A multi-protocol awareness based mobile network device forced authentication system and method

Abstract

The application discloses a kind of mobile network equipment forced authentication system and method based on multi-protocol perception, belong to wireless network portal authentication technical field, for the problem that non-HTTP protocol cannot trigger authentication in existing Captive Portal technology, system pop-up window can only trigger once and Wi-Fi connection is unstable and leads to authentication interruption, the present application works through delay authentication mark, dynamic DHCP lease management and intelligent network scoring protection cooperation, when the system detects the non-HTTP class protocol request of unauthenticated device, set delay authentication mark and block request, trigger authentication when its subsequent HTTP request or system detection;By allocating short lease for unauthenticated device, trigger system re-detection using lease expiration or IP address change, realize authentication pop-up window multiple trigger;And return normal network response to maintain high network score when user initial connection, prevent user equipment automatic switching network.

Description

Technical Field

[0001] This disclosure relates to the field of mandatory network portal authentication technology, and in particular to a mandatory authentication system and method for mobile network devices based on multi-protocol awareness. Background Technology

[0002] Captive portal technology is widely used in Wi-Fi networks that require user authentication. Its traditional workflow is as follows: when a user connects to a Wi-Fi network, unauthenticated access is blocked and redirected to the authentication page. This process relies on HTTP redirection status codes (such as 302) and the Location header field. After the server returns a redirection response, the browser automatically requests the new URL, thus displaying the authentication page. Simultaneously, DNS redirection is often used in conjunction with HTTP redirection, first pointing the user's domain name request to the gateway IP, and then completing the page redirection via HTTP. After the user completes authentication, the traffic is allowed to proceed. However, existing technologies have significant drawbacks:

[0003] Non-HTTP protocols cannot trigger authentication: Currently, many applications use encrypted or non-HTTP protocols such as HTTPS, QUIC (based on UDP), and DNS over UDP. Traditional Captive Portals rely on HTTP redirection, and the first request for a non-HTTP protocol can only be rejected or dropped, causing users to perceive that they are "connected but unable to access the internet," and they are unaware that authentication is required.

[0004] The system pop-up can only be triggered once: The operating system (such as iOS, Android, Windows) performs a network probe and pops up a pop-up during the first connection. If the user ignores or closes the pop-up, the system will mark the network status and will not actively pop up a pop-up again. The user will then be stuck in a predicament where they cannot access the Internet and cannot trigger authentication again. Usually, they need to "forget the network" and reconnect.

[0005] Unstable Wi-Fi connections can cause authentication interruptions: Operating systems (especially Android and its customized systems such as MIUI and EMUI) score network quality. Unauthenticated networks are marked as "limited" and have their scores lowered. When other available networks become available (such as saved Wi-Fi or mobile data), the system may automatically switch networks, causing unexpected interruptions to the authentication process and resulting in a poor user experience. Therefore, a comprehensive technical solution to address these issues is urgently needed. Summary of the Invention

[0006] This invention aims to overcome the shortcomings of existing technologies and provide a mobile network device mandatory authentication system and method based on multi-protocol awareness. Its core lies in the synergy of three mechanisms: "delayed authentication tagging", "dynamic DHCP lease management" and "intelligent network scoring protection", to achieve multiple triggering of authentication for non-HTTP protocols and authentication pop-ups, and to maintain network connection stability during the authentication process.

[0007] In a first aspect, this application provides a multi-protocol-aware mobile network device mandatory authentication system, comprising:

[0008] The connection tracking and status management module is used to monitor the network connection between user equipment and mobile network equipment, obtain the MAC address and IP address of user equipment, identify the type and operating system type of user equipment, and maintain an authentication status table, which records at least the authentication status and delayed authentication flag of user equipment.

[0009] The multi-protocol awareness and delay authentication module is used to identify requests of various protocol types. When an unauthenticated user device initiates a non-HTTP protocol request, the delay authentication flag of the user device is set to active, the blocked request information is recorded, and the request is blocked.

[0010] The dynamic DHCP lease management module is used to allocate different lease times based on the different authentication status of user equipment and whether there is a delayed authentication flag. When a short lease expires, the system is triggered to re-probe the network.

[0011] The multi-operating system network detection adaptation module is used to identify and adapt to the mandatory authentication network detection requests of various operating systems, and trigger the corresponding network detection authentication pop-up window according to the authentication status of the user device.

