] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0034] First, some nouns or terms that appear in the description of the embodiments of this application shall be interpreted as follows:

[0035] Domestically produced terminals in the field of information technology application innovation (referred to as "information technology innovation") refer to computer terminal equipment that uses domestically produced hardware and software. These terminal devices typically include domestically produced CPUs, operating systems, and other core hardware and software components, aiming to promote self-reliance and control in the field of information technology, reduce dependence on foreign technologies, and enhance information security.

[0036] It should be noted that the information collected in this application (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for display, data used for analysis, etc.) are information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, storage, use, processing, transmission, provision, disclosure, and application of this data all comply with relevant laws, regulations, and standards, necessary confidentiality measures have been taken, and they do not violate public order and good morals. Corresponding access points are provided for users to choose to authorize or refuse. For example, interfaces are set up between this system and relevant users or organizations, providing users with corresponding access points to choose to agree to or refuse automated decision-making results; if the user chooses to refuse, the process proceeds to the expert decision-making stage.

[0037] Example 1

[0038] According to an embodiment of this application, a method embodiment for network access authentication is also provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0039] The method embodiment provided in Embodiment 1 of this application can be executed on a mobile terminal, computer terminal, or similar computing device. Figure 1 A hardware block diagram of a computer terminal (or mobile device) for implementing a network access authentication method is shown. Figure 1 As shown, the computer terminal 10 (or mobile device) may include one or more processors 102 (shown as 102a, 102b, ..., 102n in the figure) 102 (processor 102 may include, but is not limited to, a microprocessor MCU or a programmable logic device FPGA, etc.), a memory 104 for storing data, and a transmission device 106 for communication functions. In addition, it may also include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of a BUS bus), a network interface, a power supply, and / or a camera. Those skilled in the art will understand that... Figure 1 The structure shown is for illustrative purposes only and does not limit the structure of the aforementioned electronic device. For example, computer terminal 10 may also include... Figure 1 The more or fewer components shown, or having the same Figure 1 The different configurations shown.

[0040] It should be noted that the aforementioned one or more processors 102 and / or other data processing circuits are generally referred to herein as "data processing circuits". These data processing circuits may be embodied, in whole or in part, in software, hardware, firmware, or any other combination thereof. Furthermore, the data processing circuits may be a single, independent processing module, or may be integrated, in whole or in part, into any other element within the computer terminal 10 (or mobile device). As involved in the embodiments of this application, the data processing circuits serve as a processor control mechanism (e.g., selection of a variable resistor termination path connected to an interface).

[0041] The memory 104 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the network access authentication method in this embodiment. The processor 102 executes various functional applications and data processing by running the software programs and modules stored in the memory 104, thereby implementing the aforementioned network access authentication method. The memory 104 may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include memory remotely located relative to the processor 102, and these remote memories can be connected to the computer terminal 10 via a network. Examples of the aforementioned networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0042] The transmission device 106 is used to receive or send data via a network. Specific examples of the network described above may include a wireless network provided by the communication provider of the computer terminal 10. In one example, the transmission device 106 includes a Network Interface Controller (NIC), which can connect to other network devices via a base station to communicate with the Internet. In another example, the transmission device 106 may be a Radio Frequency (RF) module, used for wireless communication with the Internet.

[0043] The display may be a touchscreen liquid crystal display (LCD) that allows the user to interact with the user interface of the computer terminal 10 (or mobile device).

[0044] Under the aforementioned operating environment, this application provides the following: Figure 2 The network access authentication method shown. Figure 2 This is a flowchart of a network access authentication method according to Embodiment 1 of this application. The network access authentication method includes:

[0045] Step S201: Receive the target data packet of the network access request sent by the target device, wherein the target data packet includes at least the ticket information corresponding to the target device and the sequence code to be verified corresponding to the target device.

[0046] Optionally, in a domestically developed IT-enabled terminal environment, whenever a terminal (i.e., the target device mentioned above) attempts to access the network, it first sends a network access request. This request signals that the terminal desires network access rights, indicating that the terminal is seeking legitimacy verification.

[0047] The network access request sent by the target device is transmitted in the form of a data packet, namely the target data packet mentioned above. The target data packet includes at least two key pieces of information: ticket information and a sequence number to be verified. The ticket information can be a credential generated based on an authentication protocol, and can be an electronic ticket containing information for verifying identity, such as encrypted attribute parameters of the target device, or an access token issued through some authentication mechanism. The sequence number refers to a unique hardware identification code of the target device, such as a serial number (SN), which is a fixed and unique hardware identifier used to confirm the physical entity of the device.

[0048] Target data packets can be transmitted over a network to a network access control system, which can be a dedicated network device or application software running on a server, such as an endpoint management platform or a wireless controller. These systems are responsible for receiving all network access requests from endpoints.

