Local area network authentication method, system, equipment and computer program product

Abstract

The invention provides a local area network authentication method, system and device and a computer program product, and relates to the technical field of networks. The local area network authentication method comprises the following steps: receiving and displaying an issued portal page when accessing a wireless local area network for the first time; in response to a downloading trigger operation on a network access authentication program on the portal page, generating and sending a downloading request, and redirecting the downloading request to access authentication service equipment to obtain a temporary access permission; wherein the downloading request points to a preset domain name; accessing the Internet and downloading the network access authentication program based on the temporary access authority; an authentication request is generated and sent by running the network access authentication program, and the authentication request is redirected to access the authentication service equipment so as to obtain a formal access permission; wherein the authentication request points to the preset domain name.

Description

Technical Field

[0001] This specification relates to the field of network technology, and in particular to a local area network authentication method, system, device, and computer program product. Background Technology

[0002] In regional network environments such as campuses and factory parks, an access authentication architecture based on AAA (Authentication, Authorization, Accounting) servers and PORTAL servers is typically used to ensure the security and controllability of network access. Unauthenticated devices (such as mobile phones) connecting to the area's Wi-Fi must authenticate before using internet services. The main methods include entering a username and password on an automatically popping-up webpage or activating a specific mini-program through the webpage to complete authentication. Such systems often also provide additional services such as top-up, offline access, and account inquiry, all dependent on the authentication process. However, in existing authentication schemes, the authentication process is passively triggered. Once a user closes the authentication page, subsequent service URLs are complex, sessions time out, or the address is random, making it difficult to access the service directly again, leading to inconvenience for top-up and inquiry operations. Similarly, the mini-program method cannot re-obtain the AAA server address after closing or clearing the cache, resulting in poor service accessibility. Furthermore, the variety of terminal device types and differences in operating systems and versions often prevent the PORTAL page from popping up automatically, requiring users to manually enter the URL and wait for it to be blocked, resulting in a cumbersome experience and low success rate. These shortcomings limit the ease of user operation and the reliability of system services.

[0003] Therefore, some embodiments of this specification provide a local area network authentication method, system, device, and computer program product, which aim to solve the problem of service entry points being difficult to reproduce by establishing persistent service channels. Summary of the Invention

[0004] This specification provides one or more embodiments of a local area network authentication method, the method comprising: upon first accessing a wireless local area network, receiving and displaying a distributed portal page; in response to a download trigger operation for a network access authentication program on the portal page, generating and sending a download request, the download request being redirected to access an authentication server to obtain temporary access rights; wherein the download request points to a preset domain name; based on the temporary access rights, accessing the Internet and downloading the network access authentication program; and by running the network access authentication program, generating and sending an authentication request, the authentication request being redirected to access an authentication server to obtain formal access rights; wherein the authentication request points to the preset domain name.

[0005] According to one or more embodiments of this specification, the temporary access permission is configured by the network access control terminal based on a temporary authorization instruction corresponding to the download request; the temporary authorization instruction includes an Internet authorization token with restrictions issued by the authentication server; wherein, the restrictions include time limits and / or traffic limits; based on the temporary access permission, accessing the Internet and downloading the network access authentication program includes: within the restrictions of the Internet authorization token, accessing an application distribution platform on the Internet to download the network access authentication program.

[0006] According to one or more embodiments of this specification, the network access authentication program is a WeChat mini program; by running the network access authentication program, an authentication request is generated and sent, including: providing a user interaction interface through the WeChat mini program to receive authentication information input by the user; and generating an authentication request based on the authentication information and sending it to the authentication server.

[0007] The method provided according to one or more embodiments of this specification further includes: responding to a triggering condition of a network detection request, controlling a network access authentication program to initiate a network detection request to a preset domain name; wherein the network detection request initiated to the preset domain name is redirected to an authentication server; determining whether the user is currently connected to a wireless local area network based on whether a response to the network detection request is received from the authentication server; wherein the network detection request is a heartbeat message; the triggering condition of the network detection request includes at least one of the following: automatically triggered when the network access authentication program is opened; periodically triggered when the network access authentication program is running in the foreground; receiving an immediate detection instruction triggered through the interface of the network access authentication program.

[0008] The method provided according to one or more embodiments of this specification further includes: when it is determined that the current connection is to a wireless local area network, sending a service operation request to an authentication server through a network access authentication procedure, wherein the service operation request is sent through a preset domain name; and / or, when it is determined that the current connection is not to a wireless local area network, sending a service operation request to a backup authentication server through a network access authentication procedure, wherein the service operation request is sent through a backup domain name and redirected to the backup authentication server by a backup network access control terminal; wherein the backup authentication server maintains data synchronization with the authentication server; wherein the service operation request includes at least one of the following: querying the current online status; recharging the account; or performing an active offline action.

[0009] This specification provides one or more embodiments of a local area network authentication method, the method comprising: intercepting an internet access request initiated by an unauthenticated user terminal through a wireless local area network and sending a portal page to the user terminal; receiving a download request sent by the user terminal pointing to a preset domain name and redirecting the download request to an authentication server; receiving a temporary authorization instruction from the authentication server corresponding to the user terminal and configuring temporary access permissions for the user terminal according to the temporary authorization instruction; receiving an authentication request sent by the user terminal through a network access authentication procedure pointing to a preset domain name and redirecting the authentication request to the authentication server; and receiving a formal authorization instruction from the authentication server corresponding to the user terminal and configuring formal access permissions for the user terminal according to the formal authorization instruction.

[0010] According to one or more embodiments of this specification, configuring temporary access permissions for a user terminal based on a temporary authorization instruction includes: adding the user terminal's network identifier to a temporary access whitelist according to the temporary authorization instruction; wherein the temporary authorization instruction includes an Internet authorization token with restrictions issued by an authentication server, the restrictions including time limits and / or traffic limits; configuring formal access permissions for the user terminal based on a formal authorization instruction includes: removing the user terminal's network identifier from the temporary access whitelist; and adding the user terminal's network identifier to a formal authorization list for allowing long-term Internet access.

[0011] The method provided according to one or more embodiments of this specification further includes: receiving a network detection request initiated by an authenticated user terminal; wherein the network detection request points to a preset domain name; redirecting the network detection request to an authentication server; receiving a response from the authentication server to the network detection request; and sending the response to the user terminal.

[0012] The method provided according to one or more embodiments of this specification further includes: receiving a service operation request initiated by an authenticated user terminal through a network access authentication procedure; and redirecting the service operation request to an authentication server for processing.

[0013] This specification provides one or more embodiments of a regional network authentication method, the method comprising: receiving a download request from a user terminal redirected by a network access control terminal; in response to the download request, generating and sending a temporary authorization instruction for the user terminal to the network access control terminal to trigger the network access control terminal to configure temporary access permissions for the user terminal; receiving an authentication request from the user terminal redirected by the network access control terminal; verifying the authentication request, and upon successful verification, generating and sending a formal authorization instruction for the user terminal to the network access control terminal to trigger the network access control terminal to configure formal access permissions for the user terminal.

[0014] The method provided according to one or more embodiments of this specification further includes: receiving a network detection request redirected from a network access control terminal; wherein the network detection request is sent by an authenticated user terminal through a network access authentication procedure; and returning a response to the network detection request to the network access control terminal for the user terminal to determine that it is currently connected to a wireless local area network.

[0015] The method provided according to one or more embodiments of this specification further includes: receiving a service operation request redirected from a network access control terminal; wherein the service operation request is sent by an authenticated user terminal through a network access authentication procedure; processing the service operation request and returning a processing result; wherein the service operation request includes at least one of the following: querying the current online status; recharging the account; or performing an active offline action.

[0016] This specification provides one or more embodiments of a terminal device, comprising: a terminal receiving module for receiving and displaying a portal page when first accessing a wireless local area network; a request generation module for generating a download request in response to a download trigger operation for a network access authentication program on the portal page, wherein the download request is redirected to access an authentication service device to obtain temporary access rights; and an authentication request is generated by running the network access authentication program, wherein the authentication request is redirected to access the authentication service device to obtain formal access rights; wherein the download request points to a preset domain name; the authentication request points to a preset domain name; a download module for accessing the Internet and downloading the network access authentication program based on the temporary access rights; and a terminal sending module for sending the download request and / or the authentication request.