[0012] The Authentication Portal service module provides an authentication page and updates the authentication status of the user device to "authenticated" after successful authentication, and clears the delayed authentication flag.

[0013] Furthermore, the multi-protocol awareness and delay authentication module includes:

[0014] Protocol identification unit, used to identify HTTP, HTTPS, QUIC, and UDP protocols;

[0015] The delayed authentication tag unit is used to set a delayed authentication tag when a non-HTTP protocol request is detected;

[0016] The request blocking unit is used to return a connection reset for TCP requests and to silently discard UDP requests.

[0017] Furthermore, the dynamic DHCP lease management module allocates an hourly lease time to authenticated user equipment, a first-second lease time to newly connected but unauthenticated user equipment, and a second-second lease time to unauthenticated user equipment with a delayed authentication flag, wherein the second-second lease time is shorter than the first-second lease time.

[0018] Furthermore, if the second-second lease time of the unauthenticated user equipment with a delayed authentication mark expires, a new DHCP request will be initiated. If the user equipment is still found to be unauthenticated, the dynamic DHCP lease management module will allocate a new IP address. The change of IP address will trigger the operating system to re-probe the network.

[0019] Furthermore, the mobile network device mandatory authentication system based on multi-protocol awareness also includes an intelligent network scoring protection module. In the initial stage after a user device connects to the network, if it is determined that the user device has not yet had actual network activity, the module returns a response indicating that the network is normal to the network probe request from the operating system to maintain the network score. After it is determined that the user device has actual network activity, the module determines the response content to the network probe request based on the user device's authentication status and delayed authentication flag to prevent the user device from automatically switching to other networks.

[0020] Secondly, this application provides a multi-protocol-aware mobile network device mandatory authentication method, applied to the aforementioned multi-protocol-aware mobile network device mandatory authentication system, which is mainly deployed on devices such as MiFi devices or enterprise wireless access points. This includes:

[0021] S1: The user equipment connects to the network access point, obtains the user equipment MAC address, identifies the user equipment type and operating system type, the system assigns it an IP address and initial lease, creates a record in the authentication status table, and initializes the delayed authentication flag as inactive;

[0022] S2: System network detection processing, including:

[0023] S201: The system automatically initiates network detection. When an unauthenticated user device initiates an HTTP protocol request, it triggers the authentication page. After authentication, it records the authenticated status of the user device, assigns an hourly lease, returns a normal response, and the system determines that the network is available.

[0024] S202: The system automatically initiates network detection. When an unauthenticated user device is detected to be accessing the network and has not initiated a non-HTTP protocol request, a first-second lease is allocated.

[0025] S203: The system automatically initiates network probing. When an unauthenticated user device initiates a non-HTTP protocol request, the request is blocked, a second-second lease is allocated, and a delayed authentication flag is activated in its authentication status record. The duration of the second-second lease is shorter than that of the first-second lease.

[0026] S3: When the first-second lease expires, the system re-triggers the authentication page. If the unauthenticated user device ignores or closes the page, when it initiates its first non-HTTP protocol request, the system will determine whether the user device performs authentication. If no authentication is performed, the first-second lease will be changed to a second-second lease, and the delayed authentication flag will be activated.

[0027] S4: When an HTTP request is detected from a user device with a delayed authentication flag, a redirect response is returned to the user device to trigger the authentication page;

[0028] S5: After the user completes authentication through the authentication page, the delayed authentication flag is cleared and the device's DHCP lease is updated to an hourly lease.

[0029] Furthermore, in step S2, the hourly rental period is 1-2 hours, the first second rental period is 30-60 seconds, and the second second rental period is 15-30 seconds.

[0030] Furthermore, in step S202, if the user equipment initiates an HTTP protocol request, the process proceeds to step S201; if it initiates a non-HTTP protocol request, the process proceeds to step S203.

[0031] Furthermore, step S2 also includes S204: If, in step S203, the user equipment still fails to authenticate after the third or more second-second lease cycles, the system allocates a new IP address to trigger the operating system to re-initiate network probing.

[0032] Furthermore, in step S1, after the user equipment first connects to the network access point, there is also a network score protection phase: when the user equipment has just connected and has not performed any actual network operations, the system probe request returns a normal response, which makes the system determine that the network is available, maintains a normal network score, and avoids triggering the user equipment to automatically switch to the mobile data network or other Wi-Fi networks.