[0049] The purpose of the ticket information is to verify the user's identity, ensuring that the person requesting network access is an authorized user. The serial number, on the other hand, verifies the device itself; it's an anti-counterfeiting measure that prevents unauthorized devices from accessing the network even if they pass user authentication. The combined use of tickets and serial numbers forms the basis of two-factor authentication, significantly increasing the difficulty of unauthorized access and improving overall network security.

[0050] Step S202: Verify the invoice information to obtain the first verification result.

[0051] Optionally, after receiving the target data packet, the network access system parses the ticket information within it and then communicates with the authentication server using a pre-defined verification mechanism to check the validity of the ticket information. This includes verifying whether the ticket signature is correct, whether the ticket has expired, and whether the user identity and permissions in the ticket conform to the control policy. After verifying the ticket information, a first verification result is obtained. The first verification result determines whether the target device is allowed to continue the subsequent authentication process. If the ticket information is confirmed to be valid, the first verification result indicates that the verification has passed, meaning that the user identity has been preliminarily confirmed, and the target device can continue to the next step of sequence code verification. Conversely, if the ticket information is invalid, the first verification result indicates that the verification has failed. In this case, the network access process will stop, and the target device will be denied access to the network.

[0052] Step S203: If the first verification result indicates that the verification is successful, the sequence code to be verified is verified to obtain a second verification result. If the second verification result indicates that the verification is successful, the target device is allowed to access the target network.

[0053] Optionally, after the first verification result confirms that the ticket information is correct, the network access control process proceeds to the second stage, which involves verifying the sequence code to be verified to obtain a second verification result. This step aims to further ensure that devices accessing the network are not only owned by legitimate users but must also be security devices registered and approved by the system.

[0054] A serial number (SN) is a unique hardware identifier that uniquely identifies each device. In large-scale domestically developed terminal network access authentication, serial number verification, as a second factor, together with ticket information, constitutes a two-factor authentication system, enhancing the security of device access. This is because even if a user's identity is stolen, without the correct serial number, an unauthorized device cannot pass network access authentication.

[0055] Once the ticket information verification (first verification result) passes, the system will begin processing and verifying the sequence code in the data packet. This verification process may involve communicating with a database storing registered sequence codes to compare whether the incoming sequence code exists in the sequence code list of legitimate devices. If the sequence code matches and is not included in a preset list or has not been reported lost, the system will determine it as valid, obtaining a second verification result indicating that the verification has passed.

[0056] In summary, when a target device sends a network access request, the target data packet corresponding to the request contains two parts: ticket information and a sequence code to be verified. The initial verification of the ticket information ensures the reliability of the target device's identity. Only after the ticket information is verified successfully—that is, after obtaining the first verification result indicating successful verification—will the validity of the sequence code be further checked. This dual-check strategy essentially forms two lines of defense. Even if one factor is compromised, the existence of the other factor can prevent unauthorized devices from entering the network, greatly enhancing the security of the network entry point. The verification of the sequence code to be verified, i.e., the second verification result, strengthens the physical layer authentication of the device and can effectively resist software-based attacks, such as login attempts impersonating legitimate users. This solution improves the authentication standard, effectively avoids the security risks caused by authentication based on a single factor, enhances the security level of terminal network access authentication, and achieves more refined and comprehensive network access control, thereby achieving the technical effect of improving network and data security.

[0057] Optionally, in the network access authentication method provided in this application embodiment, after receiving the target data packet of the network access request sent by the target device, the method further includes: performing domain name resolution on the target device to obtain the resolution result; determining a first network access authentication cluster for processing the target data packet from multiple network access authentication clusters based on the resolution result; and forwarding the target data packet to the first network access authentication cluster.

[0058] In an optional embodiment, after the target device initiates a network access request, the system first performs domain name resolution, converting the domain name in the target device's request into an IP address. In large-scale network deployments, domain name resolution is not only a basic means of directing traffic to the target server, but it can also achieve functions such as load balancing and failover through intelligent resolution mechanisms, ensuring the efficiency and stability of network services.

[0059] Then, based on the parsing results, the system can select one cluster (i.e., the first network access authentication cluster mentioned above) from multiple pre-configured network access authentication clusters to handle the network access request of the target device. The network access authentication cluster can be matched based on the geographical location of the device, device type, request time, or other business rules. The purpose is to distribute the load across multiple clusters, avoid overloading a single cluster, and also to quickly switch to another cluster when a cluster fails, reducing service interruption time.

[0060] Finally, after selecting the first network access authentication cluster, the system forwards the network access request data packet sent by the target device (i.e., the target data packet mentioned above) to that cluster for subsequent authentication processing. Through the above process, each cluster can independently undertake a portion of the network access authentication work, which improves efficiency and enhances the fault tolerance of the entire system.

