Terminal authentication method, computer device and medium

Abstract

Embodiments of the present application provide a terminal authentication method, a computer device and a medium. The method comprises: a first authentication server determining an authentication process of a terminal according to first interaction information in a first target process matrix table corresponding to a network access device, and authenticating the terminal based on the authentication process. A second authentication server determines an authentication process of the network access device according to second interaction information in a second target process matrix table corresponding to the network access device, and authenticates the terminal based on the authentication process. Based on the method provided in the present application, the authentication server can complete the network access authentication of the terminal according to the interaction information configured in the target process matrix table, thereby saving the process of developing the authentication process separately, saving time and effort, and improving the efficiency of the authentication server in completing the network access authentication of the terminal.

Description

Technical Field

[0001] This application relates to the field of communications, and more particularly to a terminal authentication method, computer equipment, and medium. Background Technology

[0002] Terminal network access authentication is a security mechanism that authenticates terminal devices before they connect to a network, protecting the network from unauthorized terminal access and potential security threats. Captive Portal authentication is one method of terminal network access authentication. Captive Portal authentication includes the authentication process between the Network Access Server (NAS) and the authentication server. However, there is no standardized Captive Portal authentication process; the process is defined and implemented by the NAS manufacturer for different brands, resulting in variations between the authentication processes between different NAS brands and the authentication server.

[0003] In related technologies, for different brands of NAS, the corresponding authentication process is usually customized on the authentication server so that the authentication server can interact with NAS of different brands.

[0004] However, customized development requires the development of new software. Software development, testing, release, and version upgrades take a long time. It is impossible to complete the authentication process connection between the authentication server and the network access device in a short period of time, resulting in low efficiency in the authentication process connection between the authentication server and the network access device, which in turn leads to low efficiency in the authentication server to complete terminal network access authentication. Summary of the Invention

[0005] This application provides a terminal authentication method, computer equipment, and medium, which can improve the efficiency of authentication servers in completing terminal network access authentication.

[0006] In a first aspect, embodiments of this application provide a terminal authentication method, the method being applied to a first authentication server, comprising:

[0007] The receiving terminal sends a first authentication request, the first authentication request including information about the network access device accessed by the terminal;

[0008] In response to the first authentication request, a preset first target process matrix table is determined; wherein, the first target process matrix table includes the first interaction information between the network access device and the first authentication server;

[0009] Based on the first interaction information in the first target process matrix table, determine the authentication process with the terminal;

[0010] The terminal is authenticated based on the authentication process described above.

[0011] In one possible implementation, the first interactive information includes first authentication information and second authentication information;

[0012] Accordingly, determining the authentication process with the terminal based on the first interaction information in the first target process matrix table includes:

[0013] The first authentication process between the first authentication server and the terminal is determined based on the first authentication information, wherein the first authentication process is the process from receiving the first authentication request to returning to the authentication page;

[0014] The second authentication process between the first authentication server and the terminal is determined based on the second authentication information. The second authentication process is the process from receiving the second authentication request for login information from the terminal to returning the authentication information.

[0015] In one possible implementation, the first authentication information includes a first target operation corresponding to the first authentication process, and the first target operation includes returning a preset authentication page to the terminal.

[0016] Accordingly, the authentication of the terminal based on the authentication process includes:

[0017] By performing the first target operation, the preset authentication page is sent to the terminal so that the terminal displays the authentication page.

[0018] In one possible implementation, the second authentication information includes a second target operation corresponding to the second authentication process, and the second target operation includes generating authentication information;

[0019] Accordingly, after sending the preset authentication page to the terminal, the method further includes:

[0020] The terminal receives a second authentication request, wherein the second authentication request is generated by the terminal in response to the user's input operation on the login page, and the second authentication request includes login information;

[0021] In response to the second authentication request, the second target operation is performed to generate authentication information for the login information;

[0022] The authentication information is sent to the second authentication server so that the second authentication server can authenticate the authentication information.

[0023] In one possible implementation, sending the authentication information to the second authentication server includes:

[0024] The authentication information is sent to the terminal, so that the terminal sends the authentication information to the network access device, so that the network access device generates a third authentication request for the authentication information and sends the third authentication request to the second authentication server.

[0025] In one possible implementation, prior to the first authentication request sent by the receiving terminal, the method further includes:

[0026] Obtain a first original authentication interaction message, wherein the first original authentication message includes the first original interaction information of the network access device;

[0027] Based on the first original interaction information, the first target process matrix table is obtained.

[0028] Secondly, embodiments of this application provide a terminal authentication method, the method being applied to a second authentication server, comprising:

[0029] Receive a third authentication request sent by a network access device, wherein the third authentication request is generated by the network access device based on authentication information sent by the terminal, and includes information of the network access device;

[0030] In response to the third authentication request, a preset second target process matrix table is determined; wherein the second target process matrix table includes second interaction information between the network access device and the second authentication server, wherein the second interaction information includes third authentication information;

[0031] The third authentication process between the second authentication server and the terminal is determined based on the third authentication information, wherein the third authentication process is the process from receiving the third authentication request to returning the authentication result;

[0032] The terminal is authenticated based on the third authentication process.

[0033] In one possible implementation, the third authentication information includes a third target operation corresponding to the third authentication process, the third target operation including authenticating the authentication information and returning the obtained authentication result to the terminal.

[0034] Thirdly, this application provides a terminal authentication device, which is applied to a first authentication server and includes:

[0035] The receiving module is used to receive a first authentication request sent by the terminal, wherein the first authentication request includes information about the network access device accessed by the terminal.

[0036] The processing module is configured to, in response to the first authentication request, determine a preset first target process matrix table; wherein, the first target process matrix table includes first interaction information between the network access device and the first authentication server;

[0037] The processing module is further configured to determine the authentication process with the terminal based on the first interaction information in the first target process matrix table;

[0038] The processing module is also used to authenticate the terminal based on the authentication process.

[0039] Fourthly, this application provides a terminal authentication device, which is applied to a second authentication server and includes:

[0040] A receiving module is configured to receive a third authentication request sent by a network access device, wherein the third authentication request is generated by the network access device based on authentication information sent by a terminal, and includes information about the network access device.

[0041] The processing module is configured to, in response to the third authentication request, determine a preset second target process matrix table; wherein the second target process matrix table includes second interaction information between the network access device and the second authentication server, wherein the second interaction information includes third authentication information;

[0042] The processing module is further configured to determine a third authentication process between the second authentication server and the terminal based on the third authentication information, wherein the third authentication process is a process from receiving the third authentication request to returning the authentication result;

[0043] The processing module is also used to authenticate the terminal based on the third authentication process.

[0044] Fifthly, this application provides a computer device, including: a memory and a processor;

[0045] The memory stores computer-executed instructions;

[0046] The processor executes computer execution instructions stored in the memory, causing the processor to perform the methods described in the first and second aspects above.

[0047] In a sixth aspect, this application provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, are used to implement the methods described in the first and second aspects above.

[0048] In a seventh aspect, this application provides a computer program product, including a computer program that, when executed by a processor, implements the methods described in the first and second aspects above.

