Communication connection method and device, electronic equipment and computer readable storage medium

Abstract

This application discloses a communication connection method, apparatus, electronic device, and computer-readable storage medium, belonging to the field of communication technology. The method includes: generating first network configuration information in response to a first communication connection command for a target communication network; initiating a connection to the target communication network based on the first network configuration information; during the connection process, sending multiple first authentication methods supported by the terminal to an authentication server corresponding to the target communication network, so that the authentication server determines a first target authentication method among the multiple first authentication methods to complete the first stage authentication; after completing the first stage authentication, sequentially using multiple second authentication methods of the terminal to perform a second stage authentication with the authentication server, until the second stage authentication is completed with the authentication server based on a second target authentication method among the multiple second authentication methods, thereby enabling the terminal to access the target communication network. This significantly improves the convenience and efficiency of the terminal accessing the target communication network.

Description

Technical Field

[0001] This application relates to the field of communication technology, specifically to a communication connection method, apparatus, electronic device, and computer-readable storage medium. Background Technology

[0002] Currently, WiFi (wireless network communication technology) has a variety of security authentication methods. Among them, the 802.1x EAP (Extensible Authentication Protocol) protocol, as the mainstream authentication standard for enterprise-level wireless network access, can effectively prevent unauthorized devices from accessing the network and provide strong network security protection for enterprises, campuses and various organizations.

[0003] However, currently, when connecting to enterprise-grade encrypted wireless networks using the 802.1x EAP protocol, users need to manually complete complex parameter configurations. This series of operations involves many technical terms, is cumbersome, and has a high technical threshold, making it difficult for ordinary users to understand. It is also very easy for connection failures to occur due to configuration errors, which seriously affects the user experience and connection efficiency. Summary of the Invention

[0004] This application provides a communication connection method, apparatus, electronic device, and computer-readable storage medium, which can simplify the cumbersome expert-level configuration process into a single connection command from the user, greatly reducing the barrier to entry and significantly improving the convenience and efficiency of terminal access to high-security networks.

[0005] In a first aspect, embodiments of this application provide a communication connection method applied to a terminal, the method comprising: In response to a first communication connection command for a target communication network, first network configuration information is generated; Based on the first network configuration information, a connection is initiated to the target communication network. During the connection process, multiple first authentication methods supported by the terminal are sent to the authentication server corresponding to the target communication network, so that the authentication server can determine the first target authentication method among the multiple first authentication methods to complete the first stage authentication. After completing the first stage of authentication, the terminal sequentially uses various second authentication methods to perform second stage authentication with the authentication server until it completes the second stage authentication with the authentication server based on the second target authentication method among the various second authentication methods, so that the terminal can access the target communication network.

[0006] In one embodiment, the first network configuration information includes a digital certificate, and generating the first network configuration information includes: Set the digital certificate to be trusted on first use so that the server certificate issued by the authentication server is automatically trusted during the connection process.

[0007] In one embodiment, sending the multiple first authentication methods supported by the terminal to the authentication server corresponding to the target communication network includes: When the first default authentication method included in the authentication request initiated by the authentication server is not one of the first authentication methods supported by the terminal, the terminal sends multiple first authentication methods supported by the terminal to the authentication server.

[0008] In one embodiment, the method further includes: When the first default authentication method included in the authentication request initiated by the authentication server belongs to the first authentication method supported by the terminal, the first stage of authentication is completed with the authentication server based on the first default authentication method.

[0009] In one embodiment, after completing the second-stage authentication with the authentication server based on the second target authentication method among at least two second authentication methods, the method further includes: The first target authentication method and the second target authentication method are saved as authentication parameters of the target communication network.

[0010] In one embodiment, after saving the first target authentication method and the second target authentication method as connection parameters of the target communication network, the method further includes: In response to a second communication connection command for the target communication network, second network configuration information is generated based on the authentication parameters; Based on the second network configuration information, access the target communication network.

[0011] In one embodiment, generating the first network configuration information includes: In the configuration field of the first network configuration information, the first configuration item corresponding to the first authentication method and the second configuration item corresponding to the second authentication method are set to empty values.

[0012] Secondly, embodiments of this application provide a communication connection device used in a terminal, the device comprising: The information generation module is used to generate first network configuration information in response to a first communication connection command for the target communication network; The first authentication module is used to initiate a connection to the target communication network based on the first network configuration information, and during the connection process, send multiple first authentication methods supported by the terminal to the authentication server corresponding to the target communication network, so that the authentication server determines the first target authentication method among the multiple first authentication methods to complete the first stage authentication; The second authentication module is used to perform second-stage authentication with the authentication server by sequentially using multiple second authentication methods of the terminal after completing the first-stage authentication, until the second-stage authentication is completed with the authentication server based on the second target authentication method among the multiple second authentication methods, so that the terminal can access the target communication network.

[0013] In one embodiment, the first network configuration information includes a digital certificate, and the information generation module includes: The certificate configuration submodule is used to set the digital certificate as trusted for first use, so that the server certificate issued by the authentication server is automatically trusted during the connection process.

[0014] In one embodiment, the first authentication module includes: The authentication method generation submodule is used to send multiple first authentication methods supported by the terminal to the authentication server when the first default authentication method included in the authentication request initiated by the authentication server does not belong to the first authentication methods supported by the terminal.

[0015] In one embodiment, the communication connection device further includes: The third authentication module is used to complete the first stage authentication with the authentication server based on the first default authentication method when the first default authentication method included in the authentication request initiated by the authentication server belongs to the first authentication method supported by the terminal.

[0016] In one embodiment, the communication connection device further includes: The parameter saving module is used to save the first target authentication method and the second target authentication method as authentication parameters of the target communication network.

[0017] In one embodiment, the communication connection device further includes: The second information generation module is used to generate second network configuration information based on the authentication parameters in response to a second communication connection command for the target communication network. Based on the second network configuration information, access the target communication network.

[0018] In one embodiment, the information generation module includes: The authentication method configuration submodule is used to set the first configuration item corresponding to the first authentication method and the second configuration item corresponding to the second authentication method to null values ​​in the configuration field of the first network configuration information.

[0019] Thirdly, embodiments of this application also provide an electronic device, which includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the computer program is executed by the processor, it implements the steps in the communication connection method described above.