[0061] Determining the primary network access authentication cluster through domain name resolution enables dynamic allocation of authentication requests, preventing bottlenecks in certain clusters due to excessive requests, while ensuring efficient utilization of resources across all clusters. This approach improves the overall processing capacity of the authentication system, reduces response latency, and enhances the user experience.

[0062] Optionally, in the network access authentication method provided in this application embodiment, verifying the ticket information to obtain a first verification result includes: determining a first load balancer based on the data processing volume of multiple load balancers in the first network access authentication cluster; sending the ticket information to the target account authentication instance in the first network access authentication cluster through the first load balancer; and verifying the ticket information through the target account authentication instance to obtain the first verification result.

[0063] In an optional embodiment, verifying ticket information includes the following steps: First, the data processing volume of all load balancers in the first network access authentication cluster is monitored, and a first load balancer with a lower current processing volume is selected based on real-time load conditions. This selection can be based on algorithms such as minimum connections, round-robin, or weighted round-robin.

[0064] Then, after determining the first load balancer, the ticket information is sent to the target account authentication instance within the first network access authentication cluster through the first load balancer. It should be noted that the target account authentication instance is selected from multiple authentication service instances in the first network access authentication cluster to handle the specific account verification work. In an optional embodiment, the first load balancer can determine the target account authentication instance based on its built-in scheduling rules, such as random selection, hash algorithms, or other intelligent algorithms, to further process the ticket information.

[0065] Finally, after receiving the ticket information, the target account authentication instance verifies the ticket information, including but not limited to decryption, signature verification, checking the validity of the ticket (such as whether it has expired), and matching it with information in the user database, thereby obtaining the first verification result mentioned above.

[0066] By automatically distributing network access requests to the most suitable account authentication instance through a load balancer, resource waste can be effectively avoided, ensuring that each account authentication instance operates in optimal condition and improving the overall system's resource utilization and efficiency. Even if a load balancer or account authentication instance fails, the load balancing mechanism can ensure that requests are rerouted to other healthy instances, thereby preventing a single point of failure from affecting the overall authentication service and improving system stability and reliability.

[0067] Optionally, in the network access authentication method provided in this application embodiment, before receiving the target data packet of the network access request sent by the target device, the method further includes: obtaining target parameter information of the target device; verifying the target parameter information, and generating ticket information based on the target parameter information after the verification is passed; and returning the ticket information to the target device.

[0068] In an optional embodiment, the ticket information of the target device can be obtained by the following steps: acquiring the target parameter information of the target device. It should be noted that the target parameter information includes, but is not limited to, the device's MAC address, IP address, operating system type, version information, and any preset security configuration information. This information helps the system to initially understand the status of the requesting device, including its hardware characteristics, software environment, and security settings. This parameter information can be automatically reported when the device attempts to connect to the network, or it can be pre-configured on the device for direct reading during the authentication process. For example, device drivers or specific client software can be designed to automatically submit this parameter information when the device attempts to access the network.

[0069] After obtaining the target device's target parameter information, this information is verified. For example, it checks whether the MAC address or IP address belongs to a preset address pool, verifies whether the operating system meets security baseline requirements (e.g., whether the latest security patches are installed), and confirms whether the security configuration is correct (e.g., whether the firewall is enabled and specific security software is installed). If the target parameter information is verified correctly, a ticket is generated based on this information. Finally, the generated ticket is securely sent back to the target device. The device will include this ticket in subsequent network access requests as proof of its legitimacy.

[0070] By verifying target parameter information, devices can be controlled more precisely, ensuring that only devices that meet specific security standards and configuration requirements can obtain network access rights, thereby enhancing the protection of network resources.

[0071] Optionally, in the network access authentication method provided in this application embodiment, verifying the sequence code to be verified to obtain a second verification result includes: determining a second load balancer based on the data processing volume of multiple load balancers in the first network access authentication cluster; sending the sequence code to be verified to a target sequence code authentication instance in the first network access authentication cluster through the second load balancer; and verifying the sequence code to be verified through the target sequence code authentication instance to obtain a second verification result.

[0072] In an optional embodiment, during the sequence code verification phase, the data processing volume of each load balancer within the first network access authentication cluster is first evaluated to determine which load balancer currently carries the fewest requests or best matches its preset load distribution strategy. After selecting a second load balancer, the sequence code information to be verified is forwarded to the target sequence code authentication instance within the cluster through the second load balancer.

[0073] After receiving the serial number information, the target serial number authentication instance performs serial number verification. Verification includes, but is not limited to, comparing the serial number with registered serial numbers in a local or remote database, checking whether the device is authorized, whether the serial number is valid, and whether it is on a preset list or a list of suspicious serial numbers. If the serial number verification is successful, the second verification result is passed, the device's serial number is verified as legitimate, the entire access process is considered complete, and the device is allowed to access the network. Conversely, if the serial number verification fails, the second verification result is failed, and network access will be blocked.