[0049] The terminal authentication method, computer equipment, and media provided in this application embodiment enable the authentication server to perform terminal network access authentication without developing separate authentication processes for different brands of NAS. Instead, it queries the target process matrix table corresponding to the NAS and completes the network access authentication of the terminal according to the authentication information configured in the target process matrix table. This saves time and effort by eliminating the need to develop separate authentication processes for NAS, improves the efficiency of the authentication server and network access device authentication process integration, and thus improves the efficiency of the authentication server in completing terminal network access authentication. Attached Figure Description

[0050] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0051] Figure 1 This application provides a schematic diagram of the scenario.

[0052] Figure 2 Flowchart of the terminal authentication method provided in this application Figure 1 ;

[0053] Figure 3 Flowchart of the terminal authentication method provided in this application Figure 2 ;

[0054] Figure 4 Here is an example of a first-target process matrix table;

[0055] Figure 5 This is an example of a first-target process matrix table;

[0056] Figure 6 Flowchart of the terminal authentication method provided in this application Figure 3 ;

[0057] Figure 7 Flowchart of the terminal authentication method provided in this application Figure 4 ;

[0058] Figure 8 This is the first process matrix template for the example;

[0059] Figure 9 Flowchart of the terminal authentication method provided in this application Figure 5 ;

[0060] Figure 10 Here is an example of a second target process matrix table;

[0061] Figure 11 This is an example of a second process matrix template for the second certification stage;

[0062] Figure 12 This is an example of a second target process matrix table for the second certification stage;

[0063] Figure 13 A flowchart for creating a target process matrix table as an example;

[0064] Figure 14 The hardware authentication process for terminal network access authentication is shown as an example.

[0065] Figure 15 This is a flowchart of the interactive message processing.

[0066] Figure 16 Schematic diagram of the terminal authentication device provided in this application Figure 1 ;

[0067] Figure 17 Schematic diagram of the terminal authentication device provided in this application Figure 2 ;

[0068] Figure 18 A schematic diagram of the structure of the computer device provided in this application.

[0069] The accompanying drawings illustrate specific embodiments of this application, which will be described in more detail below. These drawings and descriptions are not intended to limit the scope of the concept in any way, but rather to illustrate the concepts of this application to those skilled in the art through reference to particular embodiments. Detailed Implementation

[0070] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0071] The acquisition, transmission, storage, use, and processing of data in this application comply with the relevant provisions of laws and regulations. It should also be noted that certain software, components, models, and other existing solutions in the industry may be mentioned in the embodiments of this application. These should be considered as exemplary and are intended only to illustrate the feasibility of implementing the technical solution of this application. However, they do not mean that the applicant has used or necessarily used the relevant content of the solution.

[0072] Figure 1 The scenario diagram provided for this application is as follows: Figure 1 As shown, terminal network access authentication is a security mechanism that authenticates terminal devices before they access the network, protecting the network from unauthorized terminal access and potential security threats. Captive Portal authentication is one method of terminal network access authentication. In Captive Portal authentication, the NAS responds to the terminal's network access request and interacts with the authentication server to complete the authentication. Specifically, in Captive Portal authentication, the authentication server consists of a first authentication server and a second authentication server. Correspondingly, Captive Portal authentication includes two stages: the first authentication stage corresponding to the first authentication server and the second authentication stage corresponding to the second authentication server. In the first authentication stage, the user accesses the authentication page of the first authentication server through a browser on the terminal. The first authentication page returns an authentication page to the terminal, where the user enters their username and password and clicks "authenticate." The first authentication server then generates authentication information and returns it. In the second authentication stage, the second authentication server authenticates the authentication information and returns the corresponding authentication result to the terminal. There is no unified process for Captive Portal certification. The Captive Portal certification process for different brands of NAS devices is defined and implemented by the brand itself. Therefore, there are differences in the certification process between different types of NAS and certification servers.

[0073] In related technologies, for different brands of NAS, the corresponding authentication process is usually customized on the authentication server to enable the authentication server to interact with NAS devices of different brands. However, customized development requires the development of new software, and software development, testing, release, and version upgrades take a long time. This makes it impossible to complete the authentication process integration between the authentication server and network access devices in a short period of time, resulting in low efficiency in the authentication process integration between the authentication server and network access devices.

[0074] In the process of authenticating a terminal for network access, the first authentication server obtains the first interaction information in the first authentication stage by querying the first target process matrix table corresponding to the NAS, and completes the network access authentication of the terminal based on the first interaction information. The second authentication server obtains the second interaction information in the second authentication stage by querying the second target process matrix table corresponding to the NAS, and completes the network access authentication of the terminal based on the second interaction information. According to the method provided in this application, for NAS of different brands, there is no need to develop separate authentication processes. Instead, by querying the target process matrix table corresponding to the NAS and following the interaction information configured in the target process matrix table, the connection with the NAS is completed. This saves the process of developing separate authentication processes, saving time and effort, improving the efficiency of the authentication process connection between the authentication server and the network access device, and thus improving the efficiency of the authentication server in completing the terminal network access authentication.

[0075] The technical solution of this application and how the technical solution of this application solves the above-mentioned technical problems are described in detail below with specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments. The embodiments of this application will now be described with reference to the accompanying drawings.

[0076] Figure 2 Flowchart of the terminal authentication method provided in this application Figure 1 The method is applied to the first authentication server, such as Figure 2 As shown, it includes:

[0077] S201. Receive a first authentication request sent by the terminal, wherein the first authentication request includes information about the network access device accessed by the terminal.

[0078] Based on the scenario example, the execution subject in this embodiment is Figure 1 The first authentication server in the network can be a portal server. When a terminal joins the network, the user can access any address through a browser on the terminal. Based on the user's access to any address, the terminal sends an access request to the network access device (NAS). The NAS redirects the terminal's access address based on the terminal's access request. The NAS can use the authentication page address of the portal server as the redirected address to return the redirected address to the terminal. It is worth mentioning that when the NAS returns the redirected address to the terminal, it can add its own information, such as its corresponding key parameters. Different types of NAS have different key parameters. The terminal can generate a first authentication request based on the redirected address and the corresponding key parameters of the NAS, and send the first authentication request to the portal server.

[0079] It's worth noting that the key parameters for the same type of NAS differ between wired and wireless scenarios. For example, taking NAS1 as an example, in a wireless scenario, the key parameters for NAS1 include: action information, the terminal's Media Access Control (MAC) information, the terminal's Internet Protocol (IP) address, Service Set Identifier (SSID), Access Point (AP) name, AP-group name, NAS's IP address, and original Uniform Resource Locator (URL). Therefore, when NAS1 returns the redirected address to the terminal, it can add its own corresponding action information, MAC information, SSID, AP name, terminal's IP address, AP-group name, NAS's IP address, and URL.

[0080] In wired scenarios, the key parameters for NAS1 include: action information, MAC information, terminal IP address, NAS IP address, and URL.

[0081] The key parameters for each type of NAS in wired and wireless scenarios are customized by the NAS brand. This application does not impose any restrictions on the key parameters of NAS.

[0082] S202. In response to the first authentication request, a preset first target process matrix table is determined; wherein, the first target process matrix table includes the first interaction information between the network access device and the first authentication server.

[0083] Based on the scenario example, the Portal server locally stores a first-process matrix table corresponding to various types of NAS. The Portal server's network access authentication for terminals is the first authentication stage, and the first interaction information corresponding to this first authentication stage is configured in the first-process matrix table for each type of NAS. Furthermore, the first-process matrix table for each type of NAS records the key parameters of that NAS. Since the key parameters differ for different types of NAS, the Portal server configures a separate first-process matrix table for each type of NAS. NAS types can be categorized by brand or by the actual authentication process; for example, NAS devices with the same actual authentication process can be grouped into the same category.