[0020] Fourthly, embodiments of this application also provide a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps in the above-described communication connection method.

[0021] Fifthly, embodiments of this application also provide a computer program product or computer program, which includes computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the methods provided in the various optional implementations described in the embodiments of this application.

[0022] In summary, in this embodiment, the terminal can respond to a first communication connection command for the target communication network, generate first network configuration information, and initiate a connection to the target communication network based on the first network configuration information. During the connection process, the terminal sends multiple first authentication methods supported by the terminal to the authentication server corresponding to the target communication network, so that the authentication server determines the first target authentication method among the multiple first authentication methods to complete the first stage authentication. After completing the first stage authentication, the terminal sequentially uses multiple second authentication methods to perform the second stage authentication with the authentication server until the second target authentication method among the multiple second authentication methods is used to complete the second stage authentication with the authentication server, thereby enabling the terminal to access the target communication network. This completely eliminates the need for users to manually specify and select complex authentication parameters, simplifying the cumbersome expert-level configuration process to a single connection command from the user, thus greatly reducing the barrier to entry and significantly improving the convenience and efficiency of the terminal accessing a high-security network. Attached Figure Description

[0023] To more clearly illustrate the technical solutions in this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0024] Figure 1This is a flowchart illustrating a communication connection method provided in an embodiment of this application; Figure 2 This is a schematic diagram of a specific embodiment of the communication connection method provided in this application; Figure 3 This is a schematic diagram of the structure of a communication connection device provided in an embodiment of this application; Figure 4 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0025] The technical solutions of this application will now be clearly and completely described with reference to the accompanying drawings. Obviously, the described embodiments are merely some embodiments of the present invention, and not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative effort are within the scope of protection of the present invention.

[0026] It's important to note that 802.1x EAP is currently the mainstream authentication standard for enterprises, campuses, and other organizations building highly secure wireless networks. It supports multiple specific authentication methods through an authentication framework, such as EAP-PEAP (Protected Extensible Authentication Protocol) and EAP-TTLS (Tunneled Transport Layer Security). These methods typically involve two authentication phases to provide robust network security. However, its high flexibility and security also lead to significant complexity in terminal-side connection configuration. Currently, when users connect to such networks using their terminals, the system provides a configuration interface with multiple technical options. Users first need to select one supported by the network from several EAP methods; then, in the second authentication phase, they need to select the corresponding internal authentication protocol (such as MSCHAPv2 or GTC); furthermore, users must manually manage CA (Certification Authority) certificates to verify the server's identity and enter identity credentials (username) and password. This process is not only cumbersome, but each option is also difficult for non-professional users to understand. Users often face different configuration requirements due to varying network environments, leaving them helpless without network expertise and incurring extremely high learning costs. This complexity deters many ordinary users from connecting to 802.1x EAP networks, or makes them prone to errors during configuration, resulting in devices being unable to access the network. This significantly limits the ease of use and widespread adoption of this security technology on consumer devices.

[0027] To address the current issues of cumbersome operation and high technical barriers for terminals accessing high-security networks, this application aims to provide a communication connection method. This method dynamically submits all supported first-stage authentication methods to the authentication server during the connection process, achieving automatic negotiation of the first-stage authentication. After completing the first-stage authentication, the terminal actively attempts multiple second-stage authentication methods sequentially to complete the second-stage authentication. This two-stage adaptive mechanism completely eliminates the need for users to manually specify and select complex authentication parameters, simplifying the tedious expert-level configuration process into a single user connection command. This significantly lowers the barrier to entry and greatly improves the convenience and efficiency of terminal access to high-security networks.

[0028] The following sections provide detailed descriptions of each example. It should be noted that the order in which the embodiments are described is not intended to limit the priority of the embodiments.

[0029] Figure 1 The illustration shows a flowchart of a communication connection method according to an embodiment of this application. The entity executing this communication connection method can be a communication connection device, which can be integrated into any terminal device with data processing, network communication, and program execution functions. This terminal device can be a mobile terminal (such as a smartphone or tablet), a desktop terminal (such as a laptop or desktop computer), an IoT terminal (smart camera, access control system, sensor gateway), an embedded terminal (such as a POS machine, digital signage, or attendance machine), etc., but is not limited to these.

[0030] In this embodiment, the description will be from the perspective of the communication connection device. In order to facilitate the explanation of the communication connection method of this application, the following will describe the communication connection device integrated into the terminal in detail, that is, the terminal will be used as the execution subject for detailed explanation.

[0031] Reference Figure 1 The diagram shows a flowchart of a communication connection method according to this application. The method may specifically include steps S101 to S103, as follows: S101: In response to a first communication connection command for a target communication network, generate first network configuration information.

[0032] In this embodiment, the target communication network is the communication network that the terminal needs to access and that requires authentication. This target communication network can be a wireless local area network (Wi-Fi), for example, an enterprise-grade wireless local area network that uses the 802.1XEAP protocol for authentication.

[0033] In this embodiment, the first communication connection instruction refers to an instruction triggered by a user or terminal, instructing the terminal to connect to a specified target communication network. For example, a user can select a target communication network (e.g., an enterprise network with SSID "Company_802.1X") from a scanned list of Wi-Fi networks in the terminal's network settings interface, enter user credentials such as username and password as prompted by the terminal, and then click "Connect" to trigger the first communication connection instruction. Upon receiving the first communication connection instruction, the network management module in the terminal's operating system (such as the Wi-Fi service module in Android) generates first network configuration information corresponding to the target communication network.

[0034] In this embodiment, the first network configuration information refers to the internal configuration data structure generated by the terminal for this connection before initiating the connection. This first network configuration information is configuration information without specifying a first authentication method or a second authentication method. That is, the user does not need to manually configure the first and second authentication methods before connecting; they only need to enter their username and password to connect. It should be noted that the first network configuration information also includes basic parameters such as user identity credentials, network identifier, and security protocol type.

[0035] S102: Initiate a connection to the target communication network based on the first network configuration information. During the connection process, send multiple first authentication methods supported by the terminal to the authentication server corresponding to the target communication network, so that the authentication server can determine the first target authentication method among the multiple first authentication methods to complete the first stage authentication.

[0036] In this embodiment, the first authentication method refers to the type of external authentication protocol used between the terminal and the authentication server before establishing a secure transmission tunnel. For example, under the 802.1X EAP framework, this is specifically manifested as different EAP methods; for instance, the first authentication method may specifically include EAP-PEAP, EAP-TTLS, EAP-PWD, etc.