[0074] By employing load balancing strategies, resources within the cluster can be evenly and efficiently distributed, preventing some authentication instances from becoming overloaded while others remain idle, thereby improving the overall throughput and response speed of the system.

[0075] Optionally, in the network access authentication method provided in this application embodiment, verifying the sequence code to be verified through the target sequence code authentication instance to obtain a second verification result includes: obtaining a cached sequence code set in the target sequence code authentication instance; determining whether there is a target sequence code in the cached sequence code set that is the same as the sequence code to be verified; if there is no target sequence code, determining whether there is a target sequence code in the target database that is the same as the sequence code to be verified, and obtaining a determination result; and obtaining a second verification result based on the determination result.

[0076] In an optional embodiment, during serial code verification, the target serial code authentication instance first queries its locally cached serial code set. The purpose of the cached serial code set is to quickly respond to authentication requests, avoid frequent database queries, and improve authentication efficiency. The target serial code authentication instance then compares the serial code to be verified with each item in the cached serial code set to check for a matching record. If a matching serial code is found, the second verification result is authentication successful.

[0077] If the serial number to be verified is not found in the cached serial number set, the target serial number authentication instance further queries the target database. This step ensures that even if the cache does not reflect the latest state, an accurate decision can be made based on the complete and up-to-date registration serial number information in the database. If a matching serial number is found in the target database, the verification process continues, the second verification result is passed, and the target device is allowed to access the network. Conversely, if the serial number does not exist in the database or is marked as invalid, the second verification result is failed, and the target device is prevented from accessing the network.

[0078] By caching the sequence code set locally, most authentication requests can be responded to quickly, avoiding the high latency and high overhead of directly querying the database, thus significantly improving authentication efficiency and response speed.

[0079] Optionally, in the network access authentication method provided in this application embodiment, after determining whether there is a target sequence code in the target database that is the same as the sequence code to be verified, and obtaining the determination result, the method further includes: if the determination result indicates that there is a target sequence code in the target database that is the same as the sequence code to be verified, then the cached sequence code set of the target sequence code authentication instance is updated according to the sequence code in the target database.

[0080] In an optional embodiment, when the target serial number authentication instance determines that a target serial number matching the serial number to be verified exists in the target database, in order to ensure that the local cache of the target serial number authentication instance is always up-to-date and to avoid potential authentication errors in the future, the cached serial number set of the target serial number authentication instance needs to be updated according to the serial number in the target database. It should be noted that the update process can be incremental, only adding or updating new serial numbers already existing in the database, or it can be a full update, resynchronizing the entire serial number set to ensure the integrity of the local cache. By periodically or on-demand pulling updates from the database, the cached serial number set can promptly reflect dynamic changes in the database, such as newly added registered devices and status changes (such as device authorization revocation), which helps improve the accuracy and timeliness of serial number verification.

[0081] By linking database and cache updates, the accuracy of the serial number authentication process is ensured. Even if serial number information has just been added or updated in the database, the local cache can quickly synchronize, avoiding authentication errors.

[0082] Optionally, in the network access authentication method provided in this application embodiment, after determining the first network access authentication cluster for processing the target data packet from multiple network access authentication clusters based on the parsing result, the method further includes: detecting whether the first network access authentication cluster is abnormal and obtaining a detection result; if the detection result indicates that the first network access authentication cluster is abnormal, then determining the second network access authentication cluster from multiple network access authentication clusters; and determining the second network access authentication cluster as the first network access authentication cluster.

[0083] In an optional embodiment, high availability and stability of network access authentication are among the core design considerations. To this end, a real-time monitoring and automatic switching mechanism for the health status of the network access authentication cluster is introduced. This ensures that when a cluster malfunctions, the system can automatically identify and switch to another normally functioning cluster to maintain the continuity of the authentication service. After intelligent domain name resolution determines the first network access authentication cluster for processing target data packets, the system initiates a health check of this cluster. This check may include, but is not limited to, indicators such as heartbeat detection, service response time, error rate statistics, and resource usage to comprehensively assess the cluster's operational status.

[0084] If all key metrics of the cluster perform well, the test results will indicate that the cluster is healthy; conversely, if any abnormal metrics are found, such as service response timeouts, frequent errors, or resource exhaustion, the test results will indicate that the cluster is abnormal. If the test results show that the first network access authentication cluster is abnormal, a replacement will be sought from multiple network access authentication clusters, namely the second network access authentication cluster, and the second network access authentication cluster will be designated as the first network access authentication cluster.

[0085] The automatic detection and switching mechanism can quickly identify and isolate faulty clusters, preventing network access authentication services from being interrupted due to a single cluster failure, significantly improving the system's high availability and ensuring the stable operation of services.

