Cross-scenario wi-fi non-perception authentication method, device, system and gateway equipment

Abstract

The application provides a cross-scene WiFi non-perception authentication method, device, system and gateway equipment, and belongs to the network communication field.The method comprises the following steps: after receiving an HTTP / HTTPS request initiated by a terminal when the terminal accesses a WiFi network, hijacking corresponding HTTP / HTTPS traffic and returning a redirection response to the terminal to arouse the terminal to load a detection response template page; acquiring a UUID uploaded by the terminal; the UUID is obtained after multi-dimensional stable features collected by the terminal based on the detection response template page are spliced; after MAC verification of the terminal fails, the UUID is verified, and after the UUID verification passes, an online state identifier is returned to the terminal to configure WiFi network access permission for the terminal.The application can solve the problem that non-perception authentication cannot identify the same terminal in a random MAC scene and requires repeated authentication.

Description

Technical Field

[0001] This invention relates to the field of network communication technology, specifically to a cross-scenario WiFi seamless authentication method, apparatus, system, and gateway device. Background Technology

[0002] With the large-scale deployment of WiFi networks in scenarios such as enterprise parks, commercial chains, and public services, Portal authentication has become the mainstream solution for wireless network access control due to its lightweight, easy deployment, and lack of pre-installed client features. To reduce the operational costs of repeated user authentication, MAC (Media Access Control Address) seamless authentication is widely used: the gateway records the MAC address of authenticated terminals, and when a terminal accesses the same WiFi network again, it directly completes identity verification and allows access by matching the MAC address, without requiring the user to repeatedly enter their account and password.

[0003] However, in recent years, mainstream operating systems such as iOS, Android, and Windows have all enabled a private Wi-Fi address (random MAC) privacy mechanism by default. Every time a terminal connects to a different Wi-Fi network or periodically reconnects to the same Wi-Fi network, a completely new random MAC address is generated. This mechanism directly renders the traditional MAC-based authentication system ineffective: the same physical terminal will be identified as a completely new device by the gateway due to the change of its MAC address, requiring a new Portal authentication process every time it connects. This severely impacts the user experience and increases the redundancy overhead of the authentication system, becoming a core industry pain point in the Wi-Fi authentication field.

[0004] Therefore, existing solutions suffer from the problem of identity recognition failure in random MAC scenarios, namely the pain point that traditional MAC-based seamless authentication cannot identify the same terminal and repeatedly requires authentication. Summary of the Invention

[0005] In view of this, it is necessary to provide a cross-scenario WiFi seamless authentication method, device, system and gateway device to solve the technical problem that seamless authentication cannot identify the same terminal in random MAC scenarios and requires repeated authentication requests.

[0006] To address the aforementioned problems, in a first aspect, the present invention provides a cross-scenario WiFi seamless authentication method, comprising: Upon receiving an HTTP / HTTPS request initiated by a terminal when accessing a WiFi network, the corresponding HTTP / HTTPS traffic is intercepted, and a redirection response is returned to the terminal to invoke the terminal to load the detection response template page; Obtain the UUID uploaded by the terminal; the UUID is obtained by the terminal after concatenating multi-dimensional stable features collected from the detection response template page; If the MAC verification of the terminal fails, the UUID is verified. If the UUID verification passes, an online status indicator is returned to the terminal to configure WiFi network access permissions for the terminal.

[0007] In one possible implementation, the cross-scenario WiFi seamless authentication method also includes: After the UUID verification fails, an offline status indicator is returned to the terminal to control the terminal to jump to the authentication page; the authentication page is used to receive user identity information and send the user identity information to the gateway for authentication.

[0008] In one possible implementation, the cross-scenario WiFi seamless authentication method also includes: After the UUID verification fails, the mapping relationship between the terminal access session and the UUID is stored in a record object, and the corresponding UUID is obtained based on the mapping relationship the next time the UUID is used; the lifecycle of the record object is bound to the terminal's WiFi network access session, and it is cleared after the terminal disconnects from the WiFi network.

[0009] In one possible implementation, the cross-scenario WiFi seamless authentication method also includes: Obtain the user identity information and gateway verification account uploaded by the authentication page of the terminal, and generate a MAC-insensitive temporary record and a UUID persistent authorization record after the user identity information and the gateway verification account are successfully authenticated; The MAC-insensitive temporary record includes the MAC address of the terminal and the bound user identity information. The MAC-insensitive temporary record is deleted after a target duration. The MAC-insensitive temporary record is used to match the MAC address of the terminal for MAC verification. The persistent UUID authorization record includes the UUID and the bound user identity information, and the persistent UUID authorization record is stored in the persistent UUID authorization library; the persistent UUID authorization library is used to match with the UUID to verify the UUID.