[0084] The Portal server, upon receiving the first authentication request, confirms the key parameters of the NAS carried in the request. Based on these parameters, it matches them with the first process matrix tables corresponding to various types of NAS in the local storage system. The first process matrix table corresponding to the NAS interacting with the terminal during this authentication process is then determined as the first target process matrix table. The Portal server then uses this first target process matrix table to determine the first interaction information corresponding to the first authentication stage.

[0085] S203. Determine the authentication process with the terminal based on the first interaction information in the first target process matrix table.

[0086] Using scenario examples, although the key parameters recorded in the first process matrix table differ for different types of NAS, the configured authentication process for the first authentication stage is the same. The first interaction information includes the interaction objects that the Portal server needs to interact with, and the feedback required to these objects. The Portal server uses this information to determine the authentication process that needs to be performed on the terminal.

[0087] S204. Based on the authentication process, authenticate the terminal.

[0088] Based on the scenario example, the Portal server can complete the authentication of the terminal in the first authentication stage by executing the authentication process determined above.

[0089] According to the method provided in this example, the first authentication server can obtain the first interaction information in the first authentication stage by querying the first target process matrix table corresponding to the NAS, and determine the authentication process in the first authentication stage based on the first interaction information, thereby completing the network access authentication of the terminal in the first authentication stage. Therefore, based on the method provided in this example, there is no need to develop separate authentication processes for different types of NAS, saving time and effort and improving the efficiency of the first authentication server in completing the terminal network access authentication.

[0090] Optional, Figure 3 Flowchart of the terminal authentication method provided in this application Figure 2 The first interactive information includes first authentication information and second authentication information;

[0091] Accordingly, such as Figure 3 As shown, S203 includes:

[0092] S301. Determine the first authentication process between the first authentication server and the terminal based on the first authentication information, wherein the first authentication process is the process from receiving the first authentication request to returning the authentication page.

[0093] Combined with scenario examples, Figure 4 As an example, a first target process matrix table, such as Figure 4 As shown, all content information configured in the first target process matrix table can be determined as the first interaction information. The first target process matrix table shows that the first interaction information includes two parts of authentication information: first authentication information and second authentication information, each corresponding to a different authentication process. Therefore, the authentication process corresponding to the first authentication information can be determined as the first authentication process. Figure 4 It can be seen that the first interaction information configured in the first target process matrix table includes the interaction object and interaction content corresponding to the first authentication stage. The interaction object is the device that interacts with the Portal server for authentication. Therefore, it can be known from the interaction object that the first authentication stage is the interaction between the Portal server and the terminal. The interaction content is the record of the interaction sent between the interaction objects. The interaction content in the first authentication information is the interaction record corresponding to the first authentication process. Therefore, the interaction content of the first authentication process can be determined from the interaction content in the first authentication information as follows: the terminal accesses the authentication page address of the redirected first server through the browser, and the first authentication server returns the authentication interface. Therefore, it can be known from the interaction content of the first authentication process that the first authentication process starts from the terminal accessing the authentication page of the Portal server and ends with the Portal server returning the authentication page.

[0094] S302. Determine the second authentication process between the first authentication server and the terminal based on the second authentication information, wherein the second authentication process is the process from receiving the second authentication request for login information from the terminal to returning authentication information.

[0095] Similarly, combining scenario examples, combining... Figure 4 The authentication process corresponding to the second authentication information can be defined as the second authentication process. The interactive content in the second authentication information is the record corresponding to the second authentication process. The interactive content in the second authentication information can be used to determine the interactive content of the second authentication process as follows: the user enters the authentication account and authentication password through the terminal and submits the authentication. The first authentication server returns the authentication information. Therefore, it can be seen from the interactive content of the second authentication process that the second authentication process starts from the terminal submitting the authentication of the authentication account and authentication password and ends with the Portal server returning the authentication information.

[0096] Based on the method provided in this example, the Portal server can directly determine the first interaction information between the terminal and the first authentication stage by querying the first target process matrix table, thereby determining the authentication process that needs to be completed when authenticating the terminal in the first authentication stage. By directly querying the first target process matrix table, the convenience and flexibility of the Portal server in completing terminal authentication can be improved.

[0097] Optionally, the first authentication information includes a first target operation corresponding to the first authentication process, and the first target operation includes returning a preset authentication page to the terminal;

[0098] Accordingly, S204 includes:

[0099] By performing the first target operation, the preset authentication page is sent to the terminal so that the terminal displays the authentication page.

[0100] Combined with scenario examples, Figure 4 The two authentication processes can be sorted by nodes. For example, the node corresponding to the first authentication process can be defined as node P1, and the node corresponding to the second authentication process can be defined as node P2. The Portal server receives the first authentication request from the terminal, which is the first interaction with the terminal. Therefore, it can query the first node in the first target process matrix table, i.e., query node P1, to obtain the first authentication information. The first interaction information also includes parameter information, which includes the corresponding parameter part and operation content. The parameter information included in the first authentication information can be defined as the first parameter information, the parameter part in the first parameter information can be defined as the first parameter part, and the operation content in the first parameter information can be defined as the first target operation.

[0101] Depend on Figure 4 As can be seen, the first parameter section includes at least one key parameter, each of which includes a corresponding keyword and a value. The key parameter recorded here is the key parameter corresponding to the NAS. As mentioned above, the key parameters are different for each NAS, and the first target process matrix table corresponding to the NAS can be determined through the first parameter section. The first target operation is to return to the authentication interface, so the Portal server then returns the preset authentication page to the terminal, which is stored locally on the Portal server. Optionally, the Portal server can generate a first message about the authentication page and then return the first message of the authentication page to the terminal, carrying the key parameters corresponding to the NAS in the first message of the authentication page.

[0102] Figure 5 As an example of a first-target process matrix table, assume... Figure 5 This is the first target process matrix table corresponding to a certain type of NAS, for example, the first target process matrix table corresponding to NAS1. Figure 5It is known that the key parameters corresponding to NAS1 include the following: action information, MAC information, terminal IP address, SSID, AP name, AP-group name, NAS IP address, and URL. The first target process matrix table contains keywords for each key parameter, but no specific values ​​are configured. The specific values ​​are returned to the terminal when NAS1 sends the redirected authentication page address. Therefore, the first authentication request generated by the terminal includes the keywords and values ​​of NAS1's key parameters. In practical applications, the first authentication request will include not only the keywords and values ​​of each key parameter of NAS1, but also other parameters. Therefore, when the Portal server generates the first message of the authentication page, it uses the keywords of each key parameter recorded in the first parameter section to search for the corresponding key parameters and values ​​from all the parameters carried in the first authentication request, thus obtaining the keywords and values ​​of each key parameter corresponding to NAS1. This information is then included in the first message of the generated authentication page to successfully complete the first authentication process with the terminal. The Portal server adds the keyword and value of the key parameter corresponding to NAS1 to the first message because the terminal usually interacts with the first authentication server through a browser. The "HTTP" interaction generated by the browser is stateless, and the terminal does not remember the interaction information that occurred before, including the keyword and value of the key parameter corresponding to NAS1 carried when sending the first authentication request to the Portal server. Therefore, the Portal server can add the keyword and value of the key parameter corresponding to NAS1, as well as the terminal's own IP address, to the generated first message to inform the terminal that it can carry the keyword and value of the key parameter corresponding to NAS1 in the next interaction.

