CN104144163B - Auth method, apparatus and system - Google Patents

Auth method, apparatus and system Download PDF

Info

Publication number
CN104144163B
CN104144163B CN201410355373.0A CN201410355373A CN104144163B CN 104144163 B CN104144163 B CN 104144163B CN 201410355373 A CN201410355373 A CN 201410355373A CN 104144163 B CN104144163 B CN 104144163B
Authority
CN
China
Prior art keywords
target access
access
terminal
verification result
sent
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active
Application number
CN201410355373.0A
Other languages
Chinese (zh)
Other versions
CN104144163A (en
Inventor
陈健
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Tencent Technology Shenzhen Co Ltd
Original Assignee
Tencent Technology Shenzhen Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Tencent Technology Shenzhen Co Ltd filed Critical Tencent Technology Shenzhen Co Ltd
Priority to CN201410355373.0A priority Critical patent/CN104144163B/en
Publication of CN104144163A publication Critical patent/CN104144163A/en
Application granted granted Critical
Publication of CN104144163B publication Critical patent/CN104144163B/en
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Landscapes

  • Information Transfer Between Computers (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

The invention discloses a kind of auth methods, apparatus and system, belong to radio network technique field.Method includes: to obtain terminal to log in the user identifier of specified application and the access-in point information of target access;Checking request is sent to access point server, so that access point server verifies checking request, checking request carries user identifier and access-in point information;When checking request passes through verifying, the verification result that access point server returns is received, target access is transmitted verification result to, is established and is communicated to connect with terminal after receiving verification result by target access.User identifier and access-in point information are sent to specified application server by target access of the present invention, checking request is sent from specified application server to access point server, due to being verified to user identifier, so can guarantee the legitimacy of user, the probability for reducing illegal user's invasion, improves the efficiency of operation and operation cost of target access.