[0010] In one possible implementation, the UUID persistence authorization library is deployed to a cloud server or gateway cluster.

[0011] In one possible implementation, the multi-dimensional stable features include: WebGL rendering features, Canvas drawing features, audio oscillator features, system font list, Navigator object properties, screen parameters, system time zone, and Math object calculation precision; The UUID is a feature string obtained by the terminal by concatenating multi-dimensional stable features collected from the detection response template page, and then encrypting the feature string using a hash algorithm.

[0012] In one possible implementation, a redirect response is returned to the terminal to invoke the terminal to load the detection response template page, including: The Portal redirection rule is executed, and a redirection response containing the detection response template page and the Portal authentication page is returned to the terminal to invoke the terminal to load the detection response template page.

[0013] Secondly, the present invention also provides a cross-scenario WiFi seamless authentication device, comprising: The redirection module is used to intercept the corresponding HTTP / HTTPS traffic after receiving an HTTP / HTTPS request initiated by the terminal when accessing the WiFi network, and return a redirection response to the terminal to trigger the terminal to load the detection response template page; The UUID acquisition module is used to acquire the UUID uploaded by the terminal; the UUID is obtained by the terminal by concatenating multi-dimensional stable features collected from the detection response template page. The verification module is used to verify the UUID after the MAC verification of the terminal fails, and to return an online status identifier to the terminal after the UUID verification passes, so as to configure WiFi network access permissions for the terminal.

[0014] Thirdly, the present invention also provides a gateway device, including a memory and a processor, wherein, The memory is used to store programs; The processor, coupled to the memory, is used to execute the program stored in the memory to implement the steps of the cross-scenario WiFi seamless authentication method as described in any of the above.

[0015] Fourthly, the present invention also provides a cross-scenario WiFi seamless authentication system, including the aforementioned gateway device and a terminal that is communicatively connected to the gateway device.

[0016] The beneficial effects of the above implementation are as follows: The cross-scenario WiFi seamless authentication method, device, system, and gateway device provided by the present invention, upon receiving an HTTP / HTTPS request initiated by a terminal when accessing a WiFi network, intercepts the corresponding HTTP / HTTPS traffic and returns a redirection response to the terminal to invoke the terminal to load the detection response template page; obtains the UUID uploaded by the terminal; the UUID is obtained by the terminal after concatenating multi-dimensional stable features collected by the detection response template page; after the MAC verification of the terminal fails, the UUID is verified, and after the UUID verification passes, an online status identifier is returned to the terminal to configure WiFi network access permissions for the terminal.

[0017] This invention upgrades the UUID from an "auxiliary identification factor" to an independent, permanent authorization carrier, completely eliminating the limitations of MAC addresses. Regardless of how the terminal changes its random MAC address, as long as the browser environment is stable, the terminal's identity can be accurately identified via the UUID, completely resolving the pain point of traditional seamless authentication failure caused by random MAC addresses. This invention employs a two-level verification logic with fixed priority. MAC-insensitive authentication serves as the priority path for compatibility with existing systems, while UUID serves as the fallback verification path in random MAC scenarios. The two work together to complete authentication, thus solving the technical problem of seamless authentication failing to identify the same terminal in random MAC scenarios, requiring repeated authentication requests. Attached Figure Description

[0018] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0019] Figure 1 A flowchart of an embodiment of the cross-scenario WiFi seamless authentication method provided by the present invention; Figure 2 A schematic block diagram of an embodiment of the cross-scenario WiFi seamless authentication device provided by the present invention; Figure 3 A schematic diagram of an embodiment of the electronic device provided by the present invention. Detailed Implementation

[0020] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present invention, and not all of them. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative effort are within the scope of protection of the present invention.

[0021] In the description of the embodiments of this application, unless otherwise stated, "a plurality of" means two or more.

[0022] In this embodiment of the invention, the terms "comprising" and "having" and any variations thereof are intended to cover non-exclusive inclusion, for example, a process, method, apparatus, product or device that includes a series of steps or modules is not necessarily limited to those steps or modules that are explicitly listed, but may include other steps or modules that are not explicitly listed or that are inherent to such process, method, product or device.