[0017] This specification provides one or more embodiments of a network access control device, comprising: an interception module for intercepting internet access requests initiated by unauthenticated terminal devices via a wireless local area network; a control sending module for sending a portal page to the terminal device; a control receiving module for receiving download requests sent by the terminal device to a preset domain name, receiving temporary authorization instructions corresponding to the terminal device from an authentication service device, receiving authentication requests sent by the terminal device through a network access authentication procedure to a preset domain name, and receiving formal authorization instructions corresponding to the terminal device from the authentication service device; a redirection module for redirecting download requests and / or authentication requests to the authentication service device; and a permission configuration module for configuring temporary access permissions for the terminal device according to the temporary authorization instructions and configuring formal access permissions for the terminal device according to the formal authorization instructions.

[0018] This specification provides one or more embodiments of an authentication service device, comprising: an authentication receiving module for receiving download requests and / or authentication requests from a terminal device, redirected by a network access control device; an authorization module for generating a temporary authorization instruction for the terminal device in response to the download request, thereby triggering the network access control device to configure temporary access permissions for the terminal device; further configured to verify the authentication request, and upon successful verification, generate a formal authorization instruction for the terminal device, thereby triggering the network access control device to configure formal access permissions for the terminal device; and an authentication sending module for sending the temporary authorization instruction and / or formal authorization instruction to the network access control device.

[0019] This specification provides one or more embodiments of a local area network authentication system, comprising a user terminal, a network access control terminal, and an authentication server. The user terminal is configured to receive and display a distributed portal page, and in response to a download trigger operation for a network access authentication program on the portal page, generate and send a download request. The download request is redirected to the authentication server to obtain temporary access rights. It is also configured to access the internet and download the network access authentication program based on the temporary access rights, and generate and send an authentication request by running the network access authentication program. The authentication request is redirected to the authentication server to obtain formal access rights. The network access control terminal is configured to intercept internet access requests initiated by unauthenticated user terminals via a wireless local area network, distribute a portal page to the user terminal, receive download requests from the user terminal pointing to a preset domain name, redirect the download requests to the authentication server, and receive data from the authentication server corresponding to the user terminal. The system is configured to: receive temporary authorization instructions and configure temporary access permissions for user terminals according to the temporary authorization instructions; receive authentication requests sent by user terminals through network access authentication procedures pointing to preset domain names, redirect the authentication requests to the authentication server, receive formal authorization instructions from the authentication server corresponding to the user terminals, and configure formal access permissions for user terminals according to the formal authorization instructions; and receive download requests from user terminals redirected by the network access control terminal, generate and send temporary authorization instructions for user terminals to the network access control terminal in response to the download requests, thereby triggering the network access control terminal to configure temporary access permissions for user terminals. The system is also configured to: receive and verify authentication requests from user terminals redirected by the network access control terminal, and after successful verification, generate and send formal authorization instructions for user terminals to the network access control terminal, thereby triggering the network access control terminal to configure formal access permissions for user terminals.

[0020] This specification provides one or more embodiments of a device for local area network authentication, including a processor and a memory. The memory stores a computer program or computer-executable instructions. When the computer program or computer-executable instructions are executed by the processor, they implement the local area network authentication method described in one or more embodiments of this specification.

[0021] This specification provides one or more embodiments of a computer program product, including a computer program that, when at least a portion of the computer program is executed by a processor, enables the implementation of the local area network authentication method described in one or more embodiments of this specification. Attached Figure Description

[0022] This specification will be further described by way of exemplary embodiments, which will be described in detail with reference to the accompanying drawings. The same numbers in the drawings denote the same structures or steps.

[0023] Figure 1 This is a schematic diagram of a local area network authentication system according to some embodiments of this specification.

[0024] Figure 2 This is an exemplary flowchart of a local area network authentication method according to some embodiments of this specification.

[0025] Figure 3 This is an exemplary flowchart of another local area network authentication method according to some embodiments of this specification.

[0026] Figure 4 This is an exemplary flowchart of another local area network authentication method according to some embodiments of this specification.

[0027] Figure 5 This is an exemplary flowchart of another local area network authentication method according to some embodiments of this specification.

[0028] Figure 6 This is an exemplary block diagram of a terminal device according to some embodiments of this specification.

[0029] Figure 7 This is an exemplary block diagram of a network access control device according to some embodiments of this specification.

[0030] Figure 8 This is an exemplary block diagram of an authentication service device according to some embodiments of this specification. Detailed Implementation

[0031] To more clearly illustrate the technical solutions of the embodiments in this specification, the embodiments will be described in detail below with reference to the accompanying drawings. Obviously, the content described below are some examples or embodiments of this specification. For those skilled in the art, without creative effort, the technical solutions or means disclosed in this specification can be applied to other scenarios based on this technical content.

[0032] It should be understood that the terms "system," "device," "unit," and / or "module" used in this specification are a method of distinguishing different components, elements, parts, sections, or assemblies at different levels. However, if other terms can achieve the same purpose, they may be replaced by other expressions.

[0033] Unless otherwise specified, the technical terms used to describe components, elements, etc. in this specification are not singular but may include plural. Generally speaking, terms such as "comprising" or "including" only indicate that explicitly identified steps, elements, or components are included, and these steps, elements, and components do not constitute an exclusive list, as the described method or apparatus may also include other steps or components.

[0034] This specification uses flowcharts to illustrate the operational steps performed by the apparatus or system of related embodiments. However, unless otherwise specified, the order in which these steps are described should not be construed as a limitation on the order of execution. Those skilled in the art can adjust the order of these steps based on the knowledge and information conveyed by the embodiments in this specification. Such adjustments include, but are not limited to, reversing the order of steps, merging multiple steps, and splitting a step.

[0035] A local area network (LAN) is a computer network interconnected by dedicated communication lines within a limited geographical area. It is typically used to build the basic network architecture for private information environments such as enterprises, industrial parks, and campuses. A wireless LAN is a type of LAN that uses radio waves as the transmission medium to enable interconnection and resource sharing between computers, mobile terminals (such as mobile phones and tablets) and other devices within a limited geographical area. Examples include Wi-Fi and public hotspots. Terminal devices are hardware devices that connect to the end of a computer network (such as a wireless LAN or wired LAN) and directly provide specific functions or services to end users. Terminal devices are the starting and ending points of network communication, responsible for generating, sending, or receiving data. Examples include personal computers, smartphones, and tablets. Network access control devices are key nodes deployed at the network boundary, used for authentication, authorization, and access control of terminal devices accessing the network. They often work in conjunction with backend authentication service devices to jointly manage and control terminal devices. Examples include wireless access points, switches, and gateways. An authentication service device (also known as an authentication server) is a server used to verify the authenticity of a user or device and authorize its access to network resources. It is primarily used in network applications and systems to ensure that only authorized users can access protected resources or data. Examples include AAA servers.

[0036] In some related embodiments, the wireless LAN uses Web Portal authentication. When an unauthenticated terminal device connects to the wireless LAN (such as Wi-Fi) to access the Internet, the access request is intercepted by the gateway, and an authentication portal page is forcibly sent to the terminal device. This authentication portal page sends an authentication request to the AAA server, which then verifies the identity and issues an "allow access" or "deny" instruction to the gateway. The gateway adds the terminal device's IP address to the allowed list according to the AAA server's instruction, after which the terminal device can access the Internet normally. During this process, if the user closes the authentication portal page, or if some authentication portal pages have functions such as recharge or data usage query, and the authenticated user wants to perform these operations again, they need to enter the URL of the authentication portal page before closing it. However, this URL is often difficult to access directly again due to complex paths, session timeouts, or random addresses. In addition, some Wi-Fi networks are authenticated through mini-programs. However, after authentication, operations such as recharging and data usage inquiry through the mini-program also require obtaining the AAA server address carried by the authentication portal page that pops up before authentication. When the mini-program is closed or its cache is cleared, even if the mini-program is connected to the Wi-Fi network, it cannot obtain the AAA server address, resulting in the inability to provide services such as recharging and data usage inquiry.

[0037] To address this, some embodiments of this specification propose a regional network authentication method, system, device, and computer program product. When a user terminal first accesses a wireless local area network, it receives and displays a portal page issued by the network access control terminal. Through this portal page, it generates and sends a download request for the network access authentication program. This download request is redirected by the network access control terminal to the authentication server to obtain temporary access rights. Based on this temporary access rights, the user terminal accesses the Internet and downloads the network access authentication program. Then, by running the network access authentication program, it generates and sends an authentication request. This authentication request is redirected by the network access control terminal to the authentication server to obtain formal access rights. Both the download request and the authentication request point to a preset domain name. Thus, by setting a preset domain name to establish a persistent service channel, the problem of the authentication server's entry point being difficult to reproduce is solved.