Description

Auth method, apparatus and system
Technical field
The present invention relates to radio network technique field, in particular to a kind of auth method, apparatus and system.
Background technique
The fast development of radio network technique is surfed the Internet whenever and wherever possible for people and is provided a great convenience.When terminal with connect After access point establishes communication connection, user is convenient to carry out the operation such as web page access, video-see by terminal.Further, Illegal user occupies wireless network resource in order to prevent, establishes just cascade according to the link information and access point of access point in terminal After connecing, it is necessary to be verified to user identity.Only after user is by authentication, just user is permitted to send out by terminal The operation such as web page access is played, the user of specification wireless network is carried out with this.And in the prior art, when terminal is according to access point Link information and access point establish after primary connect, user can carry out web page access, video-see etc. by terminal and operate, This undoubtedly increases the probability that illegal user invades wireless network, and a large amount of wireless network resource is caused to be occupied by illegal user.
Summary of the invention
In order to solve problems in the prior art, the embodiment of the invention provides a kind of auth methods, apparatus and system. The technical solution is as follows:
In a first aspect, providing a kind of auth method, which comprises
Target access receives the access-in point information of the user identifier that terminal is sent and target access, the user identifier The mark of specified application is logged in for the terminal, and the SSID of the target access is included at least in described access point information (Service Set Identifier, service set);
The user identifier and described access point information are sent to specified application server by the target access, described Specified application server is to provide the server of service for the specified application;
The specified application server sends checking request to access point server, carries the use in the checking request Family mark and described access point information;
Described access point server verifies the checking request;If the checking request passes through verifying, institute It states terminal and the target access is established and communicated to connect.
Second aspect provides a kind of auth method, is applied to specified application server, which comprises
It obtains terminal and logs in the user identifier of specified application and the access-in point information of target access;
Checking request is sent to access point server, so that described access point server tests the checking request Card, the checking request carry the user identifier and described access point information;
When the checking request passes through verifying, the verification result that described access point server returns is received, is tested described Card result is sent to the target access, is built after receiving the verification result with the terminal by the target access Vertical communication connection.
The third aspect provides a kind of authentication means, is applied to specified application server, and described device includes:
Data obtaining module logs in the user identifier of specified application and the access point letter of target access for obtaining terminal Breath;
Checking request sending module, for sending checking request to access point server, so that described access point server The checking request is verified, the checking request carries the user identifier and described access point information;
Verification result receiving module is returned for when the checking request passes through verifying, receiving described access point server The verification result returned, is sent to the target access for the verification result, by the target access receive it is described It establishes and communicates to connect with the terminal after verification result.
Fourth aspect provides a kind of authentication system, and the system comprises terminal, target access, specified applications Server and access point server;
The target access, for receiving the user identifier of terminal transmission and the access-in point information of target access, institute Stating user identifier is the mark that the terminal logs in specified application, includes at least the target access in described access point information SSID;
The target access, for the user identifier and described access point information to be sent to specified application service Device, the specified application server are to provide the server of service for the specified application;
The specified application server carries in the checking request for sending checking request to access point server The user identifier and described access point information;
Described access point server, for being verified to the checking request;If the checking request passes through verifying, Then the terminal and the target access, which are established, communicates to connect.
Technical solution provided in an embodiment of the present invention has the benefit that
Target access marks user after the access-in point information for receiving user identifier and target access that terminal is sent Know and access-in point information is sent to specified application server, sends verifying to access point server from specified application server and ask Ask, if checking request, by the verifying of access point server, terminal and target access are established and are communicated to connect, due to Family mark is verified, so can guarantee the legitimacy of user, reduces the probability of illegal user's invasion, improves target access The efficiency of operation and operation cost of point;In addition, user identifier access point link information is sent to access by specified application server Point server, so communication process can be made more safe and reliable.
Detailed description of the invention
To describe the technical solutions in the embodiments of the present invention more clearly, make required in being described below to embodiment Attached drawing is briefly described, it should be apparent that, drawings in the following description are only some embodiments of the invention, for For those of ordinary skill in the art, without creative efforts, it can also be obtained according to these attached drawings other Attached drawing.
Fig. 1 is a kind of configuration diagram of Radio Network System provided in an embodiment of the present invention;
Fig. 2 is a kind of flow chart of auth method provided in an embodiment of the present invention;
Fig. 3 is a kind of flow chart of auth method provided in an embodiment of the present invention;
Fig. 4 is a kind of flow chart of auth method provided in an embodiment of the present invention;
Fig. 5 is a kind of structural schematic diagram of authentication means provided in an embodiment of the present invention;
Fig. 6 is a kind of structural schematic diagram of server provided in an embodiment of the present invention.
Specific embodiment
To make the object, technical solutions and advantages of the present invention clearer, below in conjunction with attached drawing to embodiment party of the present invention Formula is described in further detail.
Referring to Fig. 1, auth method provided in an embodiment of the present invention is applied to the Radio Network System in Fig. 1.The nothing In line network system include terminal (intelligent mobile terminal), target access and positioned at network side specified application server and connect Enter point server.Wherein, terminal is used to scan the pattern identification (for example, two dimensional code) of target access, uploads and logs in specified answer The access-in point information of user identifier and target access.Target access, in the user's mark for receiving terminal transmission After knowing the access-in point information with target access, the user identifier and access-in point information are sent to specified application server;Refer to Determining application server is to provide the server of service for specified application, and for sending checking request to access point server, this is tested The user identifier and access-in point information are carried in card request;Access point server, for testing specified application server transmission Card request is verified;If the checking request is established and is communicated to connect by verifying, terminal and target access.In communication link After connecing foundation, user can carry out the operation such as web page access, video-see.If the checking request is unverified, wireless network It will always be in hanging death situation state, user can not carry out the operation such as network access or video-see by the wireless network.
Fig. 2 is a kind of flow chart of auth method provided in an embodiment of the present invention.Being executed with authentication system should For the angle of method, referring to fig. 2, method flow provided in an embodiment of the present invention includes:
201, target access receives the access-in point information of user identifier and target access that terminal is sent, user identifier The mark of specified application is logged in for terminal, and the SSID of target access is included at least in access-in point information.
202, user identifier and access-in point information are sent to specified application server by target access, specify application service Device is to provide the server of service for specified application.
203, specify application server to send checking request to access point server, carry in checking request user identifier and Access-in point information.
204, access point server verifies checking request;If checking request passes through verifying, terminal and target Access point establishes communication connection.