[0023] The naming or numbering of steps in the embodiments of the present invention does not mean that the steps in the method flow must be executed in the time / logical order indicated by the naming or numbering. The execution order of the named or numbered process steps can be changed according to the technical purpose to be achieved, as long as the same or similar technical effect can be achieved.

[0024] In this document, the term "embodiment" means that a particular feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of the invention. The appearance of this phrase in various places throughout the specification does not necessarily refer to the same embodiment, nor is it a mutually exclusive, independent, or alternative embodiment. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described herein can be combined with other embodiments.

[0025] This invention provides a cross-scenario WiFi seamless authentication method, apparatus, system, and gateway device, which are described below.

[0026] This invention provides a cross-scenario WiFi seamless authentication method, which can be implemented by executing an application in a gateway device; such as Figure 1 As shown, the method includes: S101. Upon receiving an HTTP / HTTPS request initiated by the terminal when accessing the WiFi network, the corresponding HTTP / HTTPS traffic is intercepted, and a redirection response is returned to the terminal to invoke the terminal to load the detection response template page.

[0027] It is understandable that HTTP stands for Hypertext Transfer Protocol, and HTTPS stands for Hypertext Transfer Security Protocol.

[0028] After the terminal connects to the authenticated WiFi and obtains an IP address, when it initiates any HTTP request (including a system-mandated portal connectivity detection request), the gateway intercepts the HTTP traffic, returns a 302 redirect response, and invokes the terminal's built-in browser (including the system-mandated portal browser) to load the detection response template page.

[0029] S102. Obtain the UUID uploaded by the terminal; the UUID is obtained by the terminal after splicing together the multi-dimensional stable features collected from the detection response template page.

[0030] Understandably, UUIDs are universally unique identifiers. After the detection page loads, built-in JavaScript logic collects multi-dimensional, stable features that are universally supported by the portal browser.

[0031] S103. After the MAC verification of the terminal fails, the UUID is verified, and after the UUID verification is successful, an online status identifier is returned to the terminal to configure WiFi network access permissions for the terminal.

[0032] Understandably, the terminal browser sends the generated UUID to the gateway's / api / check-user-status authentication verification interface via an Ajax POST request to query the current terminal's online authentication status.

[0033] It should be noted that the terminal's MAC address may change across different scenarios. If the MAC address changes and MAC verification fails, verification can be performed based on the UUID. After successful UUID verification, an online status indicator is returned to the terminal to configure WiFi network access permissions. Even if the MAC address changes dynamically, seamless authentication for the same terminal can be ensured, avoiding duplicate authentication caused by dynamic MAC address changes.

[0034] In some embodiments, the cross-scenario WiFi seamless authentication method further includes: After the UUID verification fails, an offline status indicator is returned to the terminal to control the terminal to jump to the authentication page; the authentication page is used to receive user identity information and send the user identity information to the gateway for authentication.

[0035] Understandably, the terminal redirects to the Portal authentication page via location.replace, guiding the user to complete identity authentication.

[0036] In some embodiments, the cross-scenario WiFi seamless authentication method further includes: After the UUID verification fails, the mapping relationship between the terminal access session and the UUID is stored in a record object, and the corresponding UUID is obtained based on the mapping relationship the next time the UUID is used; the lifecycle of the record object is bound to the terminal's WiFi network access session, and it is cleared after the terminal disconnects from the WiFi network.

[0037] Understandably, the `recog` object is a structured object that encapsulates the sensing and recognition task. The gateway stores a one-to-one mapping between the current terminal access session and the UUID within the temporary online user identification `recog` object, and returns an offline status indicator. The lifecycle of the `recog` object is bound to the terminal's WiFi access session; it is automatically cleared when the terminal disconnects from WiFi.

[0038] In some embodiments, the cross-scenario WiFi seamless authentication method further includes: Obtain the user identity information and gateway verification account uploaded by the authentication page of the terminal, and generate a MAC-insensitive temporary record and a UUID persistent authorization record after the user identity information and the gateway verification account are successfully authenticated; The MAC-insensitive temporary record includes the MAC address of the terminal and the bound user identity information. The MAC-insensitive temporary record is deleted after a target duration. The MAC-insensitive temporary record is used to match the MAC address of the terminal for MAC verification. The persistent UUID authorization record includes the UUID and the bound user identity information, and the persistent UUID authorization record is stored in the persistent UUID authorization library; the persistent UUID authorization library is used to match with the UUID to verify the UUID.