[0033] This application discloses a multi-protocol-aware mobile network device mandatory authentication system and method, which has the following beneficial effects:

[0034] 1. Through the "delayed authentication tag" mechanism, regardless of the protocol of the user device's first request (HTTP, HTTPS, QUIC, UDP protocol), it can be recorded and authentication can be triggered in subsequent HTTP interactions. This increases the success rate of authentication triggering in non-HTTP scenarios from nearly 0% to over 95%, effectively solving the problem that the first request for a non-HTTP protocol cannot trigger network authentication.

[0035] 2. By combining dynamic DHCP short lease management with system detection mechanism, after the user ignores the first pop-up, the system can be forced to re-detect within tens of seconds through lease expiration, triggering the authentication pop-up again. This makes the pop-up re-trigger success rate exceed 90%, solving the problem that the network system authentication pop-up can only be triggered once.

[0036] 3. By employing the "intelligent network score protection" strategy, the system is presented as having a normal network before the user actually starts online operations, maintaining a high network score. This effectively prevents the operating system from automatically switching to mobile data or other Wi-Fi networks due to a low network score, ensuring the continuity of the authentication process and user experience, and significantly improving the stability of Wi-Fi connections during the authentication process. Attached Figure Description

[0037] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0038] Figure 1 This is a system principle block diagram of the mandatory authentication system for mobile network devices based on multi-protocol awareness disclosed in this invention.

[0039] Figure 2 This is a flowchart of the mandatory authentication process for mobile network devices based on multi-protocol awareness disclosed in this invention.

[0040] Figure 3 This is a timing diagram of the mandatory authentication process for mobile network devices based on multi-protocol awareness disclosed in this invention. Detailed Implementation

[0041] The embodiments of the present invention will be described in detail below with reference to the accompanying drawings and examples, so that the process of how the present invention uses technical means to solve technical problems and achieve technical effects can be fully understood and implemented accordingly.

[0042] It should be noted that, unless otherwise specified, the embodiments of the present invention and the various features thereof can be combined with each other, all of which are within the protection scope of the present invention. Furthermore, the steps shown in the flowcharts of the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowcharts, in some cases, the steps shown or described may be performed in a different order than that shown here.

[0043] Please refer to Figure 1 Example 1 provides a multi-protocol awareness-based mandatory authentication system for mobile network devices, primarily deployed on devices such as MiFi devices or enterprise wireless access points. It mainly includes a connection tracking and state management module for monitoring network connections between user devices and mobile network devices, obtaining the user device's MAC address and IP address, identifying the user device's type and operating system type, and maintaining an authentication status table that records at least the user device's authentication status and delayed authentication flag. The multi-protocol awareness and delayed authentication module identifies requests of various protocol types. When an unauthenticated user device initiates a non-HTTP protocol request, it sets the user device's delayed authentication flag to an active state and records the... The system blocks the request information and the request itself; the dynamic DHCP lease management module allocates different lease times based on the user device's authentication status and whether there is a delayed authentication flag, and triggers the system to re-probe the network when the short lease time expires; the multi-operating system network detection adaptation module identifies and adapts to the forced authentication network detection requests of various operating systems, and triggers the corresponding network detection authentication pop-up window based on the user device's authentication status, including iOS, Android, Windows, and macOS; the authentication portal service module provides the authentication page and updates the user device's authentication status to authenticated after successful authentication, and clears the delayed authentication flag.

[0044] Specifically, the authentication status table includes the following fields: MAC address, IP address, authentication status, delayed authentication flag, VPN status flag, blocked request count, first blocking timestamp, device type, operating system type, connection time, and authentication time.

[0045] Specifically, the connection tracking and status management module includes: a device identification acquisition unit: used to acquire the MAC address and assigned IP address of the user device through DHCP interaction, and maintain the MAC-IP mapping relationship through the ARP table; an authentication status storage unit: maintaining an authentication status table, recording the MAC address, IP address, authentication status, delayed authentication flag, blocked request count, first blocking timestamp, device type, and operating system type information of each device; a device type identification unit: used to identify the device type (mobile phone / tablet / laptop / desktop) and operating system type (iOS / Android / Windows / macOS) through DHCP fingerprinting, User-Agent analysis, and MAC address vendor prefix methods; and a connection status monitoring unit: used to monitor changes in the device's connection status, including new connections, disconnections and reconnections, and IP change events.