[0086] In an alternative embodiment, the following can be employed: Figure 3 The diagram illustrates network access authentication, which specifically includes: when a domestically produced terminal starts up or establishes a network access authentication request, this request is first sent to a smart domain. This smart domain is designed to dynamically resolve to which specific network access authentication cluster the request should be sent to based on different conditions (such as the terminal's location, current network status, or load balancing strategy). This step ensures effective traffic distribution and avoids the risk of overloading a single cluster.

[0087] After intelligent domain name resolution, network access authentication requests are directed to the terminal management platform or wireless controller, which receives network access authentication requests from terminals and determines which network access authentication cluster to forward the request to based on the resolution result. Once the request reaches the network access authentication cluster, it is forwarded to the account authentication management device (i.e., account authentication instance) via ELB1 (i.e., load balancer). This device is responsible for verifying the terminal's ticket. After successful account authentication, the request is sent to the terminal serial number verification device (i.e., serial number authentication instance) via ELB2 (i.e., load balancer) to verify the validity of the device's serial number (SN). The serial number verification device also employs multi-instance deployment and F5 load balancing to achieve service redundancy and load distribution. Each instance has a locally cached SN dataset for fast comparison and also has the ability to periodically update this dataset to maintain consistency with the latest SN data in the database. It should be noted that all terminal serial numbers are stored in the database. In a multi-datacenter scenario, the database can adopt a master-slave architecture to ensure high data availability and consistency. When the serial number (SN) data is not found in the local cache, the serial number verification device will directly query the database to obtain the final verification result. By employing multi-instance deployment and load balancing technology, this solution ensures that the entire network access authentication process can continue smoothly even if a component or instance fails, significantly improving the system's high availability and fault tolerance.

[0088] In an alternative embodiment, the following can be employed: Figure 4 The diagram illustrates network access authentication. Based on different business usage scenarios or organizational departments, the network access service for terminals can be distributed across multiple clusters, enabling clustered management and operation, and reducing the blast radius of a single failure. For example... Figure 4 The network access authentication cluster includes cluster 1, cluster 2, etc. To improve the high availability load balancing capability of the clusters at the campus level, intelligent DNS domain name resolution can be used to load balance terminal network access requests in a single business scenario to multiple network access authentication clusters. When a single network access authentication cluster fails, at least one network access authentication cluster can take over the business, ensuring the continuity of network access services. After determining the corresponding network access authentication cluster, the specific process of network access authentication is implemented through the ELB, account authentication management device, and terminal serial number verification device in that network access authentication cluster.

[0089] The network access authentication method provided in this application embodiment receives a target data packet of a network access request sent by a target device. The target data packet includes at least ticket information corresponding to the target device and a sequence code to be verified corresponding to the target device. The ticket information is verified to obtain a first verification result. If the first verification result indicates that the verification is successful, the sequence code to be verified is verified to obtain a second verification result. If the second verification result indicates that the verification is successful, the target device is allowed to access the target network. This solves the technical problem in related technologies where the use of a single factor for network access authentication leads to relatively low security.

[0090] In this scheme, when a target device sends a network access request, the target data packet corresponding to the request contains two parts: ticket information and a sequence code to be verified. The initial verification of the ticket information ensures the reliability of the target device's identity. Only after the ticket information is verified successfully—that is, after obtaining the first verification result indicating successful verification—will the validity of the sequence code be further checked. This dual-check strategy essentially forms two lines of defense. Even if one factor is compromised, the existence of the other factor can prevent unauthorized devices from entering the network, greatly enhancing the security of the network entry point. The verification of the sequence code to be verified, i.e., the second verification result, strengthens the physical layer authentication of the device and can effectively resist software-based attacks, such as login attempts impersonating legitimate users. This scheme improves the authentication standard, effectively avoids the security risks caused by authentication based on a single factor, enhances the security level of terminal network access authentication, and achieves more refined and comprehensive network access control, thereby achieving the technical effect of improving network and data security.

[0091] It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases the steps shown or described may be executed in a different order than that shown here.

[0092] Example 2

[0093] This application also provides a network access authentication device. It should be noted that the network access authentication device of this application can be used to execute the network access authentication method provided in this application. The network access authentication device provided in this application is described below.

[0094] According to embodiments of this application, a network access authentication apparatus for implementing the above-described network access authentication method is also provided, such as... Figure 5 As shown, the device includes: a receiving unit 501, a first verification unit 502, and a second verification unit 503.

[0095] The receiving unit 501 is used to receive the target data packet of the network access request sent by the target device, wherein the target data packet includes at least the ticket information corresponding to the target device and the sequence code to be verified corresponding to the target device;

[0096] The first verification unit 502 is used to verify the bill information and obtain the first verification result;

[0097] The second verification unit 503 is used to verify the sequence code to be verified if the first verification result indicates that the verification is passed, and to obtain a second verification result, wherein if the second verification result indicates that the verification is passed, the target device is allowed to access the target network.