[0039] Understandably, after a user submits authentication information on the Portal page, the gateway verifies the account's legitimacy, and authentication is successful, two types of seamless authentication records are generated simultaneously: MAC-invisible temporary records: bind the current terminal's MAC address to the authenticated account, set a configurable fixed aging period (such as 7 days / 30 days), and automatically clear the records upon expiration, adapting to the management needs of visitors and temporary access devices.

[0040] UUID persistent authorization record: Extract the terminal UUID from the record object corresponding to the current session, permanently bind the UUID to the Internet access permission of the authenticated account, and store it in the global UUID persistent authorization library; this record has no default aging period and is not affected by changes in terminal MAC address, access WiFi SSID, or access gateway device, serving as a permanent identity authorization credential for the terminal.

[0041] In some embodiments, the UUID persistence authorization library is deployed to a cloud server or gateway cluster.

[0042] Understandably, the global UUID persistent authorization library supports two deployment modes: centralized deployment on the AAA authentication server / cloud management platform, with all gateways calling and querying in real time; and distributed deployment through a gateway cluster synchronization mechanism to achieve real-time consistency of the authorization library across all nodes, adapting to network deployment scenarios of different scales.

[0043] In some embodiments, the multi-dimensional stable features include: WebGL rendering features, Canvas drawing features, audio oscillator features, system font list, Navigator object properties, screen parameters, system time zone, and Math object calculation precision; The UUID is a feature string obtained by the terminal by concatenating multi-dimensional stable features collected from the detection response template page, and then encrypting the feature string using a hash algorithm.

[0044] Understandably, the use of multi-dimensional stable features that are universally supported by the forced portal browser, combined with the x64hash128 lightweight hash algorithm, is adapted to the low-performance system forced portal operating environment.

[0045] In some embodiments, a redirect response is returned to the terminal to invoke the terminal to load the detection response template page, including: The Portal redirection rule is executed, and a redirection response containing the detection response template page and the Portal authentication page is returned to the terminal to invoke the terminal to load the detection response template page.

[0046] Understandably, Portal redirection enables the automatic pop-up of an authentication page to control access when a terminal accesses an HTTP or HTTPS website if authentication has not yet succeeded.

[0047] like Figure 2 As shown, the present invention also provides a cross-scenario WiFi seamless authentication device 200, comprising: The redirection module 201 is used to intercept the corresponding HTTP / HTTPS traffic after receiving an HTTP / HTTPS request initiated by the terminal when accessing the WiFi network, and return a redirection response to the terminal to induce the terminal to load the detection response template page. UUID acquisition module 202 is used to acquire the UUID uploaded by the terminal; the UUID is obtained by the terminal after concatenating multi-dimensional stable features collected from the detection response template page; The verification module 203 is used to verify the UUID after the MAC verification of the terminal fails, and to return an online status identifier to the terminal after the UUID verification passes, so as to configure WiFi network access permissions for the terminal.

[0048] The present invention also provides a gateway device, including a memory and a processor, wherein, The memory is used to store programs; The processor, coupled to the memory, is used to execute the program stored in the memory to implement the steps of the cross-scenario WiFi seamless authentication method as described in any of the above.

[0049] The present invention also provides a cross-scenario WiFi seamless authentication system, including the aforementioned gateway device and a terminal that is communicatively connected to the gateway device.

[0050] In some embodiments, this invention constructs a dual-track authentication system of temporary MAC authorization + permanent UUID authorization. Through the complete logic of two-level collaborative verification, global persistent authorization, and cross-scenario identity reuse, it achieves seamless WiFi authentication across all scenarios under random MAC scenarios. The specific scheme is as follows: I. Overall Core Architecture: This invention is applied to gateway authentication devices, and its core architecture consists of three layers: Verification layer: Two-level collaborative verification logic with fixed priority, prioritizing MAC-based seamless query, and triggering UUID persistent authorization fallback verification if the query fails; Storage layer: Dual-track storage system, consisting of a temporary MAC record library with an aging cycle and a global UUID persistent authorization library shared by multiple gateways; Session layer: By temporarily identifying the record object of online users, the unauthenticated terminal UUID is automatically bound to the Portal authentication session without the need for secondary data collection.

[0051] II. Single-Scenario Basic Authentication Process: Step 1: Terminal access and HTTP (or HTTP, the same below) redirection.