[0046] Specifically, the multi-protocol awareness and delay authentication module includes a protocol identification unit: used to perform deep protocol identification on data packets entering the network access device, distinguishing between HTTP, HTTPS, QUIC, UDP, TCP, and other protocol types, with identification criteria including target port, protocol characteristics, and data packet format; a non-HTTP request detection unit: used to detect HTTPS (TCP port 443), QUIC (UDP port 443), and ordinary UDP non-HTTP protocol requests initiated by unauthenticated devices; a delay authentication marking unit: used to set the delay authentication mark of the unauthenticated device to an active state when a non-HTTP protocol request is detected, and simultaneously record the protocol type, target address, and timestamp information of the blocked request; and a request blocking unit: used to block non-HTTP protocol requests, return a connection reset signal for TCP requests, and silently discard UDP requests to avoid indefinite waiting for user applications.

[0047] Specifically, the multi-operating system network detection adaptation module is used to adapt to the network detection mechanisms of different operating systems. It includes a detection request identification unit: used to identify the network detection request characteristics of each operating system (e.g., for iOS / macOS detection, identifying access requests to the captive.apple.com domain; for Android detection, identifying access requests to the connectivitycheck.gstatic.com domain; for Windows detection, identifying access requests to the msftconnecttest.com domain; and simultaneously identifying backup detection URLs and IPv6 detection URLs for each system). A detection response generation unit: used to generate a response format that conforms to the expected format of the system based on the device authentication status and operating system type (for iOS / macOS: returning HTML content other than "Success" when unauthenticated, and returning HTML with a "Success" header when authenticated; for Android: returning a response with a non-204 status code when unauthenticated, and returning an HTTP 204 when authenticated). NoContent; For Windows: Returns a redirect response when unauthenticated, and returns the specified text content when authenticated. Response format verification unit: Used to ensure that the returned response format fully conforms to the expectations of each operating system, avoiding system misjudgment due to format issues; Probe cache control unit: Used to add header information to the response to prevent caching, ensuring that the latest authentication status is obtained with each probe.

[0048] Specifically, the dynamic DHCP lease management module is used to trigger the system to re-probe the network by adjusting the DHCP lease time. It includes an authentication status awareness unit that queries the device's authentication status and delayed authentication flag when processing DHCP requests; a dynamic lease allocation unit that allocates different lease times based on the authentication status (e.g., for authenticated devices: allocate hourly leases of 1-2 hours to reduce DHCP interaction frequency; for newly connected unauthenticated devices: allocate first-second leases of 30-60 seconds to facilitate re-probeing; for unauthenticated devices with delayed authentication flags: allocate second-second leases of 15-30 seconds to accelerate authentication triggering; for devices that have failed or canceled authentication: maintain short leases and wait for the user to retry); a lease expiration trigger unit that, when a short lease expires, triggers the operating system to re-probe the network when the device re-initiates a DHCP request; and a lease upgrade unit that immediately upgrades the lease to an hourly lease after the user completes authentication, reducing subsequent DHCP interactions. Preferably, it may also include a lease storm protection unit that appropriately extends the lease time for devices that have not been authenticated for a long time to avoid excessively frequent DHCP requests affecting network performance.

[0049] For the same lease storm protection function, when an unauthenticated user device with a delayed authentication mark re-initiates a DHCP request after the second-second lease has reached the third cycle, if the user device is still found to be unauthenticated, the dynamic DHCP lease management module will allocate a new IP address and trigger the operating system to re-probe the network through the change of IP address.

[0050] In this embodiment, preferably, the mobile network device mandatory authentication system based on multi-protocol awareness further includes an intelligent network scoring protection module. This module is used to maintain the network score by returning a response indicating normal network activity to the operating system's network probe request in the initial stage after the user device connects to the network if it is determined that the user device has not yet engaged in actual network activity. After determining that the user device has engaged in actual network activity, the module determines the response content to the network probe request based on the user device's authentication status and delayed authentication flag, preventing the user device from automatically switching to other networks, such as mobile data networks or other recorded Wi-Fi networks.