[0098] The network access authentication device provided in this application embodiment receives a target data packet of a network access request sent by a target device through a receiving unit 501. The target data packet includes at least ticket information corresponding to the target device and a sequence code to be verified corresponding to the target device. A first verification unit 502 verifies the ticket information to obtain a first verification result. If the first verification result indicates that the verification is successful, a second verification unit 503 verifies the sequence code to be verified to obtain a second verification result. If the second verification result indicates that the verification is successful, the target device is allowed to access the target network. This solves the technical problem in related technologies where the use of a single factor for network access authentication leads to relatively low security.

[0099] In this scheme, when a target device sends a network access request, the target data packet corresponding to the request contains two parts: ticket information and a sequence code to be verified. The initial verification of the ticket information ensures the reliability of the target device's identity. Only after the ticket information is verified successfully—that is, after obtaining the first verification result indicating successful verification—will the validity of the sequence code be further checked. This dual-check strategy essentially forms two lines of defense. Even if one factor is compromised, the existence of the other factor can prevent unauthorized devices from entering the network, greatly enhancing the security of the network entry point. The verification of the sequence code to be verified, i.e., the second verification result, strengthens the physical layer authentication of the device and can effectively resist software-based attacks, such as login attempts impersonating legitimate users. This scheme improves the authentication standard, effectively avoids the security risks caused by authentication based on a single factor, enhances the security level of terminal network access authentication, and achieves more refined and comprehensive network access control, thereby achieving the technical effect of improving network and data security.

[0100] Optionally, in the network access authentication device provided in this application embodiment, the device further includes: a parsing unit, configured to perform domain name resolution on the target device after receiving the target data packet of the network access request sent by the target device, and obtain the resolution result; a first determining unit, configured to determine a first network access authentication cluster for processing the target data packet from multiple network access authentication clusters based on the resolution result; and a forwarding unit, configured to forward the target data packet to the first network access authentication cluster.

[0101] Optionally, in the network access authentication device provided in this application embodiment, the first verification unit includes: a first determining module, used to determine a first load balancer based on the data processing volume of multiple load balancers in the first network access authentication cluster; a sending module, used to send the ticket information to the target account authentication instance in the first network access authentication cluster through the first load balancer; and a first verification module, used to verify the ticket information through the target account authentication instance to obtain a first verification result.

[0102] Optionally, in the network access authentication device provided in this application embodiment, the device further includes: an acquisition unit, used to acquire target parameter information of the target device before receiving the target data packet of the network access request sent by the target device; a third verification unit, used to verify the target parameter information, and generate ticket information based on the target parameter information after the verification is passed; and a return unit, used to return the ticket information to the target device.

[0103] Optionally, in the network access authentication device provided in this application embodiment, the second verification unit includes: a second determining module, used to determine a second load balancer based on the data processing volume of multiple load balancers in the first network access authentication cluster; a sending unit, used to send the sequence code to be verified to the target sequence code authentication instance in the first network access authentication cluster through the second load balancer; and a second verification module, used to verify the sequence code to be verified through the target sequence code authentication instance to obtain a second verification result.

[0104] Optionally, in the network access authentication device provided in this application embodiment, the first verification module includes: an acquisition submodule, used to acquire a cached sequence code set in the target sequence code authentication instance; a first judgment submodule, used to determine whether there is a target sequence code in the cached sequence code set that is the same as the sequence code to be verified; a second judgment submodule, used to determine whether there is a target sequence code in the target database that is the same as the sequence code to be verified if there is no target sequence code, and obtain a judgment result; and a determination submodule, used to obtain a second verification result based on the judgment result.

[0105] Optionally, in the network access authentication device provided in the embodiments of this application, the device further includes: an update unit, used to update the cached sequence code set of the target sequence code authentication instance based on the sequence code in the target database if the judgment result indicates that there is a target sequence code in the target database that is the same as the sequence code to be verified after determining whether there is a target sequence code in the target database that is the same as the sequence code to be verified.

[0106] Optionally, in the network access authentication device provided in this application embodiment, the device further includes: a detection unit, configured to detect whether the first network access authentication cluster is abnormal after determining the first network access authentication cluster for processing the target data packet from multiple network access authentication clusters based on the parsing result, and obtain a detection result; a second determination unit, configured to determine a second network access authentication cluster from multiple network access authentication clusters if the detection result indicates that the first network access authentication cluster is abnormal; and a third determination unit, configured to determine the second network access authentication cluster as the first network access authentication cluster.