[0052] After the terminal connects to the authenticated WiFi and obtains an IP address, when it initiates any HTTP request (including a system-mandated portal connectivity detection request), the gateway intercepts the HTTP traffic, returns a 302 redirect response, and invokes the terminal's built-in browser (including the system-mandated portal browser) to load the detection response template page.

[0053] Step 2: Lightweight browser fingerprint collection and UUID generation.

[0054] After the detection page loads, the built-in JavaScript logic collects multi-dimensional stable features that are universally supported by the portal browser, including but not limited to: WebGL rendering features, Canvas drawing features, audio oscillator features, system font list, Navigator object properties, screen parameters, system time zone, and Math object calculation precision.

[0055] After concatenating all feature values ​​into a feature string, a device UUID uniquely bound to the terminal browser environment is generated using the x64hash128 lightweight hash algorithm.

[0056] Step 3: Asynchronous query of authentication status.

[0057] The terminal browser sends the generated UUID to the gateway's / api / check-user-status authentication verification interface via an AjaxPOST request to query the current terminal's online authentication status.

[0058] Step 4: Two-level collaborative seamless verification.

[0059] After receiving the request, the gateway performs two levels of authentication verification according to a fixed priority: Prioritize MAC address lookup without user awareness: Use the terminal's current source MAC address as an index to match the local temporary MAC record database. If a valid record exists and the account permissions are normal, allow the terminal to go online directly and return the online status indicator "1".

[0060] MAC failure triggers UUID fallback verification: If no matching record is found in the MAC query (e.g., the terminal is using random MAC addresses or is connecting to this gateway for the first time), the reported UUID is used as an index to match the global persistent UUID authorization library. If a valid binding record exists and the account permissions are normal, UUID seamless authentication is completed and the terminal is allowed to proceed, returning an online status flag "1".

[0061] Double verification failure caching: When no valid record is found in both levels of query, the gateway stores the one-to-one mapping relationship between the current terminal access session and the UUID in the online user temporary identification record object and returns the offline status identifier "0".

[0062] The lifecycle of the recog object is bound to the terminal's WiFi access session, and it is automatically cleared when the terminal disconnects from WiFi.

[0063] Step 5: Authentication branch processing.

[0064] After receiving the returned result, the terminal performs the corresponding operation: Return status "1": The terminal directly obtains network access without any additional operation, completing the seamless access process; Returning status "0": The terminal redirects to the Portal authentication page via location.replace, guiding the user to complete identity authentication.

[0065] Step Six: Dual-track seamless recording is generated synchronously.

[0066] After the user submits authentication information on the Portal page, the gateway verifies the account's validity and the authentication is successful, two types of seamless authentication records are generated simultaneously: MAC-invisible temporary records: bind the current terminal's MAC address to the authenticated account, set a configurable fixed aging period (such as 7 days / 30 days), and automatically clear the records upon expiration, adapting to the management needs of visitors and temporary access devices.

[0067] UUID persistent authorization record: Extract the terminal UUID from the record object corresponding to the current session, permanently bind the UUID to the Internet access permission of the authenticated account, and store it in the global UUID persistent authorization library; this record has no default aging period and is not affected by changes in terminal MAC address, access WiFi SSID, or access gateway device, serving as the terminal's permanent identity authorization credential.

[0068] III. Seamless Reuse Process Across WiFi Scenarios: When a terminal reconnects to WiFi across SSIDs, gateways, and campuses within the same authentication system, the following identity reuse process is executed: After the terminal connects to the target WiFi, repeat steps one, two, and three above to complete fingerprint collection and UUID reporting; When the target gateway performs two-level verification, if the MAC query fails due to random MAC changes of the terminal or the first access to the target gateway, the UUID reported by the terminal is used as the index to match the global persistent UUID authorization library. If a valid authorization record is matched, the terminal is allowed to pass directly without having to be redirected to the Portal page for repeated authentication, thus enabling seamless passage across different scenarios.

[0069] The global UUID persistent authorization library supports two deployment modes: centralized deployment on the AAA authentication server / cloud management platform, with all gateways calling and querying in real time; and distributed deployment through a gateway cluster synchronization mechanism to achieve real-time consistency of the authorization library across all nodes, adapting to network deployment scenarios of different scales.