[0051] Please refer to Figure 2 Example 2 provides a method for mandatory authentication of mobile network devices based on multi-protocol awareness, which is applied to the mandatory authentication system for mobile network devices based on multi-protocol awareness described in Example 1. The method includes the following steps:

[0052] S1: The user equipment connects to the network access point, obtains the user equipment MAC address, identifies the user equipment type and operating system type, the system assigns it an IP address and initial lease, creates a record in the authentication status table, and initializes the delayed authentication flag as inactive;

[0053] S2: System network detection processing, including:

[0054] S201: The system automatically initiates network detection. When an unauthenticated user device initiates an HTTP protocol request, it triggers the authentication page. After authentication, it records the authenticated status of the user device, assigns an hourly lease, returns a normal response, and the system determines that the network is available.

[0055] S202: The system automatically initiates network detection. When an unauthenticated user device is detected to be accessing the network and has not initiated a non-HTTP protocol request, a first-second lease is allocated.

[0056] S203: The system automatically initiates network probing. When an unauthenticated user device initiates a non-HTTP protocol request, the request is blocked, a second-second lease is allocated, and a delayed authentication flag is activated in its authentication status record. The duration of the second-second lease is shorter than that of the first-second lease.

[0057] S3: When the first-second lease expires, the system re-triggers the authentication page. If the unauthenticated user device ignores or closes the page, when it initiates its first non-HTTP protocol request, the system will determine whether the user device performs authentication. If no authentication is performed, the first-second lease will be changed to a second-second lease, and the delayed authentication flag will be activated.

[0058] S4: When an HTTP request is detected from a user device with a delayed authentication flag, a redirect response is returned to the user device to trigger the authentication page;

[0059] S5: After the user completes authentication through the authentication page, the delayed authentication flag is cleared and the device's DHCP lease is updated to an hourly lease.

[0060] In step S2, the hourly lease time is 1-2 hours, the first-second lease time is 30-60 seconds, and the second-second lease time is 15-30 seconds. By dynamically adjusting the DHCP lease time, the system is triggered to re-probe after the short lease expires, enabling multiple triggers of the authentication pop-up and solving the problem of being unable to authenticate again after the first pop-up is ignored.

[0061] In step S202, if the user equipment initiates an HTTP protocol request, the process proceeds to step S201; if it initiates a non-HTTP protocol request, the process proceeds to step S203.

[0062] In a preferred embodiment, step S2 also includes S204: If, after the third or more second-second lease cycles following step S203, the user equipment has still not been authenticated, the system assigns a new IP address to trigger the operating system to re-initiate network probing.

[0063] In a preferred embodiment, after the user equipment first connects to the network access point in step S1, a network score protection phase is also included: when the user equipment has just connected and has not performed any actual network operations, the system probe request returns a normal response, which enables the system to determine that the network is available, maintains a normal network score, and avoids triggering the user equipment to automatically switch to a mobile data network or other Wi-Fi networks.

[0064] The purpose of activating the delayed authentication flag is twofold: first, to trigger authentication when the user is about to perform a network operation; and second, to maintain a normal network score and prevent being switched when the user has not yet performed any operation. Specifically, when a user's device has just connected to Wi-Fi and has not yet initiated any actual network request, the system returns a normal response (such as HTTP 204 or Success) to the network probe request, making the operating system believe the network is available and maintaining a normal network score. At this time, even if other saved Wi-Fi networks exist nearby, the system will not automatically switch due to the network score. When the user initiates an actual network request (such as an HTTPS request caused by opening an app), the system detects the unauthenticated state, updates the delayed authentication flag to an active state, and subsequent system probe requests will return an abnormal response, triggering an authentication pop-up.

[0065] To explain further, step S1 specifically involves:

[0066] S1.1: The DHCP server receives DHCP requests from devices, obtains the device's MAC address, and identifies the device type through DHCP fingerprinting;

[0067] S1.2: Query the authentication status table to determine whether the MAC address has been authenticated;

[0068] S1.3: Assign IP addresses and lease times based on authentication status: Authenticated devices are assigned hourly leases (long leases), and unauthenticated devices are assigned short leases;

[0069] S1.4: Include RFC 8910 Option 114 in the DHCP response to inform the Captive Portal API address;

[0070] S1.5: Initialize or update device records in the authentication status table, including authentication status, device type, operating system type, and connection time.

[0071] In the S2 system network detection process, after a user device connects, the operating system automatically initiates a network probe:

[0072] S2.1: Intercept system network probe HTTP requests;

[0073] S2.2: Identify the probe type (iOS / Android / Windows / macOS) based on the requested URL path and Host header.