[0038] Figure 1 This is a schematic diagram of a local area network authentication system according to some embodiments of this specification. For example... Figure 1 As shown, the regional network authentication system 100 may include a user terminal 110, a network access control terminal 120, an authentication server 130, and a network 140. The user terminal 110, the network access control terminal 120, and the authentication server 130 transmit data through the network 140.

[0039] The network can be any type of wired or wireless network, or any combination thereof. For example, a network can be one or more of the following: wired network, fiber optic network, telecommunications network, internal network, Internet, local area network (LAN), wide area network (WAN), wireless local area network (WLAN), metropolitan area network (MAN), public switched telephone network (PSTN), Bluetooth network, etc. A network can have multiple access points, through which user terminals, network access control terminals, and authentication servers can access the network.

[0040] A user terminal can be a hardware device that accesses a computer network and directly provides specific functions or services to end users, responsible for generating, sending, or receiving data. In some embodiments, a user terminal can be a personal computer, smartphone, or tablet computer, etc. Users can find the name of the wireless local area network (WLAN) to be accessed on the user terminal's network settings interface and click "Connect" to request permission to access the Internet through that WLAN. For example, when a user terminal first accesses a WLAN, it receives and displays a portal page, and sends a download request for a network access authentication program through this portal page. This download request first grants temporary access to the Internet to download the network access authentication program. Then, the running network access authentication program generates and sends an authentication request to obtain formal access.

[0041] A network access control terminal is a device with access control functions such as interception and redirection. Depending on different configuration requirements, it can be a standalone device or a combination of multiple devices. In some embodiments, the network access control terminal can transmit data with user terminals, receive and manage internet access requests from user terminals. For example, it can intercept internet access requests initiated by unauthenticated user terminals through a wireless LAN and send a portal page to the user terminal. It can also receive download requests or authentication requests sent by user terminals pointing to a preset domain name. In some embodiments, the network access control terminal can also transmit data with an authentication server, redirecting requests from user terminals to the authentication server. It can also receive instructions from the authentication server and control the internet access permissions of user terminals according to the instructions. For example, it can redirect download requests or authentication requests to the authentication server, receive temporary or formal authorization instructions from the authentication server corresponding to the user terminal, and configure temporary or formal access permissions for the user terminal according to the instructions. In some embodiments, the network access control terminal may include a firewall.

[0042] The authentication server can be a high-performance computer device. In some embodiments, the authentication server can be an AAA server, deployed in the cloud or locally. The authentication server can transmit data with the network access controller and user terminals to verify the authenticity of the user or device's identity and authorize its access to network resources. For example, in response to a download request from a user terminal redirected by the network access controller, the authentication server generates and sends a temporary authorization instruction for the user terminal to the network access controller, triggering the network access controller to configure temporary access permissions for the user terminal. The authentication server can also receive and verify authentication requests from user terminals redirected by the network access controller, and upon successful verification, generate and send a formal authorization instruction for the user terminal to the network access controller, triggering the network access controller to configure formal access permissions for the user terminal.

[0043] Figure 2 This is an exemplary flowchart illustrating a local area network authentication method according to some embodiments of this specification. In some embodiments, Figure 2 The illustrated process 200 can be implemented by multiple execution devices. In some embodiments, process 200 can be implemented by a local area network authentication system 100, which may include a user terminal 110, a network access control terminal 120, and an authentication server 130. In some embodiments, such as Figure 2 As shown, the user terminal can be implemented by terminal device 600, the network access control terminal can be implemented by network access control device 700, and the authentication server can be implemented by authentication service device 800. Figure 2As shown, in some embodiments, process 200 may include the following steps.

[0044] Step 201: The user terminal connects to the wireless local area network for the first time and initiates an Internet access request.

[0045] In some embodiments, the user terminal may be a personal computer, smartphone, or tablet computer, etc., which can switch between different networks to access the Internet through its network settings interface. The first access to a wireless local area network (WLAN) can be a user terminal switching from another network (such as mobile data) to a specific WLAN, or a user terminal switching from another WLAN to a specific WLAN, or a user terminal switching from a state with no network connection to a specific WLAN. In some embodiments, the first access to a WLAN by a user terminal can be understood as the user terminal having never accessed that WLAN before; or the user terminal's historical access history to that WLAN has been deleted. In some embodiments, after the user selects and connects to an available Wi-Fi network in the smartphone's network settings interface, the Internet access request initiated by the smartphone will first reach the network access control terminal. The Internet access request may contain the user terminal's network identifier, which may be the user terminal's IP address.

[0046] Step 202: The network access control terminal intercepts the Internet access request initiated by the unauthenticated user terminal through the wireless local area network and sends the portal page to the user terminal.

[0047] In some embodiments, the network access controller can control access to user terminals accessing the wireless local area network by setting a whitelist. The whitelist lists network identifiers of user terminals allowed to access the internet. By checking if the network identifier contained in the wireless local area network connection request exists in the whitelist, the controller confirms whether the user terminal sending the request has internet access rights. For example, when the network access controller receives an internet access request, it extracts the network identifier of the user terminal from the request and compares it with the whitelist. If the network identifier is not in the whitelist, it determines that the user terminal (such as a smartphone) has not completed authentication. In this case, the network access controller will block the internet access request, preventing the user terminal from accessing the internet.

[0048] In some embodiments, the portal page can be an authentication portal page. After the network access control terminal intercepts an internet access request, it automatically sends an authentication portal page to the user terminal that sent the request, guiding the user terminal to perform authentication operations. For example, downloading a network access authentication program.

[0049] Step 203: The user terminal receives and displays the distributed portal page, and in response to the download trigger operation of the network access authentication program on the portal page, generates and sends a download request to a preset domain name, which points to the preset domain name.

[0050] In some embodiments, the portal page may display a button for the network access authentication procedure. This button links to a pre-configured default domain name, which points to a specific authentication server. This default domain name is fixed and can be changed as needed. The download is triggered when a user clicks the button, and the user's browser initiates a standard HTTP / HTTPS download request to the default domain name. By setting a default domain name, it is ensured that the user's terminal can always accurately connect to the authentication service device and transmit data through the network access authentication procedure.

[0051] Step 204: The network access control terminal redirects the download request to the authentication server.

[0052] In some embodiments, a download request includes the target domain name to be accessed and the network identifier of the user terminal sending the request. When a download request points to a preset domain name, that preset domain name is the target domain name to be accessed, therefore the download request must contain that preset domain name. This preset domain name is configured in the whitelist of the network access control terminal, so when the network access control terminal receives a download request containing that preset domain name, it automatically redirects the download request to the authentication server corresponding to that preset domain name. Through the preset domain name and redirection mechanism, download requests sent by unauthenticated user terminals are temporarily allowed to reach the authentication server to obtain temporary authorization instructions.

[0053] Step 205: In response to the download request, the authentication server generates and sends a temporary authorization instruction for the user terminal to the network access control terminal.

[0054] In some embodiments, a temporary authorization instruction may be an internet authorization token with restrictions, which may be any one or both of time-limited and traffic-limited restrictions. For example, it may authorize a user terminal to access the internet for 2 minutes, or authorize a user terminal to access the internet for 1GB of data, or authorize a user terminal to access the internet for 2 minutes and access the internet for no more than 1GB of data.

[0055] Step 206: The network access control terminal configures temporary access permissions for the user terminal according to the temporary authorization instruction.

[0056] In some embodiments, the temporary authorization instruction may include the network identifier of the user terminal to determine the authorized user terminal. In some embodiments, the network access control terminal adds the network identifier of the user terminal to a temporary access whitelist according to the temporary authorization instruction. Furthermore, if the temporary authorization instruction contains restrictions, corresponding internet access restrictions are configured for the network identifier to allow the user terminal to access the internet under the restricted conditions. By configuring temporary access permissions for the user terminal, unauthenticated user terminals can access the internet under restricted conditions to download the network access authentication procedure and complete authentication.

[0057] Step 207: The user terminal accesses the Internet and downloads the network access authentication program based on temporary access permissions. By running the network access authentication program, it generates and sends an authentication request to a preset domain name. The authentication request points to the preset domain name.