Method provided in an embodiment of the present invention, target access is in the user identifier and target access for receiving terminal transmission Access-in point information after, user identifier and access-in point information are sent to specified application server, from specified application server to Access point server sends checking request, if checking request is accessed by the verifying of access point server, terminal and target Point establishes communication connection, due to verifying to user identifier and access-in point information, so can guarantee the legitimacy of user, reduces The probability of illegal user's invasion, improves the efficiency of operation and operation cost of target access;In addition, user identifier access point Link information is sent to access point server by specified application server, so communication process can be made more safe and reliable.
Optionally, user identifier and access-in point information are sent to specified application server by target access, comprising:
The verification information of user identifier, the SSID of target access and target access is sent to specified application service Device;
Wherein, the verification information of target access is generated by target access, and carries the access point letter sent in terminal In breath.
Optionally, access point server verifies checking request, comprising:
The verification information of target access is verified;If the verification information of target access passes through verifying, mesh Tag splice access point is legal;
User identifier is verified according to the SSID of target access;If user identifier passes through verifying, user's mark It is legal to know corresponding user;
When target access is legal and user is legal, user passes through authentication.
Optionally, after access point server verifies checking request, method further include:
If checking request returns to the first verification result to specified application server by verifying, access point server, It include entry address information in first verification result;
First verification result is sent to target access by specified application server, and target access is tested receiving first It is communicated to connect after demonstrate,proving result with terminal foundation, and the first verification result is sent to terminal;
Terminal sends logging request to target access after receiving the first verification result, according to entry address information, So that target access logins successfully information after receiving logging request, to terminal return.
Optionally, after access point server verifies checking request, this method further include:
If checking request returns to the second verification result to specified application server by verifying, access point server, It include log duration information in second verification result;
Second verification result is sent to target access by specified application server, and target access is tested receiving second It is communicated to connect after demonstrate,proving result with terminal foundation, and the second verification result is sent to terminal;
Terminal shows the second verification result after receiving the second verification result.
Optionally, after access point server verifies checking request, this method further include:
If checking request returns to third verification result to specified application server by verifying, access point server, It include publishing address information in third verification result;
Third verification result is sent to target access by specified application server, and target access is tested receiving third It is communicated to connect after demonstrate,proving result with terminal foundation, and third verification result is sent to terminal;
Terminal publishes request to target access transmission after receiving third verification result, according to address information is published, So that target access disconnects after receiving and publishing request with terminal.
Optionally, before target access receives the user identifier of terminal transmission and the access-in point information of target access, This method further include:
Terminal scans the pattern identification of target access, obtains the access point password of target access;
Terminal is established primary with target access according to access point password and is connect.
All the above alternatives can form alternative embodiment of the invention using any combination, herein no longer It repeats one by one.
Fig. 3 is a kind of flow chart of auth method provided in an embodiment of the present invention.It is executed with specified application server For the angle of this method, referring to Fig. 3, method flow provided in an embodiment of the present invention includes:
301, it obtains terminal and logs in the user identifier of specified application and the access-in point information of target access.
302, checking request is sent to access point server to test so that access point server verifies checking request Card request carries user identifier and access-in point information.
303, when checking request passes through verifying, the verification result that access point server returns is received, verification result is sent out Target access is given, is established and is communicated to connect with terminal after receiving verification result by target access.
Method provided in an embodiment of the present invention, target access is in the user identifier and target access for receiving terminal transmission Access-in point information after, user identifier and access-in point information are sent to specified application server, from specified application server to Access point server sends checking request, if checking request is accessed by the verifying of access point server, terminal and target Point establishes communication connection, due to verifying to user identifier and access-in point information, so can guarantee the legitimacy of user, reduces The probability of illegal user's invasion, improves the efficiency of operation and operation cost of target access;In addition, user identifier access point Link information is sent to access point server by specified application server, so communication process can be made more safe and reliable.
Optionally, it obtains terminal and logs in the user identifier of specified application and the access-in point information of target access, comprising:
The verifying field that target access generates is obtained, using verifying field as the verification information of target access;
Receive the SSID and user identifier of the target access that target access is sent, the SSID and user of target access Mark is sent to target access by terminal.
Optionally, after receiving the verification result that access point server returns, this method further include:
The first verification result is sent to terminal by target access, includes that entry address is believed in the first verification result Breath sends logging request to target access according to entry address information from terminal, so that target access is receiving login After request, information is logined successfully to terminal return.
Optionally, after receiving the verification result that access point server returns, this method further include:
The second verification result is sent to terminal by target access, so that terminal is receiving the second verification result Afterwards, the second verification result is shown;
It wherein, include log duration information in the second verification result.
Optionally, after receiving the verification result that access point server returns, this method further include:
Third verification result is sent to terminal by target access, includes publishing address letter in third verification result Breath publishes request according to publishing address information and send to target access from terminal, so that target access is published receiving After request, disconnects and communicating to connect with terminal.
All the above alternatives can form alternative embodiment of the invention using any combination, herein no longer It repeats one by one.
Fig. 4 is a kind of flow chart of auth method provided in an embodiment of the present invention.Interaction agent is terminal, target connects Access point, specified application server and access point server.Referring to fig. 4, method flow provided in an embodiment of the present invention includes:
401, target access receives the access-in point information of user identifier and target access that terminal is sent, user identifier The mark of specified application is logged in for terminal, and the SSID of target access is included at least in access-in point information.
Wherein, application is specified to have the function of that scanning patter identifies (for example, two dimensional code).User, which logs in specified application, needs thing First pass through user's registration.After being registered, terminal can log in specified application according to the log-on message of registration.The present invention is implemented User identifier in example just refers to the login name in the log-on message.
When terminal is located in the wireless network coverage of target access, user can scan mesh by the specified application Tag splice access point and be located at pattern identification supporting body on pattern identification.Wherein, pattern identification supporting body can be target access Surface, be pasted onto print paper of the target access nearby on object etc., the embodiment of the present invention is to pattern identification supporting body Type be not especially limited.The target access owner is after obtaining the pattern identification of target access, by the pattern identification It is placed on pattern identification supporting body.After scanning the pattern identification, terminal obtains the SSID and access point password of target access. Primary connection is set up according to the access point crypto terminal and target access.
After primary connection is established, in order to enable conjunction of the access point server clearly to which access point in subsequent process Method carries out verifying and which user to carry out authentication to, so terminal need to be accessed by user identifier and including at least target The access-in point information of the SSID of point is uploaded to target access.Wherein, except the SSID including target access in access-in point information Outside, it may also include other information.For example, the generation time etc. of access-in point information, the embodiment of the present invention is to access point packet The content included is without specifically limiting.