[0103] For example, when a terminal sends the first authentication request, it includes the keywords and values ​​of the key parameters corresponding to NAS1. The Portal server can then determine that the network access device corresponding to the terminal is NAS1 based on these key parameters and request access to the authentication page. The Portal server can return the authentication page to the terminal based on the first authentication request, adding the keywords and values ​​of the key parameters corresponding to NAS1 to the first message of the returned authentication page. This is to inform the terminal that the corresponding network access device is NAS1, and the keywords and values ​​of the key parameters corresponding to NAS1, so that the terminal can include these keywords and values ​​in subsequent authentication processes to complete the authentication process.

[0104] After receiving the first message of the authentication page, the terminal can identify the authentication page and display it.

[0105] Based on the method provided in this example, the Portal server can directly query the first target process matrix table to determine the first target operation for the next interaction, and execute the corresponding first target operation to successfully complete the interaction with the terminal. It can also connect according to the first authentication information configured in the first target process matrix table, saving time and effort and improving the efficiency of the authentication server in completing terminal authentication.

[0106] Optional, Figure 6 Flowchart of the terminal authentication method provided in this application Figure 3 The second authentication information includes the second target operation corresponding to the second authentication process, and the second target operation includes generating authentication information;

[0107] Accordingly, such as Figure 6 As shown, after sending the preset authentication page to the terminal, the method further includes:

[0108] S601. Receive a second authentication request sent by the terminal, wherein the second authentication request is generated by the terminal in response to the user's input operation on the login page, and the second authentication request includes login information.

[0109] Based on the scenario example, the authentication page includes input boxes for entering authentication account, authentication password and other information. Users can perform authentication operations by outputting authentication account, authentication password and other information based on the authentication page displayed on the terminal. The terminal responds to the user's authentication operation by generating a second authentication request based on the authentication account, authentication password and other information output by the user, and then sends the generated second authentication request to the Portal server again.

[0110] S602. In response to the second authentication request, the second target operation is performed to generate authentication information for the login information.

[0111] Based on the scenario example and the above content, the Portal server completes the network access operation for the terminal in a continuous process. Therefore, the Portal server receiving the second authentication request is the second interaction performed by the Portal server. Thus, the second authentication information can be obtained by querying the second node in the first target process matrix table, i.e., querying node P2. Figure 4 The parameter information included in the first authentication information can be determined as the second parameter information, and the parameter portion of the second parameter information can be determined as the second parameter portion. Figure 4 It can be seen that the second parameter section includes at least one corresponding key parameter, and each key parameter includes a corresponding keyword and a value assigned to the keyword. The operation content in the second parameter information is determined as the second target operation, which is to return authentication information.

[0112] The key parameters of the second parameter section differ for different types of NAS. Figure 5 Taking the first target process matrix table corresponding to NAS1 as an example, the key parameters in the second parameter section of NAS1 include: authentication account, authentication password, authentication interface, sending method, logout interface, and action information. The authentication account and password are the authentication account and password entered by the user on the authentication page displayed on the terminal; the authentication interface and logout interface are the HTTP interfaces provided by the NAS, where the authentication interface is used for authentication and the logout interface is used for exiting authentication; the action information indicates whether authentication is required or not; and the sending method refers to the method used when sending HTTP messages to the NAS, including POST and GET methods.

[0113] The first target process matrix table contains the keywords and values ​​corresponding to each key parameter. Based on the second target operation, authentication information needs to be returned. Therefore, the Portal server can generate a second message containing authentication information and return it to achieve the purpose of returning authentication information. Specifically, the authentication information can be determined by the keywords and their corresponding values ​​for the authentication account, authentication password, authentication interface, sending method, logout interface, and action information.

[0114] S603. Send the authentication information to the second authentication server so that the second authentication server can authenticate the authentication information.

[0115] Based on the scenario example, the authentication information can be returned by sending the second message of the authentication information back to the terminal according to the interaction objects configured in the first target process matrix table. The terminal then sends the second message of the authentication information to the second authentication server so that the second authentication server can authenticate the authentication information. Alternatively, the second message of the authentication information can be sent directly to the second authentication server for authentication. This solution does not impose any limitations on this approach.

[0116] Based on the method provided in this example, the first authentication server can directly query the first target process matrix table to determine the second target operation to be interacted with next, execute the corresponding second target operation to return authentication information, and connect according to the interaction information configured in the first target process matrix table, saving time and effort and improving the efficiency of the authentication server in completing terminal authentication.

[0117] Optionally, sending the authentication information to the second authentication server includes:

[0118] The authentication information is sent to the terminal, so that the terminal sends the authentication information to the network access device, so that the network access device generates a third authentication request for the authentication information and sends the third authentication request to the second authentication server.

[0119] Based on the scenario example, as described above, the authentication information includes key parameters such as authentication account, authentication password, authentication interface, sending method, logout interface, and action information. After the terminal sends the authentication information to the NAS, the NAS can obtain each key parameter by parsing the authentication information. Based on the authentication account and password, a third authentication request is generated. If the action information determines that authentication of the authentication account and password is required, the third authentication request can be sent to the NAS via the authentication interface specified in the authentication information, and the method of sending the third authentication request can follow the sending method specified in the authentication information. If the action information determines that authentication needs to be exited, authentication can be exited via the logout interface specified in the authentication information.

[0120] Based on the method provided in this example, the purpose of sending authentication information to a second authentication server can be achieved, so that the second authentication server can complete the subsequent network access authentication of the terminal.

[0121] Figure 7 Flowchart of the terminal authentication method provided in this application Figure 4 ,like Figure 7 Prior to S201, the following are also included:

[0122] S701. Obtain the first original authentication interaction message, wherein the first original authentication message includes the first original interaction information of the network access device.

[0123] Based on the scenario examples and the preceding content, it's clear that the authentication processes between different types of NAS and authentication servers vary. Therefore, the original authentication interaction messages for different types of NAS also differ. The original authentication interaction messages for a NAS represent the actual interaction information generated when the NAS and an authentication server of the same brand authenticate each other. This includes the actual number of interactions with the authentication server, the actual content of each interaction, and the actual key parameters for each interaction. Specifically, by identifying the type of NAS, its brand information can be determined, thereby identifying the authentication server of the same brand as the NAS. The actual interaction information between the authentication server and the NAS can then be obtained locally from the authentication server of the same brand.

[0124] Since terminal authentication for network access involves two authentication phases: a first authentication phase with a first authentication server and a second authentication phase with a second authentication server, the original authentication interaction message for the NAS consists of two parts: a first original authentication interaction message corresponding to the first authentication phase and a second original authentication interaction message corresponding to the second authentication phase. The first original authentication message includes the NAS's first original interaction information during the first authentication phase, including the number of interactions between the NAS and the authentication server, the interaction content, and the key parameters carried. The second original authentication message includes the NAS's second original interaction information during the second authentication phase, including the number of interactions between the NAS and the authentication server, the interaction content, and the key parameters carried.

[0125] S702. Based on the first original interaction information, obtain the first target process matrix table.