[0037] In this embodiment, the terminal can initiate an 802.1X authentication connection to the target communication network via a wireless access point (AP) based on the first network configuration information. After the connection is established, the authentication server can proactively initiate the authentication process according to the 802.1X protocol, sending a request message (e.g., an EAP-Request / Identity message) to the terminal to inquire about the terminal's identity. After the terminal replies with its identity, the authentication server will typically attempt to use one of its default configured first authentication methods (e.g., EAP-PEAP) to initiate a specific authentication method request to the terminal. At this time, the terminal will check whether the default method belongs to the list of first authentication methods supported by the terminal itself. If the default method is not within the range of the terminal's support, the terminal will not directly return an error or rejection, but will instead send a proposal list containing multiple first authentication methods supported by the terminal to the authentication server via a protocol message. For example, the terminal can send an EAP-Response message, the payload of which carries a list of EAP methods it supports, specifically including EAP-PEAP, EAP-TTLS, and EAP-PWD methods. After receiving the list, the authentication server compares it with its own set of supported methods, selects one from the intersection as the first target authentication method (e.g., EAP-TTLS), and informs the terminal of this selection via subsequent messages. Then, the terminal and authentication server execute the corresponding protocol interaction process based on the selected first target authentication method. Taking EAP-TTLS as an example, this process successfully establishes a TLS encrypted tunnel, thus completing the first stage of authentication. The first stage of authentication refers to the process by which the terminal and authentication server negotiate and execute a first authentication method supported by both parties to establish an encrypted tunnel to protect the communication security of the subsequent second authentication stage.

[0038] In this embodiment, by having the terminal actively report the multiple first authentication methods it supports, the choice of authentication method is given to the authentication server, which has a clearer understanding of the network policy. This avoids connection failures caused by preset mismatches and eliminates the need for user intervention in any technology selection process.

[0039] S103: After completing the first stage of authentication, the terminal sequentially uses various second authentication methods to perform the second stage of authentication with the authentication server until the second target authentication method among the various second authentication methods is used to complete the second stage of authentication with the authentication server, so that the terminal can access the target communication network.

[0040] In this embodiment, the second authentication method refers to the specific authentication protocol used to verify user identity credentials within the encrypted tunnel established in the first-stage authentication. Specifically, under the 802.1X EAP framework, the second authentication method may include PAP, CHAP, MSCHAP, MSCHAPv2, etc.

[0041] In this embodiment, the second-stage authentication refers to the authentication process between the terminal and the authentication server, under the protection of an encrypted tunnel, whereby a second authentication method is executed to verify the user's identity credentials in order to complete the final access authorization authentication process.

[0042] In this implementation, after the first-stage authentication successfully establishes an encrypted tunnel, the authentication server initiates a second-stage authentication request within the tunnel, requiring the terminal to provide a second authentication method for user identity credential verification. At this time, the terminal maintains a priority list of supported second authentication methods, such as PAP, CHAP, MSCHAP, and MSCHAPv2. The terminal first uses the first method (PAP) in the list, encapsulating the user's username and password in a message conforming to this method's format, and sends it to the authentication server through the encrypted tunnel. If the authentication server supports this method and the credential verification passes, the server returns an authentication success message, and this method is determined as the second target authentication method. The second-stage authentication is complete, and the terminal successfully accesses the target communication network. If the authentication server returns an error message indicating that it is not supported or that verification failed, the terminal captures the failure response and automatically switches to the next method (CHAP) in the list to try again. This process is executed cyclically along the list: trying one method, retrying the next method if it fails, until a successful attempt is made. If all methods in the list are tried unsuccessfully, it indicates that there is no compatible authentication protocol between the terminal and the server or that the user credentials are incorrect, and the connection is declared unsuccessful.

[0043] In this implementation, with the security of an encrypted tunnel already established, exhaustive compatibility negotiation can automatically discover and match the correct internal authentication protocol while ensuring security, thereby completely eliminating the user's confusion and manual configuration burden when facing the technical options involved in the second-stage authentication.

[0044] By employing the technical solution of this application embodiment, the terminal actively sends multiple supported first authentication methods to the authentication server during the connection process. The server selects a compatible first authentication method and automatically attempts multiple second authentication methods after the encrypted tunnel is established. This allows the entire complex two-stage authentication parameter negotiation process to be completed automatically by the terminal and the server. Therefore, the user only needs to trigger the first communication connection command once to complete a high-security network connection that previously required specialized knowledge to manually configure multiple technical parameters. This fundamentally eliminates the operational threshold and significantly improves the convenience, success rate, and user experience of the communication connection.

[0045] In one feasible implementation, the first network configuration information includes a digital certificate, and the step of generating the first network configuration information may specifically include: setting the digital certificate to be trusted for first use, so as to automatically trust the server certificate issued by the authentication server during the connection process.

[0046] It should be noted that a digital certificate is an electronic document used to prove the identity of a party in network communication, issued by an authoritative certificate authority. In this embodiment, the digital certificate specifically refers to a trusted root certificate or intermediate certificate pre-installed on the terminal side for verifying the identity of the authentication server, such as a root CA certificate issued by an enterprise or public CA authority.

[0047] It should be further explained that "first-time use trust" refers to a system-level certificate trust policy configuration mode. In this mode, for the first connection, the terminal automatically trusts the server certificate issued by the authentication server, regardless of whether the server certificate can be verified by the trusted certificate chain pre-installed on the terminal, and caches it as a trusted credential in local secure storage for strict verification during subsequent connections.

[0048] In one example, a user in a corporate office environment needs to connect their terminal to an encrypted Wi-Fi network deployed by the enterprise using the 802.1XEAP-PEAP protocol. After selecting the target corporate Wi-Fi network (e.g., SSID: "Enterprise_WiFi") in the terminal's Wi-Fi settings interface, the system's pop-up configuration dialog box only prompts the user for a username and password; other technical configuration items are hidden. After the user enters their credentials and clicks "Connect," the Wi-Fi network management service in the terminal's operating system receives the first communication connection command. The network management service then initializes and constructs a first network configuration information corresponding to the target communication network in memory. During the construction of this first network configuration information, the terminal automatically processes the certificate trust-related configuration items. Specifically, the terminal sets the parameter corresponding to the "CA Certificate" option to "Trust for First Use" in the configuration field.