In embodiments of the present invention, terminal is in the access point letter for sending user identifier and target access to target access When breath, transparent transmission can be carried out by website links.For example, any website links www.abc.com of terminal access, then in the network address chain Connect to target access initiate access request when, can by the SSID of user identifier and target access carry in the access request In, to achieve the purpose that the access-in point information for sending user identifier and target access to target access.
402, user identifier and access-in point information are sent to specified application server by target access, specify application service Device is to provide the server of service for specified application.
In embodiments of the present invention, target access is being incited somebody to action after receiving the SSID of user identifier and target access The SSID of user identifier and target access is transmitted to before specified application server, will additionally generate the verifying letter of target access Breath, and the verification information of the target access is carried in access-in point information.Wherein, why this step generates target access The verification information of point is because subsequent access point server, will also be to target when carrying out authentication in the embodiment of the present invention The legitimacy of access point is verified, and is threatened with eliminating or alleviating the rogue access point bring of invader's installation.
Continue step 401 in example for, then target access after receiving the access request of www.abc.com, It will do it 302 addresses to jump.In the jump procedure of address, target access generates auth verifying field according to assignment algorithm, and The auth verifying field is encrypted.Later, the auth verifying field of encryption is carried to the target access passed at the terminal Access-in point information in.So far, it is connect in the access-in point information of target access including at least the SSID of target access and target The verification information of access point.By user identifier.The SSID of target access and the verification information of target access are sent to specified When application server, it can take and three is subjected to the mode retransmited after compression packing, can also take and directly send out three Which kind of sending method is the mode sent specifically take, and the present invention is not especially limit this.In addition, target access is raw It can refer to existing auth verification algorithm at the mode of auth verifying field and realize that details are not described herein again.
Wherein, specified application server is to provide the server of service for specified application.For example, when specified application is microblogging In application, specified application server is micro blog server;When specified application is wechat in application, specified application server is wechat Server.
403, it specifies application server to send checking request to access point server, carries user identifier in the checking request And access-in point information.
In embodiments of the present invention, specify application server in the user identifier and access for receiving target access upload After point information (SSID and verification information including target access), verifying can be generated according to user identifier and access-in point information and asked It asks, and sends the checking request to access point server, to complete authentication.Further, since checking request is by specified application Server is sent to access point server, rather than is sent from specified application to access point server, is communicated so can guarantee Cheng Gengjia is safe and reliable.
Wherein, other information can also be carried in addition to carrying user identifier and access-in point information in checking request.For example, Hasphone mark, the mark refer to whether user has retained telephone number, the embodiment of the present invention when being registered to specified application To checking request carry content without specifically limiting.
404, access point server verifies checking request;If checking request is thened follow the steps by verifying 405。
In embodiments of the present invention, access point server is after receiving the checking request that specified application server is sent, Just the checking request is verified.When verifying to the checking request, the legitimacy for carrying out target access respectively is tested The legitimate verification of card and user.
When the legitimacy to target access is verified, takes and the verification information of target access is verified Mode.Since target access is after generating auth verifying field, auth verifying field is encrypted, so to target When the verification information of access point is verified, also need that decipherment algorithm corresponding with Encryption Algorithm is first taken to verify the auth of encryption Field is decrypted, and obtains auth verifying field.After obtaining auth verifying field, auth verifying field is verified.Than Such as, the type and length of auth verifying field are verified;If the type and length of auth verifying field meet the requirements, For auth verifying field by verifying, target access is legal.It is required if the type and length violation of auth verifying field are closed, Auth verifying field is unverified, and target access is illegal, and process flow ends here.
When the legitimacy to user is verified, the mode verified to user identifier is taken.Implement in the present invention In example, the corresponding relationship between each access point and user identifier can be stored in access point server.That is, to access point service For each access point of device institute compass of competency, server, which can store, was once successfully established communication connection with each access point The corresponding user identifier of terminal.It, can be first according to specified when the user identifier sent to specified application server is verified The SSID for the target access that application server is sent, the mapping table between the access point and user identifier being previously stored In, search whole user identifiers corresponding to the SSID;Later, determine user identifier that specified application server is sent whether with Any of corresponding whole user identifiers of the SSID match;If user identifier and be somebody's turn to do that specified application server is sent Any of corresponding whole user identifiers of SSID match, then the user identifier for specifying application server to send is by testing Card, the corresponding user of the user identifier are legal.
In addition, if appointing in user identifier whole user identifiers corresponding with the SSID that specified application server is sent One mismatches, then the user identifier that can be sent according to specified application server generates user characteristic data inquiry request, and The user characteristic data inquiry request is sent to specified application server, and specified application server is receiving user spy After levying data inquiry request, pulled from pre-stored mass users characteristic according to the user characteristic data inquiry request Corresponding user characteristic data, and the user characteristic data is returned into access point server.Wherein, user characteristic data includes But be not limited to individual subscriber attribute information, user ascription area information, customer flow service condition etc..
Access point server judges whether the user characteristic data meets and presets after receiving user characteristic data Condition of contact.For example, whether user's nearest week is less than threshold value using flow.If user characteristic data satisfaction is set in advance The condition of contact set, the then user identifier for judging that specified application server is sent pass through verifying, the corresponding user of the user identifier It is legal;If user characteristic data meets pre-set condition of contact, user's mark that specified application server is sent is judged Know unverified, the corresponding user of the user identifier is illegal, and process flow ends here.
It should be noted that access point server is after being verified checking request, it will usually Xiang Zhiding application service Device returns to some verification results including log-on message, target access geographic location, to provide convenience for user's online. Detailed process is referring to following step 405 to step 407.
405, access point server returns to the first verification result to specified application server, includes stepping in the first verification result Record address information.
In embodiments of the present invention, entry address information is shaped like " login ": " http: // 192.168.60.1:3990/ Logon? the character string of key=QgYnkgYSBwZXJzZXZlcmFuY2Ugb2YgZGVsaWdodCBpbiB0aG ".Certainly, it steps on Address information is recorded in addition to above-mentioned form, other forms also may be present, the embodiment of the present invention is to this without specifically limiting.
406, specify application server that the first verification result is sent to target access, target access is receiving the It establishes and communicates to connect with terminal after one verification result, and the first verification result is sent to terminal.
In embodiments of the present invention, specify application server after the first verification result is sent to target access, mesh Tag splice access point and terminal, which are established, to be communicated to connect.After target access and terminal establish communication connection, user can carry out webpage The operation such as access, video-see.In addition, target access is after receiving the first verification result, in order to enable terminal is according to Entry address information in one verification result is logged in, and target access also needs the first verification result being transmitted to terminal.