[0070] IV. Corresponding Gateway Device Architecture: The WiFi gateway device that implements the above method contains six core modules: Traffic hijacking and redirection module: used to hijack HTTP requests from access terminals, execute Portal redirection rules, and push detection response template pages and Portal authentication pages; Two-level authentication verification module: used to receive the UUID reported by the terminal, perform MAC seamless query and UUID persistent authorization query according to priority, and return the corresponding authentication status; Temporary session cache module: Used to maintain online user record objects, manage the mapping relationship between terminal access sessions and UUIDs, and control the cache lifecycle; Dual-track seamless storage module: It is divided into a MAC temporary record unit and a UUID persistent authorization unit, which respectively store two types of seamless records and support query, addition, deletion and aging management; Global synchronization module: Used to synchronize the persistent UUID authorization library with other gateways / authentication platforms under the same authentication system to ensure consistency of authentication across scenarios; Portal authentication processing module: Used to process Portal authentication requests submitted by users, complete account verification, and trigger the synchronous generation of dual-track seamless records after successful authentication.

[0071] The present invention has the following beneficial effects: 1. Address the root cause of the imperceptible failure problem in random MAC scenarios.

[0072] This invention upgrades the browser fingerprint UUID from an "auxiliary identification factor" to an independent, permanent authorization carrier, completely eliminating the limitations of MAC addresses. Regardless of how the terminal changes its random MAC address, as long as the browser environment is stable, the terminal's identity can be accurately identified through the UUID, completely solving the pain point of traditional seamless authentication failure caused by random MAC addresses.

[0073] 2. Break through the limitations of different scenarios and achieve seamless identity reuse across all scenarios.

[0074] This invention achieves universal identity across SSIDs, gateways, and campuses through a globally shared persistent UUID authorization library. Users only need to complete authentication once to seamlessly access all WiFi networks within the same system, perfectly adapting to the deployment needs of multi-campus enterprises, chain stores, and other diverse scenarios.

[0075] 3. The dual-track management system balances flexibility and control requirements.

[0076] A dual-track management mechanism of "MAC temporary authorization + UUID permanent authorization" is adopted: MAC records have an aging period to adapt to the flexible management needs of visitors and temporary devices; UUID records are permanently valid to adapt to the convenient access needs of employees and fixed terminals. The two types of records share an account permission system, which is compatible with the existing MAC-insensitive management logic, and adds a permanent identity control dimension to adapt to complex enterprise-level management scenarios.

[0077] 4. Compatible with existing systems, with extremely low deployment costs.

[0078] This solution fully retains the original MAC-agnostic priority verification logic, and has no impact on terminals that have not enabled random MAC or existing authentication systems. UUID authentication serves as an incremental fallback mechanism, requiring no hardware replacement or AAA server modification. It can be implemented simply through gateway firmware upgrades, making its deployment cost far lower than hardware fingerprinting or client-side solutions.

[0079] 5. Zero client dependency, highly adaptable to all terminals.

[0080] All fingerprint collection and UUID generation are performed in the terminal's built-in browser using standard JavaScript, without requiring users to install any apps or plugins. At the same time, lightweight algorithms and feature selection optimizations have been made for forced portal browsers, making it compatible with all smart terminals and highly universal.

[0081] The key technical points of this invention include: 1. Two-level collaborative seamless authentication architecture with MAC priority and UUID as a fallback: two-level verification logic with fixed priority. MAC is the priority path to be compatible with the existing system, and UUID is the fallback verification path in random MAC scenarios. The two work together to complete the authentication.

[0082] 2. Persistent authorization mechanism that permanently binds UUID to Internet access permissions: Upgrades UUID from a temporary auxiliary identification factor to an independent permanent authorization carrier, permanently binding it to the Internet access permissions of the authenticated account, unaffected by MAC address changes, and can take effect independently of the MAC system.

[0083] 3. Global UUID authorization reuse mechanism across WiFi scenarios: A global UUID persistent authorization library shared by multiple gateways supports seamless authentication reuse when terminals access across SSIDs, gateways, and campuses, breaking through the limitations of single gateway scenarios.

[0084] 4. Recog temporary session caching and binding mechanism: When dual verification fails, the mapping relationship between the terminal UUID and the session is cached through the recog object. After the Portal authentication is successful, the UUID is directly extracted to complete the binding, without the need for secondary collection and reporting by the terminal.

[0085] 5. Dual-track authorization management mechanism: MAC temporary records (with aging period) and UUID permanent records (without default aging) run in parallel, respectively adapting to temporary access and fixed terminal scenarios, and sharing account permissions and management system.