[0058] In some embodiments, a user terminal, within the constraints of an Internet authorization token, accesses an application distribution platform on the Internet to download a network access authentication program. The application platform can be an application that provides the runtime environment and technical support for the mini-program. For example, the application platform could be WeChat, and the network access authentication program could be a WeChat mini-program that runs within WeChat.

[0059] In some embodiments, a user on a user terminal opens a WeChat mini-program, enters authentication information through its user interface, and then the WeChat mini-program generates an authentication request based on the authentication information and sends it to the authentication server. For example, a user on a user terminal opens a WeChat mini-program, enters a username, password, and other authentication information within the mini-program, and the WeChat mini-program generates an authentication request based on the entered authentication information and sends it to the authentication server. In practice, data transmission between the user terminal and the authentication server must pass through the network access control terminal; therefore, the authentication request is delivered to the authentication server after passing through the network access control terminal.

[0060] Step 208: The network access control terminal redirects the authentication request to the authentication server.

[0061] In some embodiments, the authentication request includes the target domain name to be accessed and the network identifier of the user terminal sending the request. When the authentication request points to a preset domain name, the preset domain name is the target domain name to be accessed, therefore the authentication request must contain the preset domain name. When the network access control terminal receives an authentication request containing the preset domain name, it will automatically redirect the authentication request to the authentication server corresponding to the preset domain name.

[0062] Step 209: The authentication server verifies the authentication request, and after successful verification, generates and sends a formal authorization instruction for the user terminal to the network access control terminal.

[0063] In some embodiments, the authentication request may include information such as the user terminal's identity identifier, network identifier, and verification code. After all information is verified, the authentication server generates a formal authorization instruction, which may include the user terminal's network identifier to determine the authorized user terminal.

[0064] Step 210: The network access control terminal configures formal access permissions for the user terminal according to the formal authorization instruction.

[0065] In some embodiments, the network access controller determines the user terminal to be granted formal access permission based on the network identifier of the user terminal contained in the formal authorization instruction. The formal access permission for the user terminal is configured by removing the network identifier of the user terminal from the temporary access whitelist and adding it to the formal authorization list for allowing long-term internet access. At this point, the user terminal can freely access the internet through the wireless local area network.

[0066] Step 211: In response to the triggering condition of the network detection request, the user terminal controls the network access authentication program to initiate a network detection request to the preset domain name.

[0067] In some embodiments, the network detection request may be a heartbeat message containing identification information of the user terminal sending the request. For example, the heartbeat message may contain the user terminal's MAC address or IP address.

[0068] In some embodiments, the triggering conditions for a network detection request include: automatic triggering when the network access authentication program is opened. For example, when the network access authentication program is opened and run in the foreground, i.e., its interface is displayed on the user terminal screen, a network detection request is automatically sent. In some embodiments, the triggering conditions for a network detection request include: periodic triggering while the network access authentication program is running in the foreground. For example, when the network access authentication program is always running in the foreground, the network detection request is set to be sent automatically periodically, such as once every 30 seconds. In some embodiments, the triggering conditions for a network detection request include: receiving an immediate detection instruction triggered through the interface of the network access authentication program. For example, a network detection button is provided on the interface of the network access authentication program, and when the user terminal clicks the button, a network detection request is sent. The network detection request is sent to a preset domain name to ensure that even if the network access authentication program is closed and reopened or its cache is cleared, the entry point of the authentication server can still be accurately found. In addition, through the automatic or periodic triggering of the network detection request, the user terminal can automatically check its network environment.

[0069] Step 212: The network access control terminal receives the network detection request and redirects it to the authentication server.

[0070] In some embodiments, the network detection request includes the target domain name to be accessed and the network identifier of the user terminal sending the request. When the network detection request points to a preset domain name, the preset domain name is the target domain name to be accessed, therefore the network detection request must contain the preset domain name. When the network access control terminal receives a network detection request containing the preset domain name, it will automatically redirect the network detection request to the authentication server corresponding to the preset domain name.

[0071] Step 213: The authentication server returns a response to the network access control terminal in response to the network detection request.

[0072] In some embodiments, different local area networks (especially wireless LANs and mobile data networks) are equipped with different network access controllers and different authentication servers, and there is a one-to-one correspondence between preset domain names and authentication servers. Therefore, when configuring a preset domain name, a specific preset domain name will only be set on the network access controller that is used with its corresponding authentication server. In other words, the network access controller can only perform redirection operations on that specific preset domain name. Assuming that a request sent by a user terminal to that specific preset domain name can reach the authentication server after being redirected by the network access controller, the authentication server can confirm that the user terminal is connected to its local area network. At this time, the authentication server can respond based on receiving this network detection request. For example, a wireless LAN is equipped with network access controller A and authentication server A, and the preset domain name A corresponding to authentication server A is configured in network access controller A. A mobile data network is equipped with network access controller B and authentication server B, and the preset domain name B corresponding to authentication server B is configured in network access controller B. Suppose a user terminal sends a network detection request to a preset domain A. This request is redirected by network access control terminal A and reaches authentication server A. Authentication server A can then confirm that the user terminal is connected to Wi-Fi A and notifies the user terminal by returning a response. Alternatively, suppose the user terminal sends a network detection request to the preset domain A, but this request reaches network access control terminal B. Network access control terminal B cannot redirect this request to authentication server A, and authentication server A will not respond.

[0073] Step 214: The network access control terminal sends the response to the network detection request to the user terminal.

[0074] In some embodiments, since data transmission between the user terminal and the authentication server must pass through the network access control terminal, the response must also pass through the network access control terminal before reaching the user terminal. The response includes at least the network identifier of the user terminal, used to identify the user terminal receiving the response.

[0075] Step 215: The user terminal receives the response to the network detection request and sends a business operation request to the authentication server through the network access authentication procedure. The business operation request is sent through a preset domain name.

[0076] In some embodiments, a user terminal is considered connected to the wireless local area network (WLAN) upon receiving a response to a network detection request. See step 213 for a detailed explanation, which will not be repeated here. Therefore, the user terminal sends a service operation request via a preset domain name. This request can reach the authentication server associated with the WLAN it is connected to. The service operation request may include at least one of querying the current online status, recharging the account, and performing a proactive offline action. For example, the network access authentication program interface displays three buttons, corresponding to querying the current online status, recharging the account, and performing a proactive offline action. When the user clicks the query current online status button, a request to query the current online status is generated and sent via the preset domain name. The authenticated user terminal still sends various service operation requests via the preset domain name, which avoids the problem of not being able to find the authentication server entry point after the network access authentication program is closed or the cache is cleared, thus improving connection reliability.

[0077] Step 216: The network access control terminal redirects the service operation request to the authentication server.

[0078] In some embodiments, a service operation request includes the target domain name to be accessed and the network identifier of the user terminal sending the request. When the service operation request is sent through a preset domain name, the preset domain name is the target domain name to be accessed, therefore the service operation request necessarily includes the preset domain name. When the network access control terminal receives a service operation request containing the preset domain name, it will automatically redirect the service operation request to the authentication server corresponding to the preset domain name.

[0079] Step 217: The authentication server processes the business operation request and returns the processing result.

[0080] In some embodiments, the service operation request includes the network identifier of the user terminal. After the authentication server processes the service operation request, the processing result returned also includes the network identifier of the user terminal, which is used to determine the user terminal that received the processing result.

[0081] In some embodiments, if a user terminal does not receive a response to a network detection request, it indicates that the user terminal is not connected to the wireless local area network. In this case, the service operation request sent via the preset domain name cannot reach the network access control terminal. For details, please refer to step 213. Therefore, the user terminal can send a service operation request to the backup authentication server through the network access authentication procedure. This service operation request is sent via the backup domain name and redirected to the backup authentication server by the backup network access control terminal. In some embodiments, the backup authentication server maintains data synchronization with the authentication server and is an independent authentication server. For example, there are two AAA servers, one acting as the authentication server and the other as the backup authentication server, and the data on the two AAA servers is synchronized. The operation procedures of the backup network access control terminal and the backup authentication server are the same as those of the network access control terminal and the authentication server; for details, please refer to steps 216 and 217. For example, the user terminal determines that it is not connected to the wireless local area network based on the failure to receive a response to the network detection request. Assuming the user terminal is connected to a mobile data network, it automatically switches to sending service operation requests via an alternate domain name. This request travels through the mobile data network to the alternate network access control terminal, and is then redirected to the alternate authentication server. Based on the response to the network detection request, the user terminal switches to different domain names to send service operation requests, enabling some functions of the network access authentication process to be implemented without relying on the wireless LAN.