407, terminal sends to log in and ask according to entry address information after receiving the first verification result to target access It asks, so that target access logins successfully information after receiving logging request, to terminal return.
In embodiments of the present invention, terminal will send a shape after receiving the first verification result to target access As " http: // 192.168.60.1:3990/logon? key=QgYnkgYSBwZXJzZXZlcmFuY2Ugb2YgZGVsaWd The get of odCBpbiB0aG " is requested.And target access will send a shape after receiving get request to target access As " http://wae.wiwide.com/portal/? res=success& " login successfully information.Wherein, res= Success expression logins successfully.This is being logined successfully information after display interface is shown by terminal, and user can know end End can currently carry out the operation such as web page access or video-see.
In addition, above-mentioned steps 405 to step 407 can also be substituted by following step a1 to step c1.Detailed process is as follows:
Step a1, access point server returns to the second verification result to specified application server, wraps in the second verification result Include log duration information.
In embodiments of the present invention, log duration information is used to indicate that this to connect the online duration of allowed user, Shaped like " " allow_seconds ": character string 1800 ".Certainly, other also may be present in addition to above-mentioned form in log duration information Form, the embodiment of the present invention is to this without specifically limiting.
Step b1, the second verification result is sent to target access by specified application server, and target access is receiving It establishes and communicates to connect with terminal after to the second verification result, and the second verification result is sent to terminal.
Similarly with above-mentioned steps 406, details are not described herein again for the step.
Step c1, terminal shows the second verification result after receiving the second verification result.
After receiving the second verification result, terminal in the display interface shows the second verification result, to use This clear online duration of family, rationally carries out online arrangement according to the online duration.
In addition, above-mentioned steps 405 can also be substituted to step 407 by following step a2 to step c2.Detailed process is as follows:
Step a2, access point server returns to third verification result to specified application server, wraps in third verification result It includes and publishes address information.
In embodiments of the present invention, entry address information is shaped like " logout ": " http: // 192.168.60.1:3990/ The character string of logoff ".Certainly, address information is published in addition to above-mentioned form, and other forms, the embodiment of the present invention pair also may be present This is without specifically limiting.
Step b2, third verification result is sent to target access by specified application server, and target access is receiving It establishes and communicates to connect with terminal after to third verification result, and third verification result is sent to terminal.
Similarly with above-mentioned steps 406, details are not described herein again for the step.
Step c2, terminal is stepped on according to address information is published to target access transmission after receiving third verification result It requests out, so that target access disconnects after receiving and publishing request with terminal.
In embodiments of the present invention, terminal is after receiving third verification result, and in the follow-up process, terminal can be according to stepping on Address information publishes request to target access transmission out, so that target access after receiving and publishing request, is broken with terminal Open connection.Similarly with above-mentioned steps 407, details are not described herein again for the step.
It should be noted that log duration information and publish address information can also be carried along the with entry address information In one verification result.Terminal is receiving including entry address information, log duration information and is publishing the first of address information and test After demonstrate,proving result, a get request will be sent to target access according to entry address information.It is returned receiving target access Login successfully information after, can surf the Internet.Meanwhile showing log duration information, so that the clear current connection of user is permitted Perhaps how long surf the Internet.When user wants to disconnect network connection, also one can be sent to target access according to address information is published A get request.And target access will be switched off the communication connection with terminal after receiving get request.
Method provided in an embodiment of the present invention, target access is in the user identifier and target access for receiving terminal transmission Access-in point information after, user identifier and access-in point information are sent to specified application server, from specified application server to Access point server sends checking request, if checking request is accessed by the verifying of access point server, terminal and target Point establishes communication connection, due to verifying to user identifier and access-in point information, so can guarantee the legitimacy of user, reduces The probability of illegal user's invasion, improves the efficiency of operation and operation cost of target access;In addition, user identifier access point Link information is sent to access point server by specified application server, so communication process can be made more safe and reliable.
Fig. 5 is a kind of authentication means provided in an embodiment of the present invention, is applied to specified application server.Referring to Fig. 5, The device includes: data obtaining module 501, checking request sending module 502, verification result receiving module 503.
Wherein, the user identifier and target access applied are specified for obtaining terminal login in data obtaining module 501 Access-in point information;Checking request sending module 502 is connect with data obtaining module 501, for testing to access point server transmission Card request, so that access point server verifies checking request, checking request carries user identifier and access-in point information;It tests Card result receiving module 503 is connect with data obtaining module 501, for when checking request passes through verifying, receiving access point clothes The verification result that business device returns, transmits verification result to target access, by target access after receiving verification result It establishes and communicates to connect with terminal.
Optionally, data obtaining module, for obtaining the verifying field of target access generation, using verifying field as mesh The verification information of tag splice access point;Receive the SSID and user identifier of the target access that target access is sent, target access SSID and user identifier target access is sent to by terminal.
Optionally, verification result receiving module is also used to that the first verification result is sent to terminal by target access, Include entry address information in first verification result, sends to log in target access according to entry address information from terminal and ask It asks, so that target access logins successfully information after receiving logging request, to terminal return.
Optionally, verification result receiving module is also used to that the second verification result is sent to terminal by target access, So that after receiving the second verification result, the second verification result is shown for terminal;Wherein, include in the second verification result Log duration information.
Optionally, verification result receiving module is also used to that third verification result is sent to terminal by target access, Include publishing address information in third verification result, is published and asked according to publishing address information and sent to target access from terminal It asks, so that target access after receiving and publishing request, is disconnected with terminal and being communicated to connect.
Device provided in an embodiment of the present invention, target access is in the user identifier and target access for receiving terminal transmission Access-in point information after, user identifier and access-in point information are sent to specified application server, from specified application server to Access point server sends checking request, if checking request is accessed by the verifying of access point server, terminal and target Point establishes communication connection, due to verifying to user identifier and access-in point information, so can guarantee the legitimacy of user, reduces The probability of illegal user's invasion, improves the efficiency of operation and operation cost of target access;In addition, user identifier access point Link information is sent to access point server by specified application server, so communication process can be made more safe and reliable.
The embodiment of the invention provides a kind of authentication system, which includes terminal, target access, specified application Server and access point server;
Target access, for receiving the user identifier of terminal transmission and the access-in point information of target access, Yong Hubiao Knowing is that terminal logs in the specified mark applied, and the SSID of target access is included at least in access-in point information;
Target access specifies application clothes for user identifier and access-in point information to be sent to specified application server Business device is to provide the server of service for specified application;
Specified application server carries user identifier in checking request for sending checking request to access point server And access-in point information;