[0049] In this embodiment, after the terminal generates the first network configuration information, it initiates an 802.1X authentication connection to the wireless access point of the target Wi-Fi network via its wireless network card. The access point, acting as an intermediate forwarding device, transparently transmits EAP messages between the terminal and the backend RADIUS authentication server. After the connection is established, both parties enter the specific EAP authentication method negotiation and tunnel establishment phase. Taking the EAP-PEAP method as an example, in this phase, the authentication server issues its own server certificate to the terminal to prove the legitimacy of its identity. In a normal connection process, the terminal would strictly verify the validity of the server certificate (including signature verification, validity period verification, certificate chain verification, etc.) based on the CA certificate specified in the configuration; if no CA certificate is configured or the configuration is incorrect, the verification fails and the connection is interrupted. However, in this embodiment, since the CA certificate field in the first network configuration information is set to "trusted for first use," upon receiving the server certificate, the callback event of certificate verification failure is intercepted, the connection is not interrupted, but the server certificate is automatically trusted, and the subsequent TLS handshake process continues. After the TLS encrypted tunnel is successfully established, the first stage of authentication is completed.

[0050] By employing the technical solution of this application embodiment, when generating the first network configuration information, the terminal actively sets the digital certificate to "trusted for first use." This enables the terminal to automatically trust and accept the server certificate issued by the authentication server during the connection process, and to perform strict verification using the cached certificate in subsequent connections. This further shields the user from the complex and difficult-to-understand process of selecting professional CA certificates, significantly reducing the technical threshold and operational complexity of the terminal's first connection to a high-security network while ensuring the fundamental security of long-term communication connections, thereby further improving the user experience.

[0051] In one feasible implementation, the step of sending multiple first authentication methods supported by the terminal to the authentication server corresponding to the target communication network may specifically include: when the first default authentication method included in the authentication request initiated by the authentication server is not a first authentication method supported by the terminal, sending multiple first authentication methods supported by the terminal to the authentication server.

[0052] In this embodiment, the authentication request is a protocol message initiated by the authentication server to the terminal to start the first phase of authentication. For example, the EAP-Request / Identity message sent by the authentication server is used to inquire about the terminal's identity, while the EAP-Request message sent by the authentication server carrying the specific EAP method type (such as EAP-TLS) is used to initiate the first phase of authentication.

[0053] In this embodiment, the first default authentication method refers to the preferred authentication method preset by the authentication server according to its own network management policy before knowing the terminal's capabilities. When initiating the first phase of authentication negotiation, the authentication server will carry the type code corresponding to the first default authentication method in the type field of the authentication request message.

[0054] In one example, a terminal, based on initial network configuration information, initiates an 802.1X connection request to the target communication network via a campus wireless access point (AP). The access point relays the terminal's authentication request to the backend authentication server. Upon receiving the connection request, the authentication server initiates the authentication process according to the 802.1X protocol. First, the authentication server sends an EAP-Request / Identity message to the terminal, requesting the terminal to report its identity. After the terminal replies with an EAP-Response / Identity message, both parties enter the specific EAP method negotiation phase. At this point, the authentication server, according to its preset policy, directly sends an EAP-Request message to the terminal with a type field specifying EAP-TLS. This message is the specific authentication request initiating the first authentication method negotiation, and the EAP-TLS carried within it is the first default authentication method. Upon receiving the EAP-Request message, the terminal parses its type field and extracts the first default authentication method (EAP-TLS). The terminal then checks its internally maintained "List of First Authentication Methods Supported by the Terminal" to see if EAP-TLS is included. After performing the lookup and comparison, it was found that EAP-TLS was not in the supported list, which means that "the first default authentication method included in the authentication request initiated by the authentication server is not one of the first authentication methods supported by the terminal". Then, multiple first authentication methods supported by the terminal were sent to the authentication server for automatic negotiation of the first stage of authentication.

[0055] In this embodiment, when the terminal receives an authentication request from the authentication server containing a first default authentication method that is not among the first authentication methods supported by the terminal, the terminal will not return a negative response message indicating direct rejection or negotiation failure to the authentication server. This is because a direct rejection would cause the connection process to be interrupted, and the user would see a connection failure result. Furthermore, the terminal would not be able to know whether other mutually compatible authentication methods exist. Instead, the terminal can send an EAP-Response message. The payload field of this message encapsulates a list of type codes corresponding to the various first authentication methods supported by the terminal, according to the protocol specification. For example, these are numerical identifiers encoded as EAP-PEAP, EAP-TTLS, and EAP-PWD, respectively. The terminal sends this message as a response to the authentication server's authentication request, thereby proactively reporting its supported first authentication methods to the authentication server.

[0056] By employing the technical solution of this application embodiment, when a terminal receives an authentication request from an authentication server that includes a first default authentication method it does not support, it does not directly return a connection failure. Instead, it proactively reports the various first authentication methods it supports to the authentication server, allowing the server to select a compatible first target authentication method from among them. This enables the terminal to complete the connection even without certain specific first authentication methods, effectively avoiding connection failures caused by inconsistencies between the server's default configuration and the terminal's capabilities, thereby improving connection robustness and success rate.

[0057] In one feasible implementation, the communication connection method may further include: when the first default authentication method included in the authentication request initiated by the authentication server belongs to the first authentication method supported by the terminal, completing the first stage authentication with the authentication server based on the first default authentication method.

[0058] In this embodiment, after receiving an authentication request from the authentication server, the terminal parses its type field and extracts the first default authentication method. Then, it searches its internally maintained list of supported first authentication methods to see if the first default authentication method is included. If the first default authentication method is found in the supported list, it is determined that the first default authentication method included in the authentication request from the authentication server is one of the first authentication methods supported by the terminal. At this point, the terminal does not need to trigger an automatic negotiation process for the first authentication method with the authentication server; instead, it directly determines the first default authentication method as the first target authentication method and follows the standard protocol specifications of this first default authentication method to perform subsequent interactions with the authentication server to complete the first stage of authentication.