[0082] The following example further illustrates the regional network authentication method. Assume that the architecture of Wi-Fi A includes a network access control terminal A and an authentication server, with the authentication server having a fixed domain name of as.gwifi.com.cn. This Wi-Fi network uses WeChat authentication for access authentication, which also supports operations such as querying current online status, topping up accounts, and performing active offline actions. The architecture of the mobile data network includes a network access control terminal B (independent of network access control terminal A in Wi-Fi A) and a backup authentication server, with the backup authentication server having a fixed domain name of as1.gwifi.com.cn. This backup authentication server maintains data synchronization with the authentication server. A user connects their mobile phone to the Wi-Fi network to access the internet. The user selects to connect to the Wi-Fi network in the phone's network connection settings and initiates an internet access request. Because the phone is not authenticated, the internet access request is intercepted by network access control terminal A, which simultaneously sends an authentication portal page to the phone. On the authentication portal page displayed on the user's phone, clicking the button to download the WeChat authentication program generates a download request to the domain as.gwifi.com.cn. This download request is redirected by network access control terminal A to the authentication server. The authentication server responds to the download request by generating a temporary authorization instruction for the phone and sending it to network access control terminal A. Network access control terminal A then configures temporary access permissions for the phone based on the temporary authorization instruction (adding it to a temporary whitelist). At this point, the phone can temporarily access the internet to download the WeChat authentication program. Afterward, the user opens and runs the WeChat authentication program in WeChat and enters authentication information. The WeChat authentication program generates an authentication request to the domain as.gwifi.com.cn based on the authentication information. This authentication request is also redirected by network access control terminal A to the authentication server. After the authentication server verifies the authentication request, it generates a formal authorization instruction for the phone and sends it to network access control terminal A. Network access control terminal A then configures formal access permissions for the phone based on the formal authorization instruction (removing it from the temporary access whitelist and adding it to the formal authorization list for allowing long-term internet access). At this point, the phone can access the internet via Wi-Fi. When a user reopens the WeChat authentication program on their mobile phone or brings it from the background to the foreground, the program automatically sends a network detection request to the domain as.gwifi.com.cn. Assuming the phone receives a response, it indicates that the phone is currently connected to a Wi-Fi network. After the user clicks the "Check Current Online Status" button on the WeChat authentication program interface, a service operation request is generated pointing to the domain as.gwifi.com.cn. This service operation request is also redirected to the authentication server via network access control terminal A. The authentication server processes the service operation request and returns the processing result to the mobile phone, which is then displayed on the WeChat authentication program interface.In this way, the user terminal always transmits data with the authentication server through a preset fixed domain name, ensuring that the user terminal can always connect to the authentication server accurately and without being affected by the network access authentication process being closed or the cache being cleared. If the phone does not receive a response, indicating that the phone is not currently connected to the Wi-Fi network, after the user clicks the "Check Current Online Status" button on the WeChat authentication program interface, a service operation request pointing to the domain name as1.gwifi.com.cn will be generated. This service operation request will be redirected by the network access control terminal B to the backup authentication server. After the backup authentication server processes the service operation request, it returns the processing result to the phone and displays it on the WeChat authentication program interface. Thus, some functions of the network access authentication program can be implemented without relying on the Wi-Fi network.

[0083] Some embodiments in this specification ensure that user terminals can always accurately connect to the authentication service device and transmit data through the network access authentication program by setting preset domain names, even if the network access authentication program is closed or the local cache is cleared. Furthermore, the network access authentication program has an automatic network environment detection function. When it detects that the user terminal is not connected to a wireless LAN, the program will automatically switch the service operation request to another backup domain name for transmission, thereby connecting to the backup authentication service device. This design allows some functions of the network access authentication program to be implemented without relying on a wireless LAN, improving the robustness and availability of the authentication process.

[0084] Figure 3 This is an exemplary flowchart of another local area network authentication method according to some embodiments of this specification. In some embodiments, Figure 3 The process 300 shown can be executed by the terminal device 600. For example... Figure 3 As shown, in some embodiments, process 300 may include the following steps.

[0085] Step 310: Upon first access to the wireless local area network, receive and display the sent portal page. In some embodiments, step 310 may be implemented by the terminal receiving module 610.

[0086] In some embodiments, the portal page may be an authentication portal page, used to guide end-device users through authentication operations. For example, downloading a network access authentication program.

[0087] Step 320: In response to the download trigger operation of the network access authentication procedure on the portal page, a download request is generated and sent. The download request is redirected to access the authentication service device to obtain temporary access rights. In some embodiments, step 310 can be implemented by the request generation module 620, and the sending of the download request in step 310 can be implemented by the terminal sending module 640.

[0088] In some embodiments, the download request is directed to a preset domain name, which may be a pre-configured fixed domain name pointing to a specific authentication service device. For a detailed explanation of the preset domain name, please refer to the description in step 203, which will not be repeated here.

[0089] Step 330: Based on temporary access permissions, access the Internet and download the network access authentication program. In some embodiments, step 330 may be implemented by download module 630.

[0090] In some embodiments, temporary access permissions are configured by the network access control device according to a temporary authorization instruction corresponding to the download request. For a detailed explanation of temporary access permissions, please refer to the descriptions of steps 205 and 206, which will not be repeated here.

[0091] In some embodiments, within the limitations of an Internet authorization token, an application distribution platform on the Internet is accessed to download a network access authentication program. For specific instructions on downloading the network access authentication program, please refer to the description of step 207, which will not be repeated here.

[0092] Step 340: By running the network access authentication program, an authentication request is generated and sent. The authentication request is redirected to the authentication service device to obtain formal access rights. In some embodiments, step 340 can be implemented by the request generation module 620, and the sending of the authentication request in step 340 can be implemented by the terminal sending module 640.

[0093] In some embodiments, the authentication request is directed to a preset domain name. For a detailed explanation of the preset domain name, please refer to the description in step 203; it will not be repeated here.

[0094] In some embodiments, the network access authentication procedure is a WeChat mini-program. Through its user interface, the user inputs authentication information, and the mini-program generates an authentication request based on this information and sends it to the authentication service device. After obtaining official access rights, the device is considered to have accessed the wireless local area network (WLAN), and can freely access the internet through this WLAN. For a detailed explanation of sending the authentication request to the authentication service device, please refer to step 207; it will not be repeated here.

[0095] In some embodiments, after obtaining formal access rights, the network access authentication process can also initiate a network detection request to a preset domain name in response to the triggering condition of the network detection request. This request is redirected to the authentication service device. Whether or not a response to the network detection request is received from the authentication service device determines whether the user is currently connected to a wireless local area network (WLAN). For a detailed explanation of sending the network detection request, please refer to the description of step 211, which will not be repeated here. For a detailed explanation of determining whether the user is currently connected to a WLAN based on the response, please refer to the description of step 213, which will not be repeated here.

[0096] In some embodiments, when it is determined that the current connection is to a wireless local area network (WLAN), a service operation request is sent to the authentication service device through the network access authentication procedure. The service operation request is sent via a preset domain name. For a detailed explanation of sending a service operation request when connected to a WLAN, please refer to the description of step 215, which will not be repeated here.

[0097] In some embodiments, when it is determined that the device is not currently connected to a wireless local area network (WLAN), a service operation request is sent to a backup authentication service device through a network access authentication procedure. The service operation request is sent via a backup domain name and redirected to the backup authentication service device by a backup network access control device. The backup authentication service device maintains data synchronization with the authentication service device. For a detailed explanation of sending a service operation request when not connected to a WLAN, please refer to the description of step 218; it will not be repeated here.

[0098] Figure 4 This is an exemplary flowchart of another local area network authentication method according to some embodiments of this specification. In some embodiments, Figure 4 The process 400 shown can be executed by the network access control device 700. For example... Figure 4 As shown, in some embodiments, process 400 may include the following steps.

[0099] Step 410: Intercept the internet access request initiated by the unauthenticated terminal device through the wireless local area network, and send the portal page to the terminal device. In some embodiments, step 410 can be implemented by the interception module 710, and the sending of the portal page to the terminal device in step 410 can be implemented by the control sending module 720.