[0074] S2.3: Query the user equipment authentication status and delayed authentication flag;

[0075] S2.4: Generate a response conforming to the expected format of the operating system based on the status and device type, including: Authenticated: return a normal response, the system determines that the network is available, corresponding to step S201; Unauthenticated and without delayed authentication flag: return a normal response to protect the network score, or return an abnormal response to trigger a pop-up window, corresponding to step S202; Unauthenticated and with delayed authentication flag: return an abnormal response to trigger a Captive Portal pop-up window, corresponding to step S203.

[0076] Furthermore, in step S2, the system accurately identifies and adapts its responses to network probe requests from different operating systems. Specifically: For iOS and macOS systems, the target URL for the probe request is either hotspot-detect.html or success.html under captive.apple.com. The system checks the device authentication status. If authenticated, it returns an HTML page with the title "Success"; if unauthenticated and a pop-up needs to be triggered, it returns HTML content without "Success" or directly returns the authentication page HTML. For Android systems, the target URL for the probe request is generate_204 under connectivitycheck.gstatic.com. The system checks the device authentication status. If authenticated, it returns an HTTP 204 No Content status code; if unauthenticated and a pop-up needs to be triggered, it returns an HTTP 302 redirect response or a non-204 status code. For Windows systems, the target URL for the probe request is connecttest.txt under msftconnecttest.com. The system checks the device authentication status. If authenticated, it returns an HTTP 200 response containing the specified text content; if unauthenticated and a pop-up needs to be triggered, it returns an HTTP 302 redirect response. It is particularly important to note that 403, 404, and 500 error codes must not be returned; otherwise, Windows will interpret them as network failures rather than Captive Portal. All responses should include a header indicating that caching is disabled to ensure that the latest status is obtained with each probe.

[0077] Please refer to Figure 3 The complete authentication process for mandatory authentication of mobile network devices based on multi-protocol awareness disclosed in this technical solution is as follows:

[0078] When a user device connects to a MiFi device's Wi-Fi, the DHCP server assigns an IP address and a short lease, initializing the device's record in the authentication status table. The operating system automatically initiates a network probe, determining the response based on the current authentication status and request protocol type, employing a network scoring protection strategy. If a normal response is returned, the system determines the network is available. If the user opens an app and the app initiates an HTTPS request, the system detects an unauthenticated device initiating a non-HTTP request, updates the delayed authentication flag, blocks the request, and the app displays a network error. The user may continue to attempt more HTTPS or UDP requests, which are then blocked and recorded. The operating system retryes the network probe due to abnormal network usage. If the system detects that the delayed authentication flag is activated and triggers a second-second lease or a new IP address based on the DHCP lease expiration, a new network probe is initiated. This probe returns an abnormal response. When the user attempts to access an HTTP website, a Captive event is triggered. A portal pop-up appears; the pop-up browser accesses the authentication page, which displays statistics on blocked requests; the user enters their mobile phone number and then the verification code obtained from their mobile phone to complete the authentication; after successful system verification, the authentication status is updated, the delayed authentication flag is cleared, and the DHCP lease is upgraded; the system performs another network probe, returns a normal response, confirms network availability, and the pop-up browser closes; the user can now access the internet normally, and previously failed apps automatically retry successfully.

[0079] The parts not described in detail in this technical solution specification are obvious to those skilled in the art and can be supplemented and improved based on existing technical knowledge. At the same time, those skilled in the art should understand that the above embodiments are merely preferred embodiments of the present invention. For those skilled in the art, several improvements and modifications can be made without departing from the principles of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A mobile network device mandatory authentication system based on multi-protocol awareness, characterized in that, include: The connection tracking and status management module is used to monitor the network connection between user equipment and mobile network equipment, obtain the MAC address and IP address of user equipment, identify the type and operating system type of user equipment, and maintain an authentication status table, which records at least the authentication status and delayed authentication flag of user equipment. The multi-protocol awareness and delay authentication module is used to identify requests of various protocol types. When an unauthenticated user device initiates a non-HTTP protocol request, the delay authentication flag of the user device is set to active, the blocked request information is recorded, and the request is blocked. The dynamic DHCP lease management module is used to allocate different lease times based on the different authentication status of user equipment and whether there is a delayed authentication flag. When a short lease expires, the system is triggered to re-probe the network. The multi-operating system network detection adaptation module is used to identify and adapt to the mandatory authentication network detection requests of various operating systems, and trigger the corresponding network detection authentication pop-up window according to the authentication status of the user device. The authentication portal service module is used to provide an authentication page and update the authentication status of the user device to authenticated after successful authentication, and clear the delayed authentication flag; The dynamic DHCP lease management module allocates hourly lease time to authenticated user equipment, first-second lease time to newly connected but unauthenticated user equipment, and second-second lease time to unauthenticated user equipment with delayed authentication flags. The second-second lease time is shorter than the first-second lease time. If the second-second lease time of the unauthenticated user equipment with a delayed authentication mark expires, a new DHCP request will be initiated. If the user equipment is still found to be unauthenticated, the dynamic DHCP lease management module will allocate a new IP address. The change of IP address will trigger the operating system to re-probe the network.