[0059] By employing the technical solution of this application embodiment, when the first default authentication method initiated by the authentication server happens to be within the range supported by the terminal, the terminal does not need to perform additional method negotiation and can directly complete the first-stage authentication with the authentication server based on the first default authentication method. Thus, in scenarios where the capabilities of both parties are naturally matched, the connection process can proceed quickly with minimal interaction steps, effectively shortening the completion time of the first-stage authentication and avoiding unnecessary network interaction overhead.

[0060] In one feasible implementation, after completing the second-stage authentication with the authentication server based on the second target authentication method among at least two second authentication methods, the communication connection method may further include: saving the first target authentication method and the second target authentication method as authentication parameters of the target communication network.

[0061] In this embodiment, when the terminal successfully completes the second-stage authentication and formally accesses the target communication network, the terminal captures the connection success status change event and triggers the persistent storage process of authentication parameters.

[0062] Specifically, the terminal extracts two key negotiation result data from the memory context of the current connection session: the first is the type identifier of the first target authentication method, such as the protocol type code corresponding to EAP-TTLS or an identifier assigned internally by the terminal; the second is the type identifier of the second target authentication method, such as the protocol type code corresponding to MSCHAPv2 or an identifier assigned internally by the terminal. The terminal associates and stores these two identifiers with the SSID of the target communication network, forming a set of authentication parameter data for that specific network. Subsequently, the terminal calls the data persistence interface to write this set of authentication parameters into the network configuration database in non-volatile storage media. In the specific implementation of the Android system, this operation is manifested by assigning values ​​to the corresponding fields in the WifiConfiguration object and calling the save or update interface of WifiManager to persist the parameters to the list of saved networks maintained by the terminal.

[0063] By employing the technical solution of this application embodiment, after the terminal successfully accesses the target communication network through two-stage adaptive negotiation, it automatically saves the first and second target authentication methods that actually took effect during this connection as the authentication parameters of the network. This enables the terminal to persistently record the dynamic negotiation results of the initial connection, laying a data foundation for subsequent rapid reconnection.

[0064] In one feasible implementation, after saving the first target authentication method and the second target authentication method as connection parameters of the target communication network, the communication connection method may further include: in response to a second communication connection instruction for the target communication network, generating second network configuration information based on the authentication parameters; and accessing the target communication network based on the second network configuration information.

[0065] In this embodiment, the second communication connection instruction refers to an instruction triggered by the user or the terminal again after the terminal has successfully completed the first connection to the target communication network, instructing the terminal to connect to the same target communication network. The second communication connection instruction can be triggered by the user manually selecting the network in the Wi-Fi list and clicking connect, or by the terminal initiating an automatic connection request after detecting the saved network signal.

[0066] In one example, a user successfully connects their device to the corporate Wi-Fi network for the first time in the morning. After successful connection, the device automatically and persistently saves the first target authentication method (EAP-TTLS) and the second target authentication method (MSCHAPv2) used for this connection as authentication parameters for that network. In the afternoon, the user leaves the office for a meeting, and the device automatically disconnects from the corporate Wi-Fi network. In the evening, the user returns to the office, and the device re-enters the signal coverage area of ​​the corporate Wi-Fi network. At this time, the device's Wi-Fi module continuously performs periodic background scans, detects that the saved corporate Wi-Fi network signal strength is good, and automatically triggers a second communication connection command for the corporate Wi-Fi network. Alternatively, the user can manually select the corporate Wi-Fi network from the Wi-Fi list and click connect to trigger the second communication connection command.

[0067] In this embodiment, after receiving the second communication connection command, the terminal identifies that the target communication network already has a saved network configuration record locally, and then reads the authentication parameters associated with the target communication network from the network configuration database. Then, based on the read authentication parameters, a second network configuration information data structure is constructed in memory. Specifically, the terminal can directly assign the field of the first configuration item corresponding to the first authentication method to the saved specific value of the first target authentication method (e.g., EAP-TTLS) in the configuration field of the first network configuration information, and assign the field of the second configuration item corresponding to the first authentication method to the saved specific value of the second target authentication method (e.g., MSCHAPv2). Simultaneously, the second network configuration information also includes the SSID of the target communication network, the security type (802.1X EAP), and the username and password entered and saved by the user during the initial connection, all read from the saved record.

[0068] In this embodiment, the terminal initiates an 802.1X authentication connection to the target communication network via its wireless network card, based on the pre-constructed second network configuration information. Since the second network configuration information explicitly specifies EAP-TTLS as the first target authentication method, the terminal does not need to report a list of multiple first authentication methods to the authentication server during the authentication interaction, nor does it need to wait for the server to initiate a potentially incompatible default authentication request. Instead, it directly uses EAP-TTLS as the negotiation starting point and initiates a TLS handshake interaction with the authentication server. During the TLS handshake phase, the authentication server issues its server certificate to the terminal to prove its identity. The terminal verifies the server certificate according to its preset certificate trust policy. Since a successful connection has already been established, the server certificate may have been cached as a trusted certificate by the terminal during the initial connection, allowing the verification process to be completed quickly. After a successful TLS handshake, an encrypted tunnel is established, and the first phase of authentication is completed. Upon entering the second stage of authentication, since the second network configuration information explicitly specifies MSCHAPv2 as the second target authentication method, the terminal no longer needs to sequentially try multiple methods such as PAP, CHAP, MSCHAP, and MSCHAPv2 according to priority. Instead, it directly adopts the MSCHAPv2 method, encapsulating the username and password according to the MSCHAPv2 protocol response format to generate an authentication response message, which is then sent to the authentication server through an encrypted tunnel. Because this method (MSCHAPv2) is a valid method verified during the initial connection, the authentication server receives it, verifies the user credentials, and returns an EAP-Success message upon successful verification. The second stage of authentication is thus completed quickly.

[0069] By employing the technical solution of this application embodiment, after a successful initial connection, the terminal saves the verified first and second target authentication methods as authentication parameters for the network. When responding to a connection command for the same network again, the terminal directly generates second network configuration information based on the saved authentication parameters, thereby skipping the two-stage adaptive negotiation process required during the initial connection. This allows the terminal to quickly complete authentication via a deterministic and efficient path during subsequent reconnections, significantly reducing the number of protocol interactions and shortening reconnection time. While maintaining the convenience of zero-configuration for the initial connection, it also considers authentication efficiency in subsequent connection scenarios.