[0100] In some embodiments, blocking internet access requests can be achieved by setting a whitelist to control access to terminal devices connected to the wireless local area network. For details on blocking, please refer to the description of step 202, which will not be repeated here.

[0101] In some embodiments, the portal page may be an authentication portal page. For a detailed explanation of the portal page, please refer to the description in step 202; it will not be repeated here.

[0102] Step 420: Receive a download request sent from the terminal device pointing to a preset domain name, and redirect the download request to the authentication service device. In some embodiments, step 420 can be implemented by the control receiving module 730, and the redirection of the download request to the authentication service device in step 410 can be implemented by the redirection module 740.

[0103] In some embodiments, the download request includes a preset domain name, which is configured in the whitelist of the network access control device, thereby redirecting the download request to the authentication service device. For a detailed explanation of redirecting download requests, please refer to step 204; it will not be repeated here.

[0104] Step 430: Receive a temporary authorization instruction corresponding to the terminal device from the authentication service device, and configure temporary access permissions for the terminal device according to the temporary authorization instruction. In some embodiments, step 430 can be implemented by the control receiving module 730, and the configuration of temporary access permissions for the terminal device according to the temporary authorization instruction in step 430 can be implemented by the permission configuration module 750.

[0105] In some embodiments, a temporary authorization instruction may include an internet authorization token with restrictions issued by the authentication service device. These restrictions may be one or both of time-limited and traffic-limited restrictions. For a detailed explanation of the temporary authorization instruction, please refer to the description in step 205; it will not be repeated here.

[0106] In some embodiments, the temporary authorization instruction may also include the network identifier of the terminal device to determine the authorized terminal device. Based on the temporary authorization instruction, the network identifier of the terminal device is added to the temporary access whitelist. For detailed instructions on configuring temporary access permissions, please refer to the description of step 206, which will not be repeated here.

[0107] Step 440: Receive an authentication request sent by the terminal device through the network access authentication procedure, pointing to a preset domain name, and redirect the authentication request to the authentication service device. In some embodiments, step 440 can be implemented by the control receiving module 730, and the redirection of the authentication request to the authentication service device in step 440 can be implemented by the redirection module 740.

[0108] In some embodiments, the authentication request includes a preset domain name, which is configured in the whitelist of the network access control device, thereby redirecting the authentication request to the authentication service device. For a detailed explanation of redirecting the authentication request, please refer to the description of step 208, which will not be repeated here.

[0109] Step 450: Receive a formal authorization instruction corresponding to the terminal device from the authentication service device, and configure formal access permissions for the terminal device according to the formal authorization instruction. In some embodiments, step 450 can be implemented by the control receiving module 730, and the configuration of formal access permissions for the terminal device according to the formal authorization instruction in step 450 can be implemented by the permission configuration module 750.

[0110] In some embodiments, the network access control device determines the terminal device to be granted formal access permission based on the network identifier of the terminal device included in the formal authorization instruction. The formal access permission is configured by removing the network identifier of the terminal device from the temporary access whitelist and adding it to the formal authorization list for allowing long-term access to the Internet. For detailed instructions on configuring formal access permission, please refer to step 210; it will not be repeated here.

[0111] In some embodiments, after configuring formal access permissions, the network access control device receives a network detection request initiated by an authenticated terminal device; wherein the network detection request points to a preset domain name; the network detection request is redirected to the authentication service device; the device also receives a response from the authentication service device to the network detection request; and sends the response to the terminal device. This enables network environment monitoring of the terminal device. For a detailed explanation of redirecting the network detection request, please refer to the description of step 212; for a detailed explanation of sending the response to the terminal device, please refer to the description of step 214, which will not be repeated here.

[0112] In some embodiments, the network access control device may also receive service operation requests initiated by authenticated terminal devices through the network access authentication procedure; the network access control device may redirect the service operation requests to the authentication service device for processing. For a detailed explanation of redirecting service operation requests, please refer to the description of step 216, which will not be repeated here.

[0113] Figure 5 This is an exemplary flowchart of another local area network authentication method according to some embodiments of this specification. In some embodiments, Figure 5 The process 500 shown can be executed by the authentication service device 800. For example... Figure 5 As shown, in some embodiments, process 500 may include the following steps.

[0114] Step 510: Receive a download request from a terminal device, redirected by the network access control device. In some embodiments, step 510 may be implemented by the authentication receiving module 810.

[0115] Step 520: In response to the download request, a temporary authorization instruction for the terminal device is generated and sent to the network access control device to trigger the network access control device to configure temporary access permissions for the terminal device. In some embodiments, step 520 can be implemented by the authorization module 820, and the sending of the temporary authorization instruction for the terminal device to the network access control device in step 520 can be implemented by the authentication sending module 830.

[0116] In some embodiments, the temporary authorization instruction may be an internet authorization token with restrictions, which may be any one or both of time-limited restrictions and traffic restrictions. For a detailed explanation of the temporary authorization instruction, please refer to the description in step 205, which will not be repeated here.

[0117] Step 530: Receive an authentication request from the terminal device, redirected by the network access control device. In some embodiments, step 530 may be implemented by the authentication receiving module 810.

[0118] Step 540: Verify the authentication request, and upon successful verification, generate and send a formal authorization instruction for the terminal device to the network access control device to trigger the network access control device to configure formal access permissions for the terminal device. In some embodiments, step 540 can be implemented by the authorization module 820, and the sending of the formal authorization instruction for the terminal device to the network access control device in step 540 can be implemented by the authentication sending module 830.

[0119] In some embodiments, the authentication request may include information such as the terminal device's identity identifier, network identifier, and verification code. After all information is verified, a formal authorization instruction is generated, which may include the terminal device's network identifier to determine the authorized terminal device.

[0120] In some embodiments, the authentication service device may also receive a network detection request redirected from the network access control device; wherein the network detection request is sent by the authenticated terminal device through a network access authentication procedure. The device then returns a response to the network detection request to the network access control device, so that the terminal device can determine whether it is currently connected to the wireless local area network.

[0121] In some embodiments, the authentication service device may also receive service operation requests redirected from the network access control device; wherein the service operation request is sent by the authenticated terminal device through the network access authentication procedure, the service operation request is processed, and the processing result is returned. The service operation request may include at least one of querying the current online status, recharging the account, and performing proactive offline actions.

[0122] This specification also provides a terminal device. Figure 6This is an exemplary block diagram of a terminal device according to some embodiments of this specification. In some embodiments, the terminal device 600 may be deployed in a user terminal 110. Figure 6 As shown, in some embodiments, the terminal device 600 may include a terminal receiving module 610, a request generating module 620, a downloading module 630, and a terminal sending module 640.

[0123] The terminal receiving module 610 can be used to receive and display the portal page sent when accessing the wireless local area network for the first time.

[0124] The request generation module 620 can be used to generate a download request in response to a download trigger operation of the network access authentication program on the portal page. The download request is redirected to access the authentication service device to obtain temporary access rights; wherein, the download request points to a preset domain name. The request generation module 620 is also used to generate an authentication request by running the network access authentication program. The authentication request is redirected to access the authentication service device to obtain formal access rights; wherein, the authentication request points to a preset domain name.

[0125] Download module 630 can be used to access the Internet and download network access authentication programs based on temporary access permissions.

[0126] The terminal sending module 640 can be used to send download requests and / or authentication requests.

[0127] In some optional embodiments, temporary access permissions can be configured by the network access control device based on a temporary authorization instruction corresponding to the download request. The temporary authorization instruction may include an internet authorization token with restrictions issued by the authentication service device. These restrictions may include time limits and / or traffic limitations. The download module 630 can also be used to access an application distribution platform on the internet, within the restrictions of the internet authorization token, to download a network access authentication program.

[0128] In some optional embodiments, the network access authentication procedure can be a WeChat mini-program. The terminal receiving module 610 can also be used to provide a user interface via the WeChat mini-program to receive authentication information input by the user. The request generation module 620 can also be used to generate an authentication request based on the authentication information.

[0129] In some optional embodiments, the terminal sending module 640 can also be used to control the network access authentication procedure to initiate a network detection request to a preset domain name in response to the triggering condition of the network detection request.

[0130] In some optional embodiments, the terminal device 600 may further include a network determination module 650, used to determine whether it is currently connected to a wireless local area network based on whether it receives a response to a network detection request from an authentication service device.