[0107] It should be noted that the receiving unit 501, the first verification unit 502, and the second verification unit 503 mentioned above correspond to steps S201 to S203 in Embodiment 1. The three units and the corresponding steps implement the same instances and application scenarios, but are not limited to the content disclosed in Embodiment 1. It should be noted that the above modules or units can be hardware or software components stored in memory (e.g., memory 104) and processed by one or more processors (e.g., processors 102a, 102b, ..., 102n). The above units can also be part of a device and run in the computer terminal 10 provided in Embodiment 1.

[0108] Example 3

[0109] Embodiments of this application may provide an electronic device. Figure 6 This is a structural block diagram of an electronic device according to an embodiment of this application. Figure 6 As shown, the electronic device may include: one or more ( Figure 6 (Only one is shown) processor 602, memory 604, memory controller, and peripheral interface, wherein the peripheral interface is connected to the radio frequency module, audio module and display.

[0110] The memory can be used to store software programs and modules, such as the program instructions / modules corresponding to the methods and apparatus in the embodiments of this application. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory, thereby implementing the above-described methods. The memory may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory may further include memory remotely located relative to the processor, and these remote memories can be connected to the terminal via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0111] The processor can invoke information and application programs stored in the memory through the transmission device to perform the following steps: receiving a target data packet of a network access request sent by a target device, wherein the target data packet includes at least ticket information corresponding to the target device and a sequence code to be verified corresponding to the target device; verifying the ticket information to obtain a first verification result; if the first verification result indicates that the verification is successful, verifying the sequence code to be verified to obtain a second verification result, wherein if the second verification result indicates that the verification is successful, the target device is allowed to access the target network.

[0112] The processor can invoke information and applications stored in the memory through the transmission device to perform the following steps: After receiving the target data packet of the network access request sent by the target device, the method further includes: performing domain name resolution on the target device to obtain the resolution result; determining a first network access authentication cluster for processing the target data packet from multiple network access authentication clusters based on the resolution result; and forwarding the target data packet to the first network access authentication cluster.

[0113] The processor can invoke the information and application stored in the memory through the transmission device to perform the following steps: verifying the ticket information to obtain a first verification result, including: determining the first load balancer based on the data processing volume of multiple load balancers in the first network access authentication cluster; sending the ticket information to the target account authentication instance in the first network access authentication cluster through the first load balancer; and verifying the ticket information through the target account authentication instance to obtain the first verification result.

[0114] The processor can invoke information and applications stored in the memory through the transmission device to perform the following steps: before receiving the target data packet of the network access request sent by the target device, the method further includes: obtaining target parameter information of the target device; verifying the target parameter information, and generating ticket information based on the target parameter information after successful verification; and returning the ticket information to the target device.

[0115] The processor can invoke information and applications stored in the memory through the transmission device to perform the following steps: verifying the sequence code to be verified to obtain a second verification result, including: determining a second load balancer based on the data processing volume of multiple load balancers in the first network access authentication cluster; sending the sequence code to be verified to the target sequence code authentication instance in the first network access authentication cluster through the second load balancer; and verifying the sequence code to be verified through the target sequence code authentication instance to obtain a second verification result.

[0116] Furthermore, verifying the serial code to be verified through the target serial code authentication instance to obtain the second verification result includes: obtaining the cached serial code set in the target serial code authentication instance; determining whether there is a target serial code in the cached serial code set that is the same as the serial code to be verified; if there is no target serial code, determining whether there is a target serial code in the target database that is the same as the serial code to be verified, and obtaining the determination result; and obtaining the second verification result based on the determination result.

[0117] Furthermore, after determining whether there exists a target sequence code in the target database that is the same as the sequence code to be verified, and obtaining the determination result, the method further includes: if the determination result indicates that there exists a target sequence code in the target database that is the same as the sequence code to be verified, then the cached sequence code set of the target sequence code authentication instance is updated based on the sequence code in the target database.

[0118] Furthermore, after determining the first network access authentication cluster for processing the target data packet from multiple network access authentication clusters based on the parsing results, the method further includes: detecting whether the first network access authentication cluster is abnormal and obtaining the detection result; if the detection result indicates that the first network access authentication cluster is abnormal, then determining the second network access authentication cluster from multiple network access authentication clusters; and determining the second network access authentication cluster as the first network access authentication cluster.

[0119] Those skilled in the art will understand that Figure 6 The structure shown is for illustrative purposes only. Electronic devices can also be smartphones, tablets, handheld computers, mobile internet devices (MIDs), PADs, and other terminal devices. Figure 6 This does not limit the structure of the aforementioned electronic device. For example, electronic devices may also include components that are more... Figure 6 The more or fewer components shown (such as network interfaces, display devices, etc.), or having the same Figure 6 The different configurations shown.

[0120] Those skilled in the art will understand that all or part of the steps in the various methods of the above embodiments can be implemented by a program instructing the hardware related to the terminal device. The program can be stored in a computer-readable storage medium, which may include: flash drive, read-only memory (ROM), random access memory (RAM), disk or optical disk, etc.