Access point server, for being verified to checking request;If checking request passes through verifying, terminal and target Access point establishes communication connection.
Optionally, target access, for believing the verifying of the SSID of user identifier, target access and target access Breath is sent to specified application server;
Wherein, the verification information of target access is generated by target access, and carries the access point letter sent in terminal In breath.
Optionally, access point server is verified for the verification information to target access;If target access Verification information by verifying, then target access is legal;User identifier is verified according to the SSID of target access;Such as Fruit user identifier is by verifying, then the corresponding user of user identifier is legal;When target access is legal and user is legal, user Pass through authentication.
Optionally, access point server, for when checking request passes through verifying, Xiang Zhiding application server to return to first Verification result includes entry address information in the first verification result;First verification result is sent to mesh by specified application server Tag splice access point, target access are established with terminal after receiving the first verification result and are communicated to connect, and by the first verification result It is sent to terminal;Terminal sends to log in and ask according to entry address information after receiving the first verification result to target access It asks, so that target access logins successfully information after receiving logging request, to terminal return.
Optionally, access point server, for when checking request passes through verifying, Xiang Zhiding application server to return to second Verification result includes log duration information in the second verification result;Second verification result is sent to mesh by specified application server Tag splice access point, target access are established with terminal after receiving the second verification result and are communicated to connect, and by the second verification result It is sent to terminal;Terminal shows the second verification result after receiving the second verification result.
Optionally, access point server, for when checking request passes through verifying, Xiang Zhiding application server to return to third Verification result includes publishing address information in third verification result;Third verification result is sent to mesh by specified application server Tag splice access point, target access are established with terminal after receiving third verification result and are communicated to connect, and by third verification result It is sent to terminal;Terminal is published and is asked to target access transmission according to address information is published after receiving third verification result It asks, so that target access disconnects after receiving and publishing request with terminal.
Optionally, terminal obtains the access point password of target access for scanning the pattern identification of target access; Primary is established with target access according to access point password to connect.
System provided in an embodiment of the present invention, target access is in the user identifier and target access for receiving terminal transmission Access-in point information after, user identifier and access-in point information are sent to specified application server, from specified application server to Access point server sends checking request, if checking request is accessed by the verifying of access point server, terminal and target Point establishes communication connection, due to verifying to user identifier and access-in point information, so can guarantee the legitimacy of user, reduces The probability of illegal user's invasion, improves the efficiency of operation and operation cost of target access;In addition, user identifier access point Link information is sent to access point server by specified application server, so communication process can be made more safe and reliable.
Fig. 6 is a kind of server shown according to an exemplary embodiment, which can be used for implementing any of the above-described Function performed by application server is specified in auth method shown in exemplary embodiment.Specifically: referring to Fig. 6, The server 600 can generate bigger difference because configuration or performance are different, may include one or more centres Reason device (Central Processing Unit, CPU) 622 (for example, one or more processors) and memory 632, one (such as one or more mass memories of storage medium 630 of a or more than one storage application program 642 or data 644 Equipment).Wherein, memory 632 and storage medium 630 can be of short duration storage or persistent storage.It is stored in storage medium 630 Program may include one or more modules (diagram does not mark).
Server 600 can also include one or more power supplys 626, one or more wired or wireless networks Interface 650, one or more input/output interfaces 658, and/or, one or more operating systems 641, such as Windows ServerTM, Mac OS XTM, UnixTM, LinuxTM, FreeBSDTM etc..
One perhaps more than one program be stored in memory and be configured to by one or more than one processor It executes, one or more than one program include the instruction for performing the following operation:
It obtains terminal and logs in the user identifier of specified application and the access-in point information of target access;
Checking request is sent to access point server, so that access point server verifies checking request, verifying is asked It asks and carries user identifier and access-in point information;
When checking request passes through verifying, the verification result that access point server returns is received, is transmitted verification result to Target access is established with terminal after receiving verification result by target access and is communicated to connect.
Assuming that above-mentioned is the first possible embodiment, then provided based on the first possible embodiment Second of possible embodiment in, also include instructions for performing the following operations:
The verifying field that target access generates is obtained, using verifying field as the verification information of target access;
Receive the SSID and user identifier of the target access that target access is sent, the SSID and user of target access Mark is sent to target access by terminal.
In the third the possible embodiment provided based on the first possible embodiment, also comprising using In the instruction for executing following operation:
The first verification result is sent to terminal by target access, includes that entry address is believed in the first verification result Breath sends logging request to target access according to entry address information from terminal, so that target access is receiving login After request, information is logined successfully to terminal return.
In the 4th kind of possible embodiment provided based on the first or the third possible embodiment, Also include instructions for performing the following operations:
The second verification result is sent to terminal by target access, so that terminal is receiving the second verification result Afterwards, the second verification result is shown;
It wherein, include log duration information in the second verification result.
In the 5th kind of possible embodiment provided based on the first possible embodiment, also comprising using In the instruction for executing following operation:
Third verification result is sent to terminal by target access, includes publishing address letter in third verification result Breath publishes request according to publishing address information and send to target access from terminal, so that target access is published receiving After request, disconnects and communicating to connect with terminal.
Server provided in this embodiment, target access is in the user identifier and target access for receiving terminal transmission After access-in point information, user identifier and access-in point information are sent to specified application server, from specified application server to connecing Enter point server and send checking request, if checking request passes through the verifying of access point server, terminal and target access Communication connection is established, due to being verified to user identifier and access-in point information, so can guarantee the legitimacy of user, is reduced The probability of illegal user's invasion, improves the efficiency of operation and operation cost of target access;In addition, user identifier access point connects It connects information and access point server is sent to by specified application server, so communication process can be made more safe and reliable.
It should be understood that authentication means provided by the above embodiment are when carrying out authentication, only with above-mentioned each The division progress of functional module can according to need and for example, in practical application by above-mentioned function distribution by different function Energy module is completed, i.e., the internal structure of device is divided into different functional modules, to complete whole described above or portion Divide function.In addition, authentication means provided by the above embodiment and auth method embodiment belong to same design, have Body realizes that process is detailed in embodiment of the method, and which is not described herein again.
Those of ordinary skill in the art will appreciate that realizing that all or part of the steps of above-described embodiment can pass through hardware It completes, relevant hardware can also be instructed to complete by program, the program can store in a kind of computer-readable In storage medium, storage medium mentioned above can be read-only memory, disk or CD etc..
The foregoing is merely presently preferred embodiments of the present invention, is not intended to limit the invention, it is all in spirit of the invention and Within principle, any modification, equivalent replacement, improvement and so on be should all be included in the protection scope of the present invention.