[0131] In some optional embodiments, the terminal sending module 640 can also be used to send a service operation request to the authentication service device through the network access authentication procedure.

[0132] This specification also provides a network access control device. Figure 7 This is an exemplary block diagram of a network access control device according to some embodiments of this specification. In some embodiments, the network access control device 700 may be deployed in a network access control terminal 120. Figure 7 As shown, in some embodiments, the network access control device 700 may include an interception module 710, a control sending module 720, a control receiving module 730, a redirection module 740, and a permission configuration module 750.

[0133] The interception module 710 can be used to intercept Internet access requests initiated by unauthenticated terminal devices through a wireless local area network.

[0134] The control sending module 720 can be used to send portal pages to terminal devices.

[0135] The control receiving module 730 can be used to receive download requests sent by terminal devices pointing to preset domain names, receive temporary authorization instructions corresponding to terminal devices from authentication service devices, receive authentication requests sent by terminal devices through network access authentication procedures pointing to preset domain names, and receive formal authorization instructions corresponding to terminal devices from authentication service devices.

[0136] The redirection module 740 can be used to redirect download requests and / or authentication requests to the authentication service device.

[0137] The permission configuration module 750 is used to configure temporary access permissions for the terminal device according to the temporary authorization instruction, and to configure formal access permissions for the terminal device according to the formal authorization instruction.

[0138] In some optional embodiments, the control receiving module 730 may also be used to receive network detection requests and / or service operation requests initiated by an authenticated terminal device, and / or receive responses from the authentication service device to the network detection requests.

[0139] In some optional embodiments, the redirection module 740 can also be used to redirect network detection requests and / or service operation requests to the authentication service device.

[0140] In some alternative embodiments, the control sending module 720 can also be used to send a response to a terminal device.

[0141] This manual also provides an authentication service device. Figure 8 This is an exemplary block diagram of an authentication service device according to some embodiments of this specification. In some embodiments, the authentication service device 800 may be deployed on the authentication server 130. Figure 8 As shown, in some embodiments, the authentication service device 800 may include an authentication receiving module 810, an authorization module 820, and an authentication sending module 830.

[0142] The authentication receiving module 810 can be used to receive download requests and / or authentication requests from terminal devices that are redirected by the network access control device.

[0143] The authorization module 820 can be used to generate a temporary authorization instruction for the terminal device in response to a download request, so as to trigger the network access control device to configure temporary access permissions for the terminal device; it can also be used to verify the authentication request, and after the verification is successful, generate a formal authorization instruction for the terminal device, so as to trigger the network access control device to configure formal access permissions for the terminal device.

[0144] The authentication sending module 830 is used to send temporary authorization instructions and / or formal authorization instructions to the network access control device.

[0145] In some optional embodiments, the authentication receiving module 810 can also be used to receive network detection requests and / or service operation requests redirected from the network access control device. The network detection requests and / or service operation requests are sent by the authenticated terminal device through the network access authentication procedure.

[0146] In some alternative embodiments, the authentication sending module 830 may also be used to return a response to a network detection request to the network access control device, and / or return a processing result.

[0147] In some optional embodiments, the authentication service device 800 further includes a business processing module 840, which can be used to process business operation requests. These business operation requests include at least one of querying the current online status, recharging an account, and performing an active offline action.

[0148] This specification also provides a local area network authentication system. In some embodiments, the local area network authentication system includes a user terminal, a network access control terminal, and an authentication server.

[0149] The user terminal is used to receive and display the distributed portal page, and in response to the download trigger operation of the network access authentication program on the portal page, generate and send a download request. The download request is redirected to access the authentication server to obtain temporary access rights. It is also used to access the Internet and download the network access authentication program based on the temporary access rights, and generate and send an authentication request by running the network access authentication program. The authentication request is redirected to access the authentication server to obtain formal access rights.

[0150] The network access control terminal is used to intercept internet access requests initiated by unauthenticated user terminals through the wireless local area network, and to send a portal page to the user terminals. It receives download requests from user terminals pointing to a preset domain name and redirects these requests to the authentication server. It also receives temporary authorization instructions from the authentication server corresponding to the user terminal and configures temporary access permissions for the user terminals based on these instructions. Furthermore, it receives authentication requests from user terminals sent through the network access authentication program pointing to a preset domain name, redirects these requests to the authentication server, receives formal authorization instructions from the authentication server corresponding to the user terminal, and configures formal access permissions for the user terminals based on these instructions.

[0151] The authentication server is used to receive download requests from user terminals that are redirected from the network access control terminal, and in response to the download requests, generate and send a temporary authorization instruction for the user terminal to the network access control terminal to trigger the network access control terminal to configure temporary access permissions for the user terminal; it is also used to receive and verify authentication requests from user terminals that are redirected from the network access control terminal, and after successful verification, generate and send a formal authorization instruction for the user to the network access control terminal to trigger the network access control terminal to configure formal access permissions for the user terminal.

[0152] For more information on each module, please refer to [link / reference]. Figure 1-5 The relevant explanations will not be repeated here. It should be understood that... Figure 6-8The systems and modules shown can be implemented in various ways. For example, in some embodiments, the systems and modules can be implemented by hardware, software, or a combination of both. The hardware portion can be implemented using dedicated logic; the software portion can be stored in memory and executed by an appropriate instruction execution system, such as a microprocessor or dedicated-design hardware. Those skilled in the art will understand that the methods and systems described above can be implemented using computer-executable instructions and / or included in the control code of a processor, such as on a media such as a disk, CD, or DVD-ROM, or in the memory of a programmable device. The systems and modules of this specification can be implemented not only by hardware circuits such as very large-scale integrated circuits or gate arrays, semiconductors such as logic chips and transistors, or programmable hardware devices such as field-programmable gate arrays and programmable logic devices, but also by software, for example, executed by various types of processors, or by a combination of the aforementioned hardware circuits and software (e.g., firmware).

[0153] It should be noted that the above description of the system and its modules is for convenience only and should not be construed as limiting this specification to the embodiments described. It is understood that those skilled in the art, after understanding the principles of this system, may arbitrarily combine the various modules without departing from these principles to form subsystems connected to other modules. Alternatively, some modules may be split to obtain more modules or multiple units under a single module. Such modifications are all within the scope of this specification.

[0154] Some embodiments of this specification also provide a computer program product, including a computer program that, when at least a portion of the computer program is executed by a processor, can perform the functions outlined in the appendix to this specification. Figure 2-5 The method is illustrated. In some embodiments, the computer program product may involve only a computer program, which may be carried on a storage medium or a processing device. In other embodiments, the computer program product may also be a storage medium or a processing device containing the aforementioned computer program. The processing device may include one or more processors, and the storage medium.

[0155] The beneficial effects that the embodiments of this specification may bring include, but are not limited to: by setting a preset domain name, it ensures that the user terminal can always accurately connect to the authentication service device and transmit data through the network access authentication program, even if the network access authentication program is closed or the local cache is cleared, the reliability of the connection is not affected; the network access authentication program has an automatic network environment detection function. When it detects that the user terminal is not connected to the wireless local area network, the program will automatically switch the service operation request to another backup domain name for transmission, thereby connecting to the backup authentication service device. This allows some functions of the network access authentication program to be implemented without relying on the wireless local area network, improving the robustness and availability of the authentication process. It should be noted that different embodiments may produce different beneficial effects. In different embodiments, the beneficial effects that may occur can be any one or a combination of the above, or any other possible beneficial effects.

[0156] The basic concepts have been described above. It is obvious that the detailed disclosure above is merely illustrative and does not constitute a limitation of this specification. Although not explicitly stated herein, various modifications, improvements, and corrections may be made to this specification by those skilled in the art. Such modifications, improvements, and corrections are taught in this specification and therefore remain within the spirit and scope of the exemplary embodiments described herein.

Claims

1. A method of authenticating a local network, characterized by, The method comprises: When first accessing the wireless local area network, receiving and displaying a portal page issued; In response to a download operation of a network access authentication program on the portal page, generating and sending a download request, the download request being redirected to an access authentication server to obtain temporary access permission; wherein the download request points to a preset domain name; Based on the temporary access permission, accessing the Internet and downloading the network access authentication program; By running the network access authentication program, generating and sending an authentication request, the authentication request being redirected to the authentication server to obtain formal access permission; wherein the authentication request points to the preset domain name.