[0086] 6. Lightweight UUID generation scheme adapted for forced portals: Select multi-dimensional stable features commonly supported by forced portal browsers, combined with the x64hash128 lightweight hash algorithm, to adapt to the low-performance system forced portal running environment.

[0087] 7. Zero-client pure browser triggering process: Fingerprint collection is triggered by HTTP hijacking and redirection through the gateway. No client needs to be installed on the terminal. The entire authentication process is completed solely by the system's built-in browser.

[0088] The cross-scenario WiFi seamless authentication device provided in the above embodiments can realize the technical solutions described in the above cross-scenario WiFi seamless authentication method embodiments. The specific implementation principles of each module or unit can be found in the corresponding content in the above cross-scenario WiFi seamless authentication method embodiments, which will not be repeated here.

[0089] like Figure 3 As shown, the present invention also provides an electronic device 300. The electronic device 300 includes a processor 301, a memory 302, and a display 303. Figure 3 Only some components of the electronic device 300 are shown, but it should be understood that it is not required to implement all of the components shown, and more or fewer components may be implemented instead.

[0090] In some embodiments, memory 302 may be an internal storage unit of electronic device 300, such as a hard disk or memory of electronic device 300. In other embodiments, memory 302 may also be an external storage device of electronic device 300, such as a plug-in hard disk, smart media card (SMC), secure digital (SD) card, flash card, etc. equipped on electronic device 300.

[0091] Furthermore, the memory 302 may include both internal storage units of the electronic device 300 and external storage devices. The memory 302 is used to store application software and various types of data installed on the electronic device 300.

[0092] In some embodiments, processor 301 may be a central processing unit (CPU), microprocessor, or other data processing chip, used to run program code stored in memory 302 or process data, such as the cross-scenario WiFi seamless authentication method of the present invention.

[0093] In some embodiments, display 303 may be an LED display, a liquid crystal display, a touch-sensitive liquid crystal display, or an OLED (Organic Light-Emitting Diode) touchscreen. Display 303 is used to display information from electronic device 300 and to display a visual user interface. Components 301-303 of electronic device 300 communicate with each other via a system bus.

[0094] In some embodiments of the present invention, when the processor 301 executes the cross-scenario WiFi seamless authentication program in the memory 302, the following steps can be implemented: Upon receiving an HTTP / HTTPS request initiated by a terminal when accessing a WiFi network, the corresponding HTTP / HTTPS traffic is intercepted, and a redirection response is returned to the terminal to invoke the terminal to load the detection response template page; Obtain the UUID uploaded by the terminal; the UUID is obtained by the terminal after concatenating multi-dimensional stable features collected from the detection response template page; If the MAC verification of the terminal fails, the UUID is verified. If the UUID verification passes, an online status indicator is returned to the terminal to configure WiFi network access permissions for the terminal.

[0095] It should be understood that when the processor 301 executes the cross-scenario WiFi seamless authentication program in the memory 302, in addition to the functions mentioned above, it can also perform other functions, as detailed in the description of the corresponding method embodiments above.

[0096] Furthermore, the embodiments of the present invention do not specifically limit the type of electronic device 300 mentioned. Electronic device 300 can be a mobile phone, tablet computer, personal digital assistant (PDA), wearable device, laptop computer, or other portable electronic device. Exemplary embodiments of portable electronic devices include, but are not limited to, portable electronic devices running iOS, Android, Microsoft, or other operating systems. The aforementioned portable electronic device can also be other portable electronic devices, such as a laptop computer with a touch-sensitive surface (e.g., a touch panel). It should also be understood that in some other embodiments of the present invention, electronic device 300 may not be a portable electronic device, but rather a desktop computer with a touch-sensitive surface (e.g., a touch panel).

[0097] In another aspect, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the cross-scenario WiFi seamless authentication method provided by the methods described above, the method comprising: Upon receiving an HTTP / HTTPS request initiated by a terminal when accessing a WiFi network, the corresponding HTTP / HTTPS traffic is intercepted, and a redirection response is returned to the terminal to invoke the terminal to load the detection response template page; Obtain the UUID uploaded by the terminal; the UUID is obtained by the terminal after concatenating multi-dimensional stable features collected from the detection response template page; If the MAC verification of the terminal fails, the UUID is verified. If the UUID verification passes, an online status indicator is returned to the terminal to configure WiFi network access permissions for the terminal.

[0098] Those skilled in the art will understand that all or part of the processes of the methods described in the above embodiments can be implemented by a computer program instructing related hardware, and the program can be stored in a computer-readable storage medium. The computer-readable storage medium may be a disk, optical disk, read-only memory, or random access memory, etc.