[0126] Based on a scenario example, the Portal server can obtain the initial interaction information between the terminal and the first authentication server during the first authentication phase by parsing the initial authentication interaction message. The terminal typically interacts with the first authentication server through a browser, so parsing the initial authentication interaction message reveals the number of browser interactions involved during the first authentication phase. Specifically, the initial authentication message can be opened in a pre-defined software and filtered using preset browser identifiers, such as using "http" to filter the message, thus obtaining the number of browser interactions.

[0127] For example, taking the first original authentication interaction message corresponding to NAS1 as an example, parsing the first original authentication interaction message corresponding to NAS1 yields the first original interaction information corresponding to the first authentication stage. The first original interaction information specifically includes: at least four interactions in the first authentication stage. The first interaction is when the terminal accesses any website address through a browser to access the NAS1 device. Since the terminal has not yet performed authentication, the traffic will be redirected by NAS1 to the authentication page of the first server, and the address of the redirected authentication page of the first server will be returned to the terminal.

[0128] The second interaction involves the terminal accessing the authentication page of the first server via a browser. When the terminal accesses this page, it includes a keyword parameter instance corresponding to NAS1. This instance contains keywords and values ​​for one or more key parameters. Upon receiving the first authentication request, the first authentication server records the keywords and values ​​for each key parameter and returns the first message corresponding to the authentication page to the terminal. This returned message also includes the keywords and values ​​for the key parameters of NAS1.

[0129] For example, the key parameters corresponding to NAS1 include, but are not limited to, the following key parameters and their corresponding keywords and values: Action information: Keyword: key_XXX; Value: val_xxx; Terminal IP address: Keyword: key_XXX; Value: ABCD; Terminal MAC information: Keyword: key_XXX; Value: HHH; Service set identifier (SSID): Keyword: key_XXX; Value: val_xxx; Access point (AP) name: Keyword: key_XXX; Value: val_xxx; AP group information (AP-Group) name: Keyword: key_XXX; Value: val_xxx; NAS1 IP address: Keyword: key_XXX; Value: ABCD; Original Uniform Resource Locator (URL): Keyword: key_XXX; Value: http: / / XXX or https: / / XXX.

[0130] The third interaction occurs after the user enters their authentication account and password on the authentication page and clicks the authentication button. The terminal then submits the authentication account and password to the first authentication server via its browser, and the first authentication server returns authentication information. During this third interaction, the second message of the returned authentication information includes key parameter instances, which, in addition to the key parameters from the second interaction, at least include: keywords and values ​​corresponding to the authentication account, authentication password, authentication interface, sending method, logout interface, and action information. The first authentication server identifies the keywords and values ​​corresponding to the authentication account, authentication password, authentication interface, sending method, and action information as the authentication information and replies to the terminal with the corresponding second message.

[0131] For example, the key parameters corresponding to the third interaction include, but are not limited to, the following key parameters and their corresponding keywords and values: Authentication interface: Keyword: key_XXX; Value: val_xxx; Sending method: POST / GET; Logout interface: Keyword: key_XXX; Value: val_xxx; Value: val_xxx; Authentication account: Keyword: key_XXX; Value: val_xxx; Authentication password: Keyword: key_XXX; Value: val_xxx; Action information: Keyword: key_XXX; Value: val_xxx.

[0132] The fourth interaction is for the terminal to submit authentication information to the NAS1 device through the browser, so that the NAS1 device and the second authentication server can start the second authentication stage authentication interaction.

[0133] After obtaining the first initial interaction information of the first phase, the Portal server can configure the first target process matrix table based on the initial interaction information. Optionally, the Portal server can choose to use a preset template for configuration, and the template used to configure the first target process matrix table can be determined as the first process matrix table template.

[0134] Figure 8 The first process matrix template is shown below. Figure 8 As shown, based on the above four interactions with the browser, the first interaction is between the terminal and NAS1, the second interaction is between the terminal and the first authentication server, the third interaction is between the first authentication server and the terminal, and the fourth interaction is between NAS1 and the terminal. Since the first and fourth interactions do not involve the interaction with the first authentication server, they do not need to be reflected in the first process matrix table.

[0135] Therefore, in the first process matrix template, the second interaction can be configured as the first authentication process of the first authentication stage, and the third interaction can be configured as the second authentication process. The two authentication processes can be sorted, for example, by nodes, to obtain node P1 corresponding to the first authentication process and node P2 corresponding to the second authentication process. The interaction objects corresponding to node P1 are the terminal and the first authentication server. The required interaction content is: the terminal accesses the redirected authentication page address of the first server through a browser, and the first authentication server returns the authentication page. The interaction objects corresponding to node P2 are the terminal and the first authentication server. The required interaction content is: the user enters the authentication account and password through the terminal and submits the authentication, and the first authentication server returns the authentication information. In summary, node P1 represents the process of the terminal opening a browser and accessing the redirected address, i.e., accessing the authentication page address of the first authentication server, until the first authentication server returns the authentication page. Node P2 represents the process of the user entering their account and password on the user's terminal and clicking authentication, until the first authentication server returns the authentication information.

[0136] Combination Figure 8 In the first process matrix table template, each authentication process may involve one message interaction or multiple message interactions. The parameter section corresponding to each authentication process needs to record the key parameters involved in each message interaction. Optionally, based on the parsed first original authentication interaction message of NAS1, it can be seen that at node P1, the first authentication server only participates in one interaction (the second interaction), and at node P2, the first authentication server also only participates in one interaction (the third interaction). Therefore, only one interaction message is generated at both nodes P1 and P2. Thus, the key parameter instance corresponding to the second interaction can be configured to node P1 in the first process matrix table template to obtain the first parameter section corresponding to node P1. Similarly, the key parameter instance corresponding to the third interaction can be configured to node P2 in the first process matrix table template to obtain the second parameter section corresponding to node P2, thereby obtaining... Figure 5 The example shown is a first target process matrix table for the first authentication stage. Configuring the first target process matrix table according to the template standardizes the Portal server's configuration process, improving both the efficiency and accuracy of the resulting matrix table.

[0137] Based on the method provided in this example, by parsing the original authentication interaction message corresponding to the NAS, the key parameters, keywords, and values ​​involved in the first authentication stage of the first authentication server can be obtained. Based on the key parameters, keywords, and values ​​involved in the first authentication stage, the first process matrix template can be configured to obtain the first target process matrix. The first authentication server completes the docking with the NAS based on the first interaction information in the first target process matrix, saving the process of developing the authentication process separately, saving time and effort, improving the efficiency of docking between the authentication server and the NAS authentication process, and thus improving the efficiency of terminal network access authentication.

[0138] Figure 9 Flowchart of the terminal authentication method provided in this application Figure 5 The method is applied to the second authentication server, such as... Figure 9 As shown, it includes:

[0139] S901. Receive a third authentication request sent by a network access device, wherein the third authentication request is generated by the network access device based on authentication information sent by the terminal, and includes information of the network access device.