[0121] Example 4

[0122] Embodiments of this application also provide a computer-readable storage medium. Optionally, in this embodiment, the storage medium can be used to store the program code executed by the network access authentication method provided in Embodiment 1.

[0123] Optionally, in this embodiment, the storage medium may be located in any computer terminal in a group of computer terminals in a computer network, or in any mobile terminal in a group of mobile terminals.

[0124] This application also provides a computer program product that, when executed on a data processing device, is suitable for performing network access authentication method steps.

[0125] The sequence numbers of the embodiments in this application are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0126] In the above embodiments of this application, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0127] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual coupling, direct coupling, or communication connection may be through some interfaces; the indirect coupling or communication connection between units or modules may be electrical or other forms.

[0128] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0129] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0130] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard drive, magnetic disk, or optical disk.

[0131] The above description is only a preferred embodiment of this application. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of this application, and these improvements and modifications should also be considered within the scope of protection of this application.

Claims

1. A network access authentication method, characterized in that, include: Receive a target data packet for a network access request sent by a target device, wherein the target data packet includes at least ticket information corresponding to the target device and a sequence code to be verified corresponding to the target device; The ticket information is verified to obtain a first verification result; If the first verification result indicates that the verification is successful, the sequence code to be verified is verified to obtain a second verification result. If the second verification result indicates that the verification is successful, the target device is allowed to access the target network.

2. The method according to claim 1, characterized in that, After receiving the target data packet of the network access request sent by the target device, the method further includes: Perform domain name resolution on the target device to obtain the resolution result; Based on the parsing results, a first network access authentication cluster for processing the target data packet is determined from multiple network access authentication clusters; The target data packet is forwarded to the first network access authentication cluster.

3. The method according to claim 1, characterized in that, The verification of the invoice information yields the following first verification result: The first load balancer is determined based on the data processing volume of multiple load balancers in the first network access authentication cluster. The ticket information is sent to the target account authentication instance in the first network access authentication cluster via the first load balancer. The ticket information is verified using the target account authentication instance to obtain the first verification result.

4. The method according to claim 1, characterized in that, Before receiving the target data packet of the network access request sent by the target device, the method further includes: Obtain the target parameter information of the target device; The target parameter information is verified, and the invoice information is generated based on the target parameter information after the verification is passed; The ticket information is returned to the target device.

5. The method according to claim 1, characterized in that, The second verification result obtained by verifying the sequence code to be verified includes: The second load balancer is determined based on the data processing volume of multiple load balancers in the first network access authentication cluster. The second load balancer sends the sequence code to be verified to the target sequence code authentication instance in the first network access authentication cluster; The target sequence code authentication instance is used to verify the sequence code to be verified, and the second verification result is obtained.

6. The method according to claim 5, characterized in that, The second verification result obtained by verifying the serial number to be verified through the target serial number authentication instance includes: Obtain the cached sequence code set from the target sequence code authentication instance; Determine whether there exists a target sequence code in the cached sequence code set that is identical to the sequence code to be verified; If the target sequence code does not exist, then determine whether there is a target sequence code in the target database that is the same as the sequence code to be verified, and obtain the determination result; Based on the judgment result, the second verification result is obtained.

7. The method according to claim 6, characterized in that, After determining whether a target sequence code exists in the target database that is identical to the sequence code to be verified, and obtaining the determination result, the method further includes: If the judgment result indicates that there is a target sequence code in the target database that is the same as the sequence code to be verified, then the cached sequence code set of the target sequence code authentication instance is updated based on the sequence code in the target database.

8. The method according to claim 2, characterized in that, After determining a first network access authentication cluster for processing the target data packet from multiple network access authentication clusters based on the parsing results, the method further includes: Detect whether there are any anomalies in the first network access authentication cluster and obtain the detection results; If the detection result indicates that the first network access authentication cluster is abnormal, then a second network access authentication cluster is determined from multiple network access authentication clusters. The second network access authentication cluster is identified as the first network access authentication cluster.

9. A network access authentication device, characterized in that, include: A receiving unit is configured to receive a target data packet of a network access request sent by a target device, wherein the target data packet includes at least ticket information corresponding to the target device and a sequence code to be verified corresponding to the target device; The first verification unit is used to verify the ticket information and obtain a first verification result; The second verification unit is used to verify the sequence code to be verified if the first verification result indicates that the verification is passed, and to obtain a second verification result, wherein if the second verification result indicates that the verification is passed, the target device is allowed to access the target network.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes a stored executable program, wherein, when the executable program is executed, it controls the device on which the computer-readable storage medium is located to perform the network access authentication method according to any one of claims 1 to 8.

11. An electronic device, characterized in that, include: Memory, which stores executable programs; A processor for running the program, wherein the program, when running, performs the network access authentication method according to any one of claims 1 to 8.

Images