[0099] The cross-scenario WiFi seamless authentication method, apparatus, system, and gateway device provided by the present invention have been described in detail above. Specific examples have been used to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only for the purpose of helping to understand the method and core ideas of the present invention. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of the present invention. Therefore, the content of this specification should not be construed as a limitation of the present invention.

Claims

1. A cross-scenario WiFi seamless authentication method, characterized in that, include: Upon receiving an HTTP / HTTPS request initiated by a terminal when accessing a WiFi network, the corresponding HTTP / HTTPS traffic is intercepted, and a redirection response is returned to the terminal to invoke the terminal to load the detection response template page; Obtain the UUID uploaded by the terminal; The UUID is obtained by the terminal by splicing together multi-dimensional stable features collected from the detection response template page; If the MAC verification of the terminal fails, the UUID is verified. If the UUID verification passes, an online status indicator is returned to the terminal to configure WiFi network access permissions for the terminal.

2. The cross-scenario WiFi seamless authentication method according to claim 1, characterized in that, Also includes: After the UUID verification fails, an offline status indicator is returned to the terminal to control the terminal to jump to the authentication page; The authentication page is used to receive user identity information and send the user identity information to the gateway for authentication.

3. The cross-scenario WiFi seamless authentication method according to claim 1, characterized in that, Also includes: After the UUID verification fails, the mapping relationship between the terminal access session and the UUID is stored in a record object, and the corresponding UUID is obtained based on the mapping relationship the next time the UUID is used; the lifecycle of the record object is bound to the terminal's WiFi network access session, and it is cleared after the terminal disconnects from the WiFi network.

4. The cross-scenario WiFi seamless authentication method according to claim 1, characterized in that, Also includes: Obtain the user identity information and gateway verification account uploaded by the authentication page of the terminal, and generate a MAC-insensitive temporary record and a UUID persistent authorization record after the user identity information and the gateway verification account are successfully authenticated; The MAC-insensitive temporary record includes the MAC address of the terminal and the bound user identity information. The MAC-insensitive temporary record is deleted after a target duration. The MAC-insensitive temporary record is used to match the MAC address of the terminal for MAC verification. The persistent UUID authorization record includes the UUID and the bound user identity information, and the persistent UUID authorization record is stored in the persistent UUID authorization library; the persistent UUID authorization library is used to match with the UUID to verify the UUID.

5. The cross-scenario WiFi seamless authentication method according to claim 1, characterized in that, The UUID persistent authorization library is deployed to a cloud server or gateway cluster.

6. The cross-scenario WiFi seamless authentication method according to claim 1, characterized in that, The multi-dimensional stable features include: WebGL rendering features, Canvas drawing features, audio oscillator features, system font list, Navigator object properties, screen parameters, system time zone, and Math object calculation precision; The UUID is a feature string obtained by the terminal by concatenating multi-dimensional stable features collected from the detection response template page, and then encrypting the feature string using a hash algorithm.

7. The cross-scenario WiFi seamless authentication method according to any one of claims 1-6, characterized in that, Returning a redirect response to the terminal to invoke the terminal to load the detection response template page, including: The Portal redirection rule is executed, and a redirection response containing the detection response template page and the Portal authentication page is returned to the terminal to invoke the terminal to load the detection response template page.

8. A cross-scenario WiFi seamless authentication device, characterized in that, include: The redirection module is used to intercept the corresponding HTTP / HTTPS traffic after receiving an HTTP / HTTPS request initiated by the terminal when accessing the WiFi network, and return a redirection response to the terminal to trigger the terminal to load the detection response template page; The UUID acquisition module is used to acquire the UUID uploaded by the terminal; The UUID is obtained by the terminal by splicing together multi-dimensional stable features collected from the detection response template page; The verification module is used to verify the UUID after the MAC verification of the terminal fails, and to return an online status identifier to the terminal after the UUID verification passes, so as to configure WiFi network access permissions for the terminal.

9. A gateway device, characterized in that, Including memory and processor, among which, The memory is used to store programs; The processor, coupled to the memory, is used to execute the program stored in the memory to implement the steps of the cross-scenario WiFi seamless authentication method as described in any one of claims 1 to 7.

10. A cross-scenario WiFi seamless authentication system, characterized in that, It includes the gateway device as described in claim 9 and a terminal that is communicatively connected to the gateway device.

Images