[0140] Based on the scenario example, the execution subject in this embodiment is Figure 1 The second authentication server in the network can be a Remote Authentication Dial-In User Service (RADIUS) server. When a terminal joins the network, the user first accesses any address through a browser on the terminal to access the NAS. The NAS returns the authentication page address of the first authentication server (the Portal server) as the redirected address to the first authentication server. Based on the redirection request sent by the NAS, the terminal accesses the authentication page address of the Portal server to send a first authentication request to the Portal server. After receiving the first authentication request from the terminal, the Portal server first queries the first target process matrix table to determine the first interaction information corresponding to the first authentication stage. Then, based on the first interaction information, it determines the authentication process between itself and the terminal and authenticates the terminal based on the authentication process between itself and the terminal. At the end of the first authentication stage, the Portal server generates a second message of authentication information and sends the second message to the terminal. The terminal then submits the authentication information to the NAS, so that the NAS generates a third authentication request for the authentication information and sends the third authentication request to the RADIUS server. The NAS can carry its own information, such as its own key parameters, in the third authentication request.

[0141] S902. In response to the third authentication request, a preset second target process matrix table is determined; wherein the second target process matrix table includes second interaction information between the network access device and the second authentication server, wherein the second interaction information includes third authentication information.

[0142] Based on the scenario example, the RADIUS server locally stores the second process matrix tables corresponding to various types of NAS. The RADIUS server's network access authentication for terminals is the second authentication stage, and the second interaction information corresponding to this second authentication stage is configured in the second process matrix tables for each type of NAS. Furthermore, the second process matrix tables for each type of NAS record the key parameters of that NAS. Since the key parameters differ for different types of NAS, the RADIUS server configures a separate second process matrix table for each type of NAS.

[0143] The RADIUS server can respond to the received third authentication request, confirm the key parameters of the NAS carried in the request, and match these parameters with the second process matrix tables corresponding to various types of NAS in the local storage. The second process matrix table corresponding to the NAS interacting with the terminal during this authentication process will be determined as the second target process matrix table. Then, the RADIUS server can query the second target process matrix table to determine the second interaction information corresponding to the first authentication stage.

[0144] Figure 10 As an example, a second target process matrix table, such as Figure 10 As shown, all content information configured in the second target process matrix table can be identified as the second interaction information. As can be seen from the second target process matrix table, the second interaction information includes the third authentication information.

[0145] S903. Determine the third authentication process between the second authentication server and the terminal based on the third authentication information, wherein the third authentication process is the process from receiving the third authentication request to returning the authentication result.

[0146] Using scenario examples, although the key parameters recorded in the second process matrix table differ for different types of NAS, the configured authentication process for the second authentication stage is the same. The second interaction information includes the interaction objects that the RADIUS server needs to interact with, and the feedback required to these objects. The RADIUS server uses this information to determine the authentication process that needs to be performed on the terminal.

[0147] Depend on Figure 10It can be seen that the second interaction information configured in the second target process matrix table includes the interaction objects and interaction content corresponding to the second authentication stage. The interaction objects are the devices that interact with the RADIUS server for authentication. Therefore, it can be seen from the interaction objects that the second authentication stage is the interaction between the RADIUS server and the NAS. The interaction content is the record of the interaction sent between the interaction objects. The authentication process corresponding to the third authentication information can be identified as the third authentication process. Therefore, the interaction content in the third authentication information is the interaction record corresponding to the third authentication process. Therefore, the interaction content of the third authentication process can be determined from the interaction content in the third authentication information as follows: the second authentication server receives the third authentication request and returns a response message of the authentication result. Therefore, it can be seen from the interaction content of the third authentication process that the third authentication process starts from the NAS sending the third authentication request to the RADIUS server and ends with the RADIUS server returning the response message of the authentication result.

[0148] S904. Based on the third authentication process, authenticate the terminal.

[0149] Based on the scenario example, the RADIUS server can complete the authentication of the terminal in the second authentication stage by executing the third authentication process determined above.

[0150] According to the method provided in this example, the second authentication server can obtain the second interaction information in the second authentication stage by querying the second target process matrix table corresponding to the NAS, and determine the authentication process in the second authentication stage based on the second interaction information, thereby completing the network access authentication of the terminal in the second authentication stage. Therefore, based on the method provided in this example, there is no need to develop separate authentication processes for different types of NAS, saving time and effort and improving the efficiency of the second authentication server in completing the terminal network access authentication.

[0151] Optionally, the third authentication information includes a third target operation corresponding to the third authentication process, wherein the third target operation includes authenticating the authentication information and returning the obtained authentication result to the terminal.

[0152] Combined with scenario examples, by Figure 10 It is known that the second target process matrix table includes an authentication process. Therefore, the RADIUS server can configure the node of this authentication process as node P3. The RADIUS server's receipt of the third authentication request is the first interaction, so it can directly query the second target process matrix table through node P3 to obtain the corresponding third authentication information. The second interaction information also includes parameter information, which includes the corresponding parameter part and operation content. The parameter information included in the third authentication information can be identified as the third parameter information. The third parameter information includes operation content, response message type, and authentication attributes. The operation content in the third parameter information can be identified as the third target operation. Figure 10 As can be seen, the third objective operation involves verifying the authentication account and password. Upon successful verification, a response message is sent, which must conform to the response message type and authentication attributes. The response message type and authentication attributes can be configured according to actual conditions. A corresponding response message is generated based on the instructions of the third objective operation. This generated response message is then identified as the authentication result response message and sent to the NAS. The NAS determines the specific authentication result based on the authentication result response message and then sends the obtained authentication result to the terminal. The authentication result includes both authentication failure and authentication success.

[0153] Based on the method provided in this example, the RADIUS server can directly query the second target process matrix table to determine the third target operation to be interacted with next, and execute the corresponding third target operation to successfully complete the interaction with the NAS. It can also connect according to the third authentication information configured in the second target process matrix table, saving time and effort and improving the efficiency of the RADIUS server in completing terminal authentication.

[0154] Optionally, as mentioned above, since the third authentication process differs between different types of NAS and the second authentication server, a separate second target process matrix table can be configured for each type of NAS. Specifically, this can be achieved by obtaining the second original authentication interaction message corresponding to the NAS and configuring the second target process matrix table for the NAS according to the second original authentication interaction message. The second original authentication interaction message corresponding to the NAS includes the second original interaction information of the NAS in the second authentication stage, including the number of interactions between the NAS and the authentication server, the interaction content, and the key parameters carried during the second authentication stage.

[0155] Since the second authentication phase corresponds to the interaction with the RADIUS server, filtering can be based on "RADIUS". For example, taking the second original authentication interaction message corresponding to NAS1 as an example, parsing the second original authentication interaction message corresponding to NAS1 and filtering based on "RADIUS" reveals that the number of interactions with the second authentication server in the second authentication phase is 1. Specifically, NAS1 sends a third authentication request for authentication information to the second authentication server, and the second authentication server returns a response message with the authentication result. By parsing the second original authentication interaction message, the second authentication server can know that the authentication attributes include two parts: a standard attribute part and a private attribute part. Both the standard attribute part and the private attribute part include one or more key attributes, and each key attribute includes a corresponding type and value. For example, the authentication attribute instances of NAS1 are: Attribute 1: type XX, type xx, value xx; ...; Attribute n: type XX, type xx, value xx; Private attribute instances: Attribute 1: type 26, vendor ID XXXXX, sub-type X, value xx; ...; Attribute n: type 26, vendor ID XXXXX, sub-type X, value xx.