Claims (24)

1. a kind of auth method, which is characterized in that the described method includes:
Target access receives the access-in point information of the user identifier that terminal is sent and target access, and the user identifier is institute The mark that terminal logs in specified application is stated, the service set of the target access is included at least in described access point information SSID;
The user identifier and described access point information are sent to specified application server by the target access, described specified Application server is to provide the server of service for the specified application;
The specified application server sends checking request to access point server, and user's mark is carried in the checking request Knowledge and described access point information;
Described access point server verifies the user identifier according to the SSID of the target access;If the use Family mark is by verifying, then the corresponding user of the user identifier is legal, if the user is legal, it is determined that the verifying is asked It asks through verifying, the terminal and the target access are established and communicated to connect.
2. the method according to claim 1, wherein the target access is by the user identifier and described connects Access point information is sent to specified application server, comprising:
The verification information of the user identifier, the SSID of the target access and the target access is sent to the finger Determine application server;
Wherein, the verification information of the target access is generated by the target access, and is carried and sent in the terminal In access-in point information.
3. if according to the method described in claim 2, it is characterized in that, the user is legal, it is determined that the verifying Request passes through verifying, comprising:
The verification information of the target access is verified;If the verification information of the target access passes through verifying, Then the target access is legal;
When the target access is legal and the user is legal, the user passes through authentication.
4. the method according to claim 1, wherein described access point server tests the checking request After card, the method also includes:
If the checking request is returned to first to the specified application server and is tested by verifying, described access point server Card is as a result, include entry address information in first verification result;
First verification result is sent to the target access by the specified application server, and the target access exists It receives to establish with the terminal after first verification result and communicate to connect, and first verification result is sent to described Terminal;
The terminal is sent out after receiving first verification result, according to the entry address information to the target access Logging request is sent, so that the target access, after receiving the logging request, the return of Xiang Suoshu terminal logins successfully letter Breath.
5. method according to claim 1 or 4, which is characterized in that described access point server to the checking request into After row verifying, the method also includes:
If the checking request is returned to second to the specified application server and is tested by verifying, described access point server Card is as a result, include log duration information in second verification result;
Second verification result is sent to the target access by the specified application server, and the target access exists It receives to establish with the terminal after second verification result and communicate to connect, and second verification result is sent to described Terminal;
The terminal shows second verification result after receiving second verification result.
6. the method according to claim 1, wherein described access point server tests the checking request After card, the method also includes:
If the checking request is returned to third to the specified application server and is tested by verifying, described access point server Card is as a result, include publishing address information in the third verification result;
The third verification result is sent to the target access by the specified application server, and the target access exists It receives to establish with the terminal after the third verification result and communicate to connect, and the third verification result is sent to described Terminal;
The terminal is published address information and is sent out to the target access after receiving the third verification result according to described Send and publish request so that the target access receive it is described publish request after, disconnected with the terminal.
7. the method according to claim 1, wherein the target access receives the user identifier that terminal is sent Before the access-in point information of target access, the method also includes:
The terminal scans the pattern identification of the target access, obtains the access point password of the target access;
The terminal is established primary with the target access according to described access point password and is connect.
8. a kind of auth method is applied to specified application server, which is characterized in that the described method includes:
It obtains terminal and logs in the user identifier of specified application and the access-in point information of target access;
Checking request is sent to access point server, so that described access point server verifies the checking request, institute It states checking request and carries the user identifier and described access point information;
When the checking request passes through verifying, the verification result that described access point server returns is received, the verifying is tied Fruit is sent to the target access, is established after receiving the verification result with the terminal by the target access logical Letter connection, wherein the checking request refers to that the user identifier is legal by verifying, and the user identifier is legal to refer to the access Point server verifies the user identifier according to the SSID of the target access, and the user identifier is by testing Card.
9. according to the method described in claim 8, it is characterized in that, it is described obtain terminal log in specified application user identifier and The access-in point information of target access, comprising:
The verifying field that the target access generates is obtained, is believed the verifying field as the verifying of the target access Breath;
Receive the target access that the target access is sent service set SSID and the user identifier, it is described The SSID of target access and the user identifier are sent to the target access by the terminal.
10. according to the method described in claim 8, it is characterized in that, the verifying for receiving described access point server and returning As a result after, the method also includes:
The first verification result is sent to the terminal by the target access, includes logging in first verification result Address information sends logging request to the target access according to the entry address information from the terminal, so that described For target access after receiving the logging request, the return of Xiang Suoshu terminal logins successfully information.
11. the method according to claim 8 or 10, which is characterized in that described to receive what described access point server returned After verification result, the method also includes:
The second verification result is sent to the terminal by the target access, so that the terminal is receiving described After two verification results, second verification result is shown;
It wherein, include log duration information in second verification result.
12. according to the method described in claim 8, it is characterized in that, the verifying for receiving described access point server and returning As a result after, the method also includes:
Third verification result is sent to the terminal by the target access, includes publishing in the third verification result Address information publishes address information from the terminal according to and publishes request to target access transmission, so that described Target access receive it is described publish request after, disconnect and communicating to connect with the terminal.
13. a kind of authentication system, which is characterized in that the system comprises terminal, target access, specified application servers And access point server;
The target access, for receiving the user identifier of terminal transmission and the access-in point information of target access, the use Family is identified as the mark that the terminal logs in specified application, and the clothes of the target access are included at least in described access point information Be engaged in set identifier SSID;
The target access, for the user identifier and described access point information to be sent to specified application server, institute Stating specified application server is to provide the server of service for the specified application;
The specified application server, for sending checking request to access point server, in the checking request described in carrying User identifier and described access point information;
Described access point server, for being verified according to the SSID of the target access to the user identifier;If The user identifier is by verifying, then the corresponding user of the user identifier is legal, if the user is legal, it is determined that described Checking request is established and is communicated to connect by verifying, the terminal and the target access.
14. system according to claim 13, which is characterized in that the target access, for by the user identifier, The verification information of the SSID of the target access and the target access is sent to the specified application server;
Wherein, the verification information of the target access is generated by the target access, and is carried and sent in the terminal In access-in point information.
15. system according to claim 14, which is characterized in that described access point server, for being connect to the target The verification information of access point is verified;If the verification information of the target access passes through verifying, the target access It is legal;When the target access is legal and the user is legal, the user passes through authentication.
16. system according to claim 13, which is characterized in that described access point server, for being asked when the verifying It asks when passing through verifying, returns to the first verification result to the specified application server, include logging in first verification result Address information;First verification result is sent to the target access by the specified application server, and the target connects Access point is established with the terminal after receiving first verification result and is communicated to connect, and first verification result is sent To the terminal;The terminal is after receiving first verification result, according to the entry address information to the target Access point sends logging request, so that the target access, after receiving the logging request, the return of Xiang Suoshu terminal is stepped on Record successful information.
17. system described in 3 or 16 according to claim 1, which is characterized in that described access point server, for being tested when described When card request passes through verifying, the second verification result is returned to the specified application server, includes in second verification result Log duration information;Second verification result is sent to the target access, the mesh by the specified application server Tag splice access point is established with the terminal after receiving second verification result and is communicated to connect, and by second verification result It is sent to the terminal;The terminal shows second verification result after receiving second verification result.
18. system according to claim 13, which is characterized in that described access point server, for being asked when the verifying It asks when passing through verifying, returns to third verification result to the specified application server, include publishing in the third verification result Address information;The third verification result is sent to the target access by the specified application server, and the target connects Access point is established with the terminal after receiving the third verification result and is communicated to connect, and the third verification result is sent To the terminal;The terminal is after receiving the third verification result, according to the address information of publishing to the target Request is published in access point transmission so that the target access receive it is described publish request after, disconnect company with the terminal It connects.
19. system according to claim 13, which is characterized in that the terminal, for scanning the target access Pattern identification obtains the access point password of the target access;It is built according to described access point password and the target access Vertical primary connection.
20. a kind of authentication means, it is applied to specified application server, which is characterized in that described device includes:
Data obtaining module logs in the user identifier of specified application and the access-in point information of target access for obtaining terminal;
Checking request sending module, for sending checking request to access point server, so that described access point server is to institute It states checking request to be verified, the checking request carries the user identifier and described access point information;
Verification result receiving module, for when the checking request passes through verifying, receiving what described access point server returned The verification result is sent to the target access by verification result, is receiving the verifying by the target access As a result it establishes and communicates to connect with the terminal after, the checking request refers to that the user identifier is legal by verifying, the user It identifies legal finger described access point server to verify the user identifier according to the SSID of the target access, and institute It states user identifier and passes through verifying.
21. device according to claim 20, which is characterized in that the data obtaining module, for obtaining the target The verifying field that access point generates, using the verifying field as the verification information of the target access;Receive the target The service set SSID for the target access that access point is sent and the user identifier, the SSID of the target access The target access is sent to by the terminal with the user identifier.
22. device according to claim 20, which is characterized in that the verification result receiving module is also used to pass through institute It states target access and the first verification result is sent to the terminal, include entry address information in first verification result, Logging request is sent to the target access according to the entry address information from the terminal, so that the target access After receiving the logging request, the return of Xiang Suoshu terminal logins successfully information.
23. the device according to claim 20 or 22, which is characterized in that the verification result receiving module is also used to lead to It crosses the target access and the second verification result is sent to the terminal, so that the terminal is receiving second verifying As a result after, second verification result is shown;It wherein, include log duration information in second verification result.
24. device according to claim 20, which is characterized in that the verification result receiving module is also used to pass through institute It states target access and third verification result is sent to the terminal, include publishing address information in the third verification result, Address information is published according to from the terminal and publishes request to target access transmission, so that the target access Receive it is described publish request after, disconnect and communicating to connect with the terminal.
CN201410355373.0A 2014-07-24 2014-07-24 Auth method, apparatus and system Active CN104144163B (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN201410355373.0A CN104144163B (en) 2014-07-24 2014-07-24 Auth method, apparatus and system