2. The method of claim 1, wherein, The temporary access permission is configured by a network access control end according to a temporary authorization instruction corresponding to the download request; the temporary authorization instruction includes an Internet authorization token issued by the authentication server with a restriction condition; wherein the restriction condition includes time effectiveness and / or traffic limit; Based on the temporary access permission, accessing the Internet and downloading the network access authentication program, comprising: Within the limitation condition of the Internet authorization token, accessing an application distribution platform on the Internet to download the network access authentication program.

3. The method of claim 1, wherein, The network access authentication program is a WeChat mini-program; The network access authentication program is a WeChat mini-program; The method further comprises: In response to a trigger condition of a network detection request, controlling the network access authentication program to initiate the network detection request to the preset domain name; wherein the network detection request initiated to the preset domain name is redirected to the authentication server; 4. The method according to any one of claims 1 to 3, characterized in that, According to whether the authentication server responds to the network detection request, it is determined whether the current wireless local area network is connected; Wherein, the network detection request is a heartbeat packet; the trigger condition of the network detection request includes at least one of the following: The network access authentication program is opened automatically; The network access authentication program is periodically triggered during foreground operation; Receive the instant detection instruction triggered through the interface of the network access authentication program. The method further comprises: When it is determined that the current wireless local area network is connected, sending a business operation request to the authentication server through the network access authentication program, the business operation request being sent through the preset domain name; and / or, 5. The method of claim 4, wherein, When it is determined that the current wireless local area network is not connected, sending a business operation request to a backup authentication server through the network access authentication program, the business operation request being sent through a backup domain name and being redirected to the backup authentication server through a backup network access control end; wherein the backup authentication server and the authentication server keep data synchronization; Wherein, the business operation request includes at least one of the following: Querying the current online state; Carrying out account recharge; Executing active offline. The method comprises: ​ 6. A method of authenticating a local network, characterized by, ​ intercepting an Internet access request initiated by an unauthenticated user terminal through a wireless local area network, and issuing a portal page to the user terminal; receiving a download request sent by the user terminal and directed to a preset domain name, and redirecting the download request to an authentication server; receiving a temporary authorization instruction corresponding to the user terminal from the authentication server, and configuring temporary access permission for the user terminal according to the temporary authorization instruction; receiving an authentication request sent by the user terminal through the network access authentication program and directed to the preset domain name, and redirecting the authentication request to the authentication server; receiving a formal authorization instruction corresponding to the user terminal from the authentication server, and configuring formal access permission for the user terminal according to the formal authorization instruction.

7. The method of claim 6, wherein, The method further comprises: adding the network identifier of the user terminal to a temporary access whitelist according to the temporary authorization instruction; wherein the temporary authorization instruction comprises an Internet authorization token with a restriction condition issued by the authentication server, and the restriction condition comprises time effectiveness and / or traffic limit; The method further comprises: removing the network identifier of the user terminal from the temporary access whitelist; adding the network identifier of the user terminal to a formal authorization list for allowing long-term access to the Internet.

8. The method of claim 6, wherein, The method further comprises: receiving a network detection request initiated by an authenticated user terminal; wherein the network detection request is directed to the preset domain name; redirecting the network detection request to the authentication server; receiving a response to the network detection request from the authentication server; sending the response to the user terminal.

9. The method of claim 8, wherein, The method further comprises: receiving a service operation request initiated by the authenticated user terminal through the network access authentication program; wherein the service operation request is directed to the preset domain name; redirecting the service operation request to the authentication server for processing.

10. A method of authenticating a local network, characterized by, The method comprises: receiving a download request from a user terminal redirected by a network access control end; in response to the download request, generating and sending a temporary authorization instruction for the user terminal to the network access control end to trigger the network access control end to configure temporary access permission for the user terminal; receiving an authentication request from the user terminal redirected by a network access control end; verifying the authentication request, and after verification, generating and sending a formal authorization instruction for the user terminal to the network access control end to trigger the network access control end to configure formal access permission for the user terminal.

11. The method of claim 10, wherein, The method further comprises: receiving a network detection request redirected by the network access control end; wherein the network detection request is sent by the authenticated user terminal through the network access authentication program; returning a response to the network detection request to the network access control end for the user terminal to determine that the current connection is in the wireless local area network.

12. The method of claim 11, wherein, The method further comprises: receiving a service operation request redirected by the network access control end; wherein the service operation request is sent by the authenticated user terminal through the network access authentication program; processing the service operation request and returning a processing result; wherein the service operation request comprises at least one of the following: inquiring about the current online state; recharging an account; performing active offline.

13. A terminal device, comprising: The device comprises: a terminal receiving module configured to receive and display a portal page issued when accessing a wireless local area network for the first time; a request generating module configured to generate a download request in response to a download trigger operation of a network access authentication program on the portal page, the download request being redirected to an authentication service device to obtain temporary access authority; and generate an authentication request by running the network access authentication program, the authentication request being redirected to the authentication service device to obtain formal access authority; wherein the download request is directed to a preset domain name; and the authentication request is directed to the preset domain name; a downloading module configured to access the Internet and download the network access authentication program based on the temporary access authority; a terminal sending module configured to send the download request and / or the authentication request.

14. A network access control device, characterized by The device comprises: an intercepting module configured to intercept an Internet access request initiated by an unauthenticated terminal device through a wireless local area network; a control sending module configured to issue a portal page to the terminal device; a control receiving module configured to receive a download request sent by the terminal device and directed to a preset domain name, receive a temporary authorization instruction corresponding to the terminal device from the authentication service device, receive an authentication request sent by the terminal device through the network access authentication program and directed to the preset domain name, and receive a formal authorization instruction corresponding to the terminal device from the authentication service device; a redirecting module configured to redirect the download request and / or the authentication request to an authentication service device; an authority configuring module configured to configure temporary access authority for the terminal device according to the temporary authorization instruction, and configure formal access authority for the terminal device according to the formal authorization instruction.

15. An authentication service device, characterized by The device comprises: an authentication receiving module configured to receive a download request and / or an authentication request from a terminal device redirected by a network access control device; an authorization module configured to generate a temporary authorization instruction for the terminal device in response to the download request, to trigger the network access control device to configure temporary access authority for the terminal device; and verify the authentication request, and generate a formal authorization instruction for the terminal device after verification, to trigger the network access control device to configure formal access authority for the terminal device; an authentication sending module configured to send the temporary authorization instruction and / or the formal authorization instruction to the network access control device.

16. A zone network authentication system characterized by comprising: The system comprises a user terminal, a network access control end, and an authentication service end; The user terminal is configured to receive and display the portal page, generate and send a download request in response to a download operation of the network access authentication program on the portal page, and redirect the download request to the access authentication server to obtain temporary access permission. The user terminal is further configured to access the Internet and download the network access authentication program based on the temporary access permission, generate and send an authentication request by running the network access authentication program, and redirect the authentication request to the authentication server to obtain formal access permission. The network access control terminal is configured to intercept an Internet access request initiated by an unauthenticated user terminal through a wireless local area network, distribute a portal page to the user terminal, receive a download request sent by the user terminal and directed to a preset domain name, redirect the download request to the authentication server, receive a temporary authorization instruction corresponding to the user terminal from the authentication server, and configure temporary access permission for the user terminal according to the temporary authorization instruction. The network access control terminal is further configured to receive an authentication request sent by the user terminal through the network access authentication program and directed to the preset domain name, redirect the authentication request to the authentication server, receive a formal authorization instruction corresponding to the user terminal from the authentication server, and configure formal access permission for the user terminal according to the formal authorization instruction. The authentication server is configured to receive a download request from a user terminal redirected by a network access control terminal, generate and send a temporary authorization instruction for the user terminal to the network access control terminal in response to the download request, to trigger the network access control terminal to configure temporary access permission for the user terminal, receive and verify an authentication request from the user terminal redirected by the network access control terminal, and generate and send a formal authorization instruction for the user terminal to the network access control terminal after verification, to trigger the network access control terminal to configure formal access permission for the user terminal.

17. An apparatus for area network authentication, the apparatus comprising: The network access control terminal includes a processor and a memory, the memory stores computer programs or computer executable instructions, and the computer programs or computer executable instructions are executed by the processor to implement the regional network authentication method of any one of claims 1 to 12.

18. A computer program product, characterised in that, The network access control terminal includes a computer program, and at least part of the computer program is executed by the processor to implement the regional network authentication method of any one of claims 1 to 12.

Images