2. The mobile network device mandatory authentication system based on multi-protocol awareness according to claim 1, characterized in that, The multi-protocol awareness and delay authentication module includes: Protocol identification unit, used to identify HTTP, HTTPS, QUIC, and UDP protocols; The delayed authentication tag unit is used to set a delayed authentication tag when a non-HTTP protocol request is detected; The request blocking unit is used to return a connection reset for TCP requests and to silently discard UDP requests.

3. The mobile network device mandatory authentication system based on multi-protocol awareness according to claim 1, characterized in that, It also includes an intelligent network scoring protection module, which, in the initial stage after a user device connects to the network, if it is determined that the user device has not yet had any actual network activity, returns a response indicating that the network is normal to the network probe request of the operating system, so as to maintain the network score. After determining that the user equipment has actual network activity, the response content to the network probe request is determined based on the user equipment's authentication status and delayed authentication flag, so as to prevent the user equipment from automatically switching to other networks.

4. A method for mandatory authentication of mobile network devices based on multi-protocol awareness, characterized in that, Includes the following steps: S1: The user equipment connects to the network access point, obtains the user equipment MAC address, identifies the user equipment type and operating system type, the system assigns it an IP address and initial lease, creates a record in the authentication status table, and initializes the delayed authentication flag as inactive; S2: System network detection processing, including: S201: The system automatically initiates network detection. When an unauthenticated user device initiates an HTTP protocol request, it triggers the authentication page. After authentication, it records the authenticated status of the user device, assigns an hourly lease, returns a normal response, and the system determines that the network is available. S202: The system automatically initiates network detection. When an unauthenticated user device is detected to be accessing the network and has not initiated a non-HTTP protocol request, a first-second lease is allocated. S203: The system automatically initiates network probing. When an unauthenticated user device initiates a non-HTTP protocol request, the request is blocked, a second-second lease is allocated, and a delayed authentication flag is activated in its authentication status record. The duration of the second-second lease is shorter than that of the first-second lease. S204: In step S203, if the user equipment still fails to authenticate after the third or more second-second lease cycles, the system will assign a new IP address to trigger the operating system to re-initiate network probing. S3: When the first-second lease expires, the system re-triggers the authentication page. If the unauthenticated user device ignores or closes the page, when it initiates its first non-HTTP protocol request, the system will determine whether the user device performs authentication. If no authentication is performed, the first-second lease will be changed to a second-second lease, and the delayed authentication flag will be activated. S4: When an HTTP request is detected from a user device with a delayed authentication flag, a redirect response is returned to the user device to trigger the authentication page; S5: After the user completes authentication through the authentication page, the delayed authentication flag is cleared and the device's DHCP lease is updated to an hourly lease.

5. The method for mandatory authentication of mobile network devices based on multi-protocol awareness according to claim 4, characterized in that, In step S2, the hourly rental period is 1-2 hours, the first second rental period is 30-60 seconds, and the second second rental period is 15-30 seconds.

6. The method for mandatory authentication of mobile network devices based on multi-protocol awareness according to claim 4, characterized in that, In step S202, if the user equipment initiates an HTTP protocol request, the process proceeds to step S201; if it initiates a non-HTTP protocol request, the process proceeds to step S203.

7. The method for mandatory authentication of mobile network devices based on multi-protocol awareness according to claim 4, characterized in that, In step S1, after the user equipment first connects to the network access point, there is also a network score protection phase: when the user equipment has just connected and has not performed any actual network operations, the system probe request returns a normal response, which makes the system determine that the network is available, maintains a normal network score, and avoids triggering the user equipment to automatically switch to the mobile data network or other Wi-Fi networks.

Images