[0156] Similarly, after obtaining the second initial interaction information in the second phase, the RADIUS server can configure the second target process matrix table based on the second initial interaction information. Optionally, the RADIUS server can choose to use a preset template for configuration, and the template used to configure the second target process matrix table can be determined as the second process matrix table template. Figure 11 This is an example of a second process matrix template for the second certification stage, such as... Figure 11As shown, in the second process matrix template, the second authentication phase includes an authentication process, which can be configured as node P3, with the corresponding interaction objects being NAS and the second authentication server. Based on the example of the second original authentication interaction message, the interaction objects are NAS1 and the second authentication server, so the interaction objects can be configured as NAS1 and the second authentication server. Node P3 in the second authentication phase may involve only one message interaction or may involve multiple message interactions, so the third parameter information needs to include the key parameters involved in each message interaction. Based on the example of the second original authentication interaction message, the third authentication process involves one interaction: NAS1 sends a third authentication request for authentication information to the second authentication server, and the second authentication server returns a response message with the authentication result. Therefore, the interaction content can be configured as follows: the second authentication server receives the third authentication request for authentication information and returns a response message with the authentication result. Regarding the third parameter information, the response message is based on the authentication result. If the authentication is successful in this example, the second authentication server will return a response message representing successful authentication. The request message type for the third authentication request can be any of the following: Access-Accept, Access-Reject, Access-Challenge, CoA-Request, or Disconnect-Request. For example, if the message type is Access-Accept, the response message returned by the second authentication server upon successful authentication should also be Access-Accept. Therefore, in the process matrix template for the second authentication stage, the response message type can be configured as "Accept-Accept," the authentication attributes can be configured as the authentication attribute instances parsed above, and the private attributes can be configured as the private attribute instances parsed above. Based on the actual operation content parsed above, the operation content in the process matrix template is configured as "verify the authentication account and password; after successful verification, issue a response message; the response message must conform to the response message type and authentication attributes," to obtain the second target process matrix table for the second authentication stage. Figure 12 This is an example of a second target process matrix table for the second authentication stage. Configuring the second target process matrix table according to the template standardizes the RADIUS server's configuration process, improving both the efficiency and accuracy of the resulting matrix table.

[0157] Figure 13This is a flowchart illustrating the creation of a target process matrix table, used to specify the interaction behavior between the authentication server and the NAS device or terminal, such as the type of message sent and the content carried by the message. The process involves obtaining the original authentication interaction message corresponding to the NAS device, dividing it into a first original authentication interaction message corresponding to the first authentication stage between the terminal and the first authentication server, and a second original authentication interaction message corresponding to the second authentication stage between the NAS and the second authentication server. These messages include the first original interaction flow of the first authentication stage and the second original interaction flow of the second authentication stage. Custom configurations are then performed on the keywords and values ​​of the parameter parts in the interaction process of the first authentication stage using the first original authentication interaction message, resulting in... Figure 5 An example of the first target process matrix table for the first authentication phase. The operation content, response message type, and authentication attributes in the interaction process of the second authentication phase are customized using the second original authentication interaction message, resulting in... Figure 12 This is an example of the second target process matrix table for the second certification stage. The first and second target process matrix tables are then bound to the corresponding NAS category information to facilitate subsequent integration with the NAS.

[0158] Figure 14 The hardware authentication process for terminal network access authentication is shown in the example below. Figure 14As shown, when a terminal joins the network, the user first accesses any address through a browser on the terminal. The NAS redirects the terminal's access address to the authentication page of the first authentication server based on the terminal's access request. The terminal accesses the redirected address to access the authentication page of the first authentication server and sends a first authentication request to the first authentication server. After receiving the first authentication request, the first authentication server queries node P1 in the first target process matrix table to return the first message of the authentication page to the terminal. After receiving the first message of the authentication page, the terminal can display the authentication page, which includes input boxes for entering authentication account, authentication password, and other information. The user can output the authentication account, authentication password, and other information based on the authentication page displayed on the terminal to perform the authentication operation. Based on the information output by the user, a second authentication request is generated and sent to the first authentication server. After receiving the second authentication request, the first authentication server queries node P2 in the first target process matrix table to return a second message of authentication information to the terminal. After receiving the second authentication message, the terminal sends the authentication information to the NAS. The NAS generates a third authentication request and sends it to the second authentication server, RADIUS. The second authentication server queries node P3 in the second target process matrix table to verify the authentication information and determines the verification result as the authentication result, which can be either authentication failure or authentication success. The second authentication server then sends a response message to the NAS. The NAS determines the specific authentication result based on the response message and then sends the obtained authentication result back to the terminal.

[0159] It is worth noting that in the target process matrix table example provided in this application, each of nodes P1, P2, and P3 has only one interaction message, so the target process matrix table example only contains parameter information corresponding to one interaction message. However, if nodes P1, P2, or P3 have multiple interaction messages, then parameter information should be configured for each interaction message in the target process matrix table. Figure 15 A flowchart of the interaction message processing, such as Figure 15As shown, before interfacing with the NAS authentication, the first and second authentication servers have analyzed and decomposed the corresponding target process matrix tables based on the original authentication messages collected by the NAS device and similar authentication servers. First, the first authentication server receives the first message from node P1 in the first authentication phase and responds according to the first target process matrix table. After responding, depending on whether node P1 has any subsequent messages to process, it chooses to proceed to the next message interaction or proceed to node P2 in the first authentication phase. Specifically, if there are subsequent messages at node P1, it responds to the subsequent messages according to the first target process matrix table; if there are no subsequent messages at node P1, it proceeds to node P2 in the first authentication phase. Similarly, the first authentication server receives the first message from node P2 in the first authentication phase, responds to the message according to the first target process matrix, and after responding, decides whether to proceed to the next message interaction or proceed to node P3 in the second authentication phase, depending on whether node P2 has any subsequent messages to process. Specifically, if there are subsequent messages at node P2, the subsequent messages are responded to according to the first target process matrix; if there are no subsequent messages at node P2, the process proceeds to node P3 in the second authentication phase. The second authentication server receives the first message from node P3 in the second authentication phase, responds to the message according to the second target process matrix, and after responding, decides whether to proceed to the next message interaction or end the authentication process, depending on whether node P3 has any subsequent messages to process. Specifically, if there are subsequent messages at node P3, the subsequent messages are responded to according to the second target process matrix; if there are no subsequent messages at node P3, the authentication process ends.

[0160] Based on the method provided in this application, during the process of terminal network access authentication, the authentication server does not need to develop separate authentication processes for different types of NAS. Instead, it queries the corresponding target process matrix table and completes the interaction with the NAS according to the authentication information configured in the target process matrix table. This saves time and effort by eliminating the need to develop separate authentication processes and improves the efficiency of terminal network access authentication.

[0161] Figure 16 Schematic diagram of the terminal authentication device provided in this application Figure 1 The device is applied to the first authentication server, such as Figure 16 As shown, it includes:

[0162] The receiving module 161 is used to receive a first authentication request sent by the terminal, wherein the first authentication request includes information about the network access device accessed by the terminal.

[0163] Processing module 162 is configured to, in response to the first authentication request, determine a preset first target process matrix table; wherein, the first target process matrix table includes first interaction information between the network access device and the first authentication server;

[0164] Processing module 162 is further configured to determine the authentication process with the terminal based on the first interaction information in the first target process matrix table;

[0165] The processing module 162 is also used to authenticate the terminal based on the authentication process.