[0070] In one feasible implementation, the step of generating the first network configuration information may specifically include: setting the first configuration item corresponding to the first authentication method and the second configuration item corresponding to the second authentication method to null values ​​in the configuration field of the first network configuration information.

[0071] In this embodiment, during the construction of the first network configuration information, the terminal first sets some basic network identification parameters. Specifically, this includes: assigning the SSID field to the name identifier of the target communication network; assigning the security type field to an enumerated constant representing the 802.1X EAP protocol; and assigning the username and password entered by the user to the identity credential related fields (such as the identity and password fields).

[0072] In this embodiment, after configuring the basic network identifier parameters, the terminal enters the processing stage for the authentication method-related configuration fields. Specifically, for the first configuration item corresponding to the first authentication method, the terminal sets its value to null. For the second configuration item corresponding to the second authentication method, the terminal also sets its value to null. At this time, in the completed first network configuration information, the two core configuration fields directly related to the authentication method are both in an "unspecified" null state.

[0073] In this embodiment, after setting these two key configuration items to null values, the terminal completes the process of constructing the first network configuration information. Subsequently, this first network configuration information will serve as the initial configuration basis for initiating a connection to the target communication network.

[0074] By adopting the technical solution of this application embodiment, when the terminal generates the first network configuration information, by setting both the first configuration item corresponding to the first authentication method and the second configuration item corresponding to the second authentication method to null values, the configuration node that requires the user to make professional technical choices can be eliminated, the connection process can get rid of the dependence on the user's professional knowledge, and lay a structural foundation for the terminal and the authentication server to achieve a completely transparent and automated two-stage authentication method negotiation in the subsequent authentication process.

[0075] In one feasible implementation, refer to Figure 2 The diagram illustrates a specific embodiment of the communication connection method. Figure 2 This describes the authentication connection process for a smart terminal running an Android operating system to connect for the first time to a WiFi network encrypted with the 802.1x EAP protocol in an enterprise environment. The authentication connection process may specifically include the following steps: Step 1: The user enters their identity credentials, triggering the connection command.

[0076] In the terminal's Wi-Fi settings interface, the user discovers the enterprise Wi-Fi network "Company_802.1X" from the list of available networks, with its security type displayed as 802.1x EAP. After clicking on this network, a simplified connection configuration dialog box appears on the terminal. Unlike the traditional process, this dialog box only includes "Username" and "Password" input fields, without displaying any technical configuration options such as EAP method selection, Phase 2 authentication method selection, or CA certificate specification. The user enters their username in the username field corresponding to their enterprise domain account and their password in the password field, then clicks the "Connect" button. This click triggers the first communication connection command.

[0077] Step 2: The terminal generates the first network configuration information, in which the EAP method and Phase 2 method are not specified, and the CA certificate is configured to be trusted for first use.

[0078] After receiving the connection command triggered in step 1, the terminal's Wi-Fi network management service constructs the first network configuration information in memory. During the construction process, the terminal performs the following key operations: the first configuration item corresponding to the EAP method is set to an empty value and not specified; the second configuration item corresponding to the Phase 2 authentication method is set to an empty value and not specified; the CA certificate configuration item is set to "trust for first use" mode, that is, the terminal does not pre-specify the CA certificate, but automatically trusts the server certificate issued by the authentication server during the connection process; and the username and password entered by the user are saved in the configuration information.

[0079] After completing the above settings, the terminal will pass the first network configuration information to the underlying authentication daemon process, preparing to initiate a connection.

[0080] Step 3: First-stage certification.

[0081] Based on the initial network configuration information, the terminal initiates an 802.1X authentication connection request to the target WiFi network through the enterprise wireless access point (AP). The access point relays this request to the backend RADIUS authentication server.

[0082] After receiving a connection request, the authentication server initiates the standard 802.1X authentication process, first sending an EAP-Request / Identity message to the terminal to inquire about its identity. The terminal replies to the server with its username encapsulated in a response message. Subsequently, the authentication server, according to its own preset policy, sends an EAP-Request authentication request message to the terminal, specifying the first default authentication method. At this point, two scenarios may occur: Scenario A (Default method not supported by the terminal): If the first default authentication method initiated by the authentication server (such as EAP-TLS) is not among the terminal's supported first authentication methods (the terminal supports EAP-PEAP, EAP-TTLS, and EAP-PWD), the terminal replies to the authentication server with an EAP-Response / Nak message, which carries a list of the three EAP method types supported by the terminal. Upon receiving this list, the authentication server selects a method supported by both parties (such as EAP-TTLS) from the intersection of its capabilities and the terminal's capabilities, determining it as the first target authentication method, and informs the terminal via a new EAP-Request message. Subsequently, both parties continue the handshake process based on this first target authentication method.

[0083] Case B (default method is terminal support): If the first default authentication method initiated by the authentication server (such as EAP-PEAP) happens to be in the first authentication method list supported by the terminal, then the terminal will directly use this method to interact with the server in subsequent interactions, and this default method will be determined as the first target authentication method.

[0084] After determining the primary authentication method, the terminal and the authentication server perform a TLS handshake process according to this method (taking EAP-TTLS or EAP-PEAP as examples). During this process, the authentication server issues its server certificate to the terminal. Since the CA certificate was configured as "trusted on first use" in step 2, the terminal automatically trusts the server certificate, completes certificate verification, and successfully establishes a TLS encrypted tunnel with the server. Thus, the first phase of authentication is complete.

[0085] Step 4: Second-stage certification.

[0086] Under the protection of the TLS encrypted tunnel established in the first phase of authentication, the authentication server continues to initiate the second phase of authentication, requiring the terminal to submit user identity credentials for internal verification. The terminal initiates an automatic second-phase authentication attempt mechanism, trying various second authentication methods it supports in a preset order.

[0087] The terminal first encapsulates the username and password using the PAP method and sends them to the authentication server through an encrypted tunnel. If the authentication server does not support PAP or authentication fails, the terminal captures the failure response and automatically switches to the CHAP method to try again. If the CHAP method still fails, the terminal switches to the MSCHAP method. If that still fails, the terminal switches to the MSCHAPv2 method. When the authentication message is sent using the MSCHAPv2 method, the authentication server verifies that the username and password are correct and returns an EAP-Success message. At this point, MSCHAPv2 is selected as the second target authentication method, and the second phase of authentication is successfully completed.

[0088] If the authentication server returns a failure response after the terminal has tried all four supported authentication methods (PAP, CHAP, MSCHAP, and MSCHAPv2), it indicates that there is no compatible second authentication method between the terminal and the server, or that the user credentials are incorrect, and the connection is declared to have failed.

[0089] Step 5: Connection successful, WiFi configuration updated, save EAP method and Phase 2 method.

[0090] After successful completion of Phase 2 authentication and formal access to the target WiFi network "Company_802.1X", the terminal's Wi-Fi network management service captures the connection success event, triggering the WiFi configuration update and saving process. The terminal extracts the type identifiers of the actual effective first target authentication method (e.g., EAP-TTLS) and second target authentication method (e.g., MSCHAPv2) from the runtime data of this connection session, associates them with the current network's SSID ("Company_802.1X"), and persistently saves these verified authentication parameters to the terminal's network configuration database. Specifically, the EAP method field, which was originally set to null, is updated to the specific value of the first target authentication method, and the Phase 2 method field, which was originally set to null, is updated to the specific value of the second target authentication method.

[0091] After saving, the terminal can then use the company's WiFi network to access intranet and internet resources normally.

[0092] Step 6: Reconnect to the network.

[0093] When the user returns to the "Company_802.1X" network coverage area, the terminal detects the signal of this saved network. In response to the reconnection command (second communication connection command), the terminal reads the saved authentication parameters (first target authentication method and second target authentication method) from the network configuration database and generates second network configuration information. This second network configuration information explicitly specifies the EAP method and Phase 2 method, and is no longer null.

[0094] The terminal connects directly based on this second network configuration information, skipping the EAP negotiation and Phase 2 method trial processes. It quickly completes authentication interaction with a defined configuration, achieving efficient reconnection. No manual operation is required from the user; the terminal automatically restores the network connection in the background.

[0095] To facilitate better implementation of the communication connection method of this application, this application also provides a communication connection device based on the above-described communication connection method. The meanings of the terms used are the same as in the above-described communication connection method, and specific implementation details can be found in the descriptions of the method embodiments.

[0096] Based on the same inventive concept, and referring to Figure 3 This application provides a communication connection device 300, which is used in a terminal. The communication connection device 300 includes: Information generation module 301 is used to generate first network configuration information in response to a first communication connection command for a target communication network; The first authentication module 302 is used to initiate a connection to the target communication network based on the first network configuration information, and send multiple first authentication methods supported by the terminal to the authentication server corresponding to the target communication network during the connection process, so that the authentication server can determine the first target authentication method among the multiple first authentication methods to complete the first stage authentication. The second authentication module 303 is used to perform second-stage authentication with the authentication server by using multiple second authentication methods of the terminal in sequence after the first-stage authentication is completed, until the second-stage authentication is completed with the authentication server based on the second target authentication method among the multiple second authentication methods, so that the terminal can access the target communication network.

[0097] In one embodiment, the first network configuration information includes a digital certificate, and the information generation module 301 includes: The certificate configuration submodule is used to set digital certificates to be trusted on first use, so that server certificates issued by the authentication server are automatically trusted during the connection process.

[0098] In one embodiment, the first authentication module 302 includes: The authentication method generation submodule is used to send multiple first authentication methods supported by the terminal to the authentication server when the first default authentication method included in the authentication request initiated by the authentication server is not one of the first authentication methods supported by the terminal.

[0099] In one embodiment, the communication connection device 300 further includes: The third authentication module is used to complete the first stage of authentication with the authentication server based on the first default authentication method when the first default authentication method included in the authentication request initiated by the authentication server belongs to the first authentication method supported by the terminal.

[0100] In one embodiment, the communication connection device 300 further includes: The parameter saving module is used to save the first target authentication method and the second target authentication method as authentication parameters of the target communication network.

[0101] In one embodiment, the communication connection device 300 further includes: The second information generation module is used to generate second network configuration information based on authentication parameters in response to a second communication connection command for the target communication network. Based on the second network configuration information, access the target communication network.

[0102] In one embodiment, the information generation module includes: The authentication method configuration submodule is used to set the first configuration item corresponding to the first authentication method and the second configuration item corresponding to the second authentication method to null values ​​in the configuration fields of the first network configuration information.

[0103] By employing the technical solution of this application embodiment, the terminal actively sends multiple supported first authentication methods to the authentication server during the connection process. The server selects a compatible first authentication method and automatically attempts multiple second authentication methods after the encrypted tunnel is established. This allows the entire complex two-stage authentication parameter negotiation process to be completed automatically by the terminal and the server. Therefore, the user only needs to trigger the first communication connection command once to complete a high-security network connection that previously required specialized knowledge to manually configure multiple technical parameters. This fundamentally eliminates the operational threshold and significantly improves the convenience, success rate, and user experience of the communication connection.

[0104] Specific limitations regarding the communication connection device 300 can be found in the limitations regarding the communication connection method described above, and will not be repeated here. Each module in the aforementioned communication connection device 300 can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in hardware or independently of the processor in the computer device, or stored in software in the memory of the computer device, so that the processor can call and execute the operations corresponding to each module.

[0105] In addition, this application also provides an electronic device, such as Figure 4 As shown, it illustrates the structural diagram of the electronic device involved in this application, specifically: The electronic device may include components such as a processor 401 with one or more processing cores and a memory 402 with one or more computer-readable storage media. Those skilled in the art will understand that... Figure 4 The electronic device structure shown does not constitute a limitation on the electronic device and may include more or fewer components than shown, or combine certain components, or have different component arrangements. Wherein: The processor 401 is the control center of the electronic device. It connects various parts of the electronic device via various interfaces and lines. By running or executing software programs and / or modules stored in the memory 402, and by calling data stored in the memory 402, it performs various functions and processes data, thereby providing overall monitoring of the electronic device. Optionally, the processor 401 may include one or more processing cores; preferably, the processor 401 may integrate an application processor and a modem processor, wherein the application processor mainly handles the operating system, user interface, and applications, and the modem processor mainly handles wireless communication. It is understood that the modem processor may not be integrated into the processor 401.