[0166] The terminal authentication device provided in this embodiment can execute the method provided in the above method embodiment. Its implementation principle and technical effect are similar, and will not be described in detail here.

[0167] Figure 17 Schematic diagram of the terminal authentication device provided in this application Figure 2 The device is applied to the second authentication server, such as Figure 17 As shown, it includes:

[0168] The receiving module 171 is used to receive a third authentication request sent by a network access device, wherein the third authentication request is generated by the network access device based on authentication information sent by the terminal, and includes information of the network access device.

[0169] Processing module 172 is configured to, in response to the third authentication request, determine a preset second target process matrix table; wherein the second target process matrix table includes second interaction information between the network access device and the second authentication server, wherein the second interaction information includes third authentication information;

[0170] Processing module 172 is further configured to determine a third authentication process between the second authentication server and the terminal based on the third authentication information, wherein the third authentication process is a process from receiving the third authentication request to returning the authentication result;

[0171] The processing module 172 is also used to authenticate the terminal based on the third authentication process.

[0172] The terminal authentication device provided in this embodiment can execute the method provided in the above method embodiment. Its implementation principle and technical effect are similar, and will not be described in detail here.

[0173] Figure 18 A schematic diagram of the structure of the computer device provided in this application. Figure 18As shown, the computer device 50 provided in this embodiment includes at least one processor 501 and a memory 502. Optionally, the device 50 further includes a communication component 503. The processor 501, memory 502, and communication component 503 are connected via a bus.

[0174] In a specific implementation, at least one processor 501 executes computer execution instructions stored in memory 502, causing at least one processor 501 to perform the above-described method.

[0175] The specific implementation process of processor 501 can be found in the above method embodiments, and its implementation principle and technical effect are similar. It will not be repeated here.

[0176] In the above embodiments, it should be understood that the processor can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), etc. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in this invention can be directly implemented by a hardware processor, or implemented by a combination of hardware and software modules within the processor.

[0177] The memory may include random access memory (RAM) and may also include non-volatile memory (NVM), such as at least one disk storage device.

[0178] The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. Buses can be categorized as address buses, data buses, control buses, etc. For ease of illustration, the buses shown in the accompanying drawings are not limited to a single bus or a single type of bus.

[0179] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the above-described method.

[0180] This application also provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, implement the above-described method.

[0181] The aforementioned readable storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as Static Random-Access Memory (SRAM), Electrically Erasable Programmable Read Only Memory (EEPROM), Erasable Programmable Read-Only Memory (EPROM), Programmable Read-Only Memory (PROM), Read-Only Memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk. The readable storage medium can be any available medium accessible to a general-purpose or special-purpose computer.

[0182] An exemplary readable storage medium is coupled to a processor, enabling the processor to read information from and write information to the readable storage medium. Of course, the readable storage medium can also be a component of the processor. The processor and the readable storage medium can reside in an Application Specific Integrated Circuit (ASIC). Alternatively, the processor and the readable storage medium can exist as discrete components in the device.

[0183] The division of units is merely a logical functional division; in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be indirect coupling or communication connection through some interfaces, devices, or units, and may be electrical, mechanical, or other forms.

[0184] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0185] In addition, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0186] If a function is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to related technologies, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, ROM, random access memory (RAM), magnetic disks, or optical disks.

[0187] Those skilled in the art will understand that all or part of the steps of the above-described method embodiments can be implemented by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When executed, the program performs the steps of the above-described method embodiments; and the aforementioned storage medium includes various media capable of storing program code, such as ROM, RAM, magnetic disks, or optical disks.

[0188] Finally, it should be noted that other embodiments of this application will readily conceive of by those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of this application that follow the general principles of this application and include common knowledge or customary techniques in the art not disclosed herein, and is not limited to the precise structures described above and shown in the accompanying drawings, and various modifications and alterations may be made without departing from its scope. The scope of this application is limited only by the appended claims.

Claims

1. A terminal authentication method, characterized in that, The method is applied to a first authentication server and includes: The receiving terminal sends a first authentication request, the first authentication request including information about the network access device accessed by the terminal; In response to the first authentication request, a preset first target process matrix table is determined; wherein, the first target process matrix table includes the first interaction information between the network access device and the first authentication server; Based on the first interaction information in the first target process matrix table, determine the authentication process with the terminal; The terminal is authenticated based on the authentication process described above.

2. The method according to claim 1, characterized in that, The first interactive information includes first authentication information and second authentication information; Accordingly, determining the authentication process with the terminal based on the first interaction information in the first target process matrix table includes: The first authentication process between the first authentication server and the terminal is determined based on the first authentication information, wherein the first authentication process is the process from receiving the first authentication request to returning to the authentication page; The second authentication process between the first authentication server and the terminal is determined based on the second authentication information. The second authentication process is the process from receiving the second authentication request for login information from the terminal to returning the authentication information.

3. The method according to claim 2, characterized in that, The first authentication information includes a first target operation corresponding to the first authentication process, and the first target operation includes returning a preset authentication page to the terminal; Accordingly, the authentication of the terminal based on the authentication process includes: By performing the first target operation, the preset authentication page is sent to the terminal so that the terminal displays the authentication page.

4. The method according to claim 3, characterized in that, The second authentication information includes the second target operation corresponding to the second authentication process, and the second target operation includes generating authentication information; Accordingly, after sending the preset authentication page to the terminal, the method further includes: The terminal receives a second authentication request, wherein the second authentication request is generated by the terminal in response to the user's input operation on the login page, and the second authentication request includes login information; In response to the second authentication request, the second target operation is performed to generate authentication information for the login information; The authentication information is sent to the second authentication server so that the second authentication server can authenticate the authentication information.

5. The method according to claim 3, characterized in that, Sending the authentication information to the second authentication server includes: The authentication information is sent to the terminal, so that the terminal sends the authentication information to the network access device, so that the network access device generates a third authentication request for the authentication information and sends the third authentication request to the second authentication server.

6. The method according to any one of claims 1-5, characterized in that, Before the first authentication request sent by the receiving terminal, the following is also included: Obtain a first original authentication interaction message, wherein the first original authentication message includes the first original interaction information of the network access device; Based on the first original interaction information, the first target process matrix table is obtained.

7. A terminal authentication method, characterized in that, The method is applied to a second authentication server and includes: Receive a third authentication request sent by a network access device, wherein the third authentication request is generated by the network access device based on authentication information sent by the terminal, and includes information of the network access device; In response to the third authentication request, a preset second target process matrix table is determined; wherein the second target process matrix table includes second interaction information between the network access device and the second authentication server, wherein the second interaction information includes third authentication information; The third authentication process between the second authentication server and the terminal is determined based on the third authentication information, wherein the third authentication process is the process from receiving the third authentication request to returning the authentication result; The terminal is authenticated based on the third authentication process.

8. The method according to claim 7, characterized in that, The third authentication information includes the third target operation corresponding to the third authentication process. The third target operation includes authenticating the authentication information and returning the obtained authentication result to the terminal.

9. A computer device, characterized in that, include: Memory, processor; The memory stores computer-executed instructions; The processor executes computer execution instructions stored in the memory, causing the processor to perform the terminal authentication method as described in any one of claims 1-6 or the terminal authentication method as described in claim 7 or 8.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the terminal authentication method as described in any one of claims 1-6 or as described in claim 7 or 8.

Images