[0106] The memory 402 can be used to store software programs and modules. The processor 401 executes various functional applications and data processing by running the software programs and modules stored in the memory 402. The memory 402 may mainly include a program storage area and a data storage area. The program storage area may store the operating system, application programs required for at least one function (such as sound playback function, image playback function, etc.), etc.; the data storage area may store data created according to the use of the electronic device, etc. In addition, the memory 402 may include high-speed random access memory, and may also include non-volatile memory, such as at least one disk storage device, flash memory device, or other volatile solid-state storage device. Accordingly, the memory 402 may also include a memory controller to provide the processor 401 with access to the memory 402.

[0107] In one feasible implementation, the electronic device further includes a power supply 403 that supplies power to the various components. Preferably, the power supply 403 can be logically connected to the processor 401 through a power management system, thereby enabling functions such as charging, discharging, and power consumption management through the power management system. The power supply 403 may also include one or more DC or AC power supplies, recharging systems, power equipment debugging circuits, power converters or inverters, power status indicators, and other arbitrary components.

[0108] In one feasible implementation, the electronic device may further include an input unit 404, which can be used to receive input digital or character information and generate keyboard, mouse, joystick, optical or trackball signal inputs related to user settings and function control.

[0109] Although not shown, the electronic device may also include a display unit, etc., which will not be described in detail here. Specifically, in this embodiment, the processor 401 in the electronic device loads the executable files corresponding to the processes of one or more applications into the memory 402 according to the following instructions, and the processor 401 runs the applications stored in the memory 402, thereby implementing the steps in any of the communication connection methods provided in the embodiments of this application.

[0110] Those skilled in the art will understand that Figure 4 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the electronic device to which the present application is applied. The specific electronic device may include more or fewer components than shown in the figure, or combine certain components, or have different component arrangements.

[0111] In one feasible implementation, an electronic device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the methods described in any embodiment of this application.

[0112] In one feasible implementation, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements the methods described in any embodiment of this application.

[0113] In one feasible implementation, a computer program product is also proposed, comprising a computer program or instructions that, when executed by a processor, implement the methods described in any embodiment of this application.

[0114] For details on the implementation of each of the above operations, please refer to the previous examples, which will not be repeated here.

[0115] Those skilled in the art will understand that all or part of the steps in the various methods of the above embodiments can be performed by instructions, or by instructions controlling related hardware. These instructions can be stored in a computer-readable storage medium and loaded and executed by a processor.

[0116] Therefore, this application provides a computer-readable storage medium storing a computer program that can be loaded by a processor to execute the steps in any of the communication connection methods provided in this application.

[0117] For details on the implementation of each of the above operations, please refer to the previous examples, which will not be repeated here.

[0118] The computer-readable storage medium may include: read-only memory (ROM), random access memory (RAM), disk or optical disk, etc.

[0119] Since the instructions stored in the computer-readable storage medium can execute the steps in any of the communication connection methods provided in this application, the beneficial effects that any of the communication connection methods provided in this application can achieve can be realized, as detailed in the preceding embodiments, and will not be repeated here.

[0120] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or terminal device that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or terminal device. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or terminal device that includes said element.

[0121] The foregoing has provided a detailed description of a communication connection method, apparatus, electronic device, and computer-readable storage medium provided in this application. Specific examples have been used to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only for the purpose of helping to understand the method and core ideas of the present invention. At the same time, for those skilled in the art, there will be changes in specific implementation methods and application scope based on the ideas of the present invention. Therefore, the content of this specification should not be construed as a limitation of the present invention.

Claims

1. A communication connection method, characterized in that, When applied to a terminal, the method includes: In response to a first communication connection command for a target communication network, first network configuration information is generated; Based on the first network configuration information, a connection is initiated to the target communication network. During the connection process, multiple first authentication methods supported by the terminal are sent to the authentication server corresponding to the target communication network, so that the authentication server can determine the first target authentication method among the multiple first authentication methods to complete the first stage authentication. After completing the first stage of authentication, the terminal sequentially uses various second authentication methods to perform second stage authentication with the authentication server until it completes the second stage authentication with the authentication server based on the second target authentication method among the various second authentication methods, so that the terminal can access the target communication network.

2. The communication connection method according to claim 1, characterized in that, The first network configuration information includes a digital certificate, and generating the first network configuration information includes: Set the digital certificate to be trusted on first use so that the server certificate issued by the authentication server is automatically trusted during the connection process.

3. The communication connection method according to claim 1, characterized in that, The step of sending the terminal's supported first authentication methods to the authentication server corresponding to the target communication network includes: When the first default authentication method included in the authentication request initiated by the authentication server is not one of the first authentication methods supported by the terminal, the terminal sends multiple first authentication methods supported by the terminal to the authentication server.

4. The communication connection method according to claim 3, characterized in that, The method further includes: When the first default authentication method included in the authentication request initiated by the authentication server belongs to the first authentication method supported by the terminal, the first stage of authentication is completed with the authentication server based on the first default authentication method.

5. The communication connection method according to claim 1, characterized in that, After completing the second-stage authentication with the authentication server based on the second target authentication method among at least two second authentication methods, the method further includes: The first target authentication method and the second target authentication method are saved as authentication parameters of the target communication network.

6. The communication connection method according to claim 5, characterized in that, After saving the first target authentication method and the second target authentication method as connection parameters of the target communication network, the method further includes: In response to a second communication connection command for the target communication network, second network configuration information is generated based on the authentication parameters; Based on the second network configuration information, access the target communication network.

7. The communication connection method according to claim 1, characterized in that, The generation of the first network configuration information includes: In the configuration field of the first network configuration information, the first configuration item corresponding to the first authentication method and the second configuration item corresponding to the second authentication method are set to empty values.

8. A communication connection device, characterized in that, The device, used in a terminal, includes: The information generation module is used to generate first network configuration information in response to a first communication connection command for the target communication network; The first authentication module is used to initiate a connection to the target communication network based on the first network configuration information, and during the connection process, send multiple first authentication methods supported by the terminal to the authentication server corresponding to the target communication network, so that the authentication server determines the first target authentication method among the multiple first authentication methods to complete the first stage authentication; The second authentication module is used to perform second-stage authentication with the authentication server by sequentially using multiple second authentication methods of the terminal after completing the first-stage authentication, until the second-stage authentication is completed with the authentication server based on the second target authentication method among the multiple second authentication methods, so that the terminal can access the target communication network.

9. An electronic device, characterized in that, It includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the communication connection method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the steps of the communication connection method as described in any one of claims 1 to 7.

Images