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN201410355373.0A CN104144163B (en) 2014-07-24 2014-07-24 Auth method, apparatus and system

Publications (2)

Publication Number Publication Date
CN104144163A CN104144163A (en) 2014-11-12
CN104144163B true CN104144163B (en) 2019-06-11

Family

ID=51853231

Family Applications (1)

Application Number Title Priority Date Filing Date
CN201410355373.0A Active CN104144163B (en) 2014-07-24 2014-07-24 Auth method, apparatus and system

Country Status (1)

Country Link
CN (1) CN104144163B (en)

Families Citing this family (13)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106714158B (en) * 2015-08-18 2020-02-18 中国移动通信集团公司 WiFi access method and device
WO2017041298A1 (en) * 2015-09-11 2017-03-16 华为技术有限公司 Wireless local area network access point verification method, terminal, service platform, access point and access point background
CN105263193B (en) * 2015-09-11 2018-09-28 上海斐讯数据通信技术有限公司 The WIFI connection methods of mobile terminal and system
CN105873035A (en) * 2016-05-19 2016-08-17 福州市协成智慧科技有限公司 Safe AP (access point) information processing method
CN106453349B (en) * 2016-10-31 2019-06-14 北京小米移动软件有限公司 Account login method and device
CN107360164B (en) * 2017-07-13 2020-11-10 上海司南卫星导航技术股份有限公司 User name authentication method and non-differential correction distributed processing system
CN107529164A (en) * 2017-09-07 2017-12-29 上海斐讯数据通信技术有限公司 A kind of portal certifications, wireless network access method and system
CN109842584B (en) * 2017-11-25 2021-11-19 华为技术有限公司 Authentication method and network device
CN108834221B (en) * 2018-06-01 2022-09-20 南昌黑鲨科技有限公司 Network connection control method, computer-readable storage medium, and mobile terminal
CN108848505B (en) * 2018-07-10 2021-05-07 上海尚往网络科技有限公司 Wireless connection method and device
CN110087330B (en) * 2019-04-25 2021-11-09 新华三技术有限公司 Wireless network connection establishing method, wireless access equipment and server
CN110497696B (en) * 2019-08-19 2021-09-28 前海联大(深圳)技术有限公司 Wireless communication module, printing consumables and printer
CN113254893B (en) * 2020-02-13 2023-09-19 百度在线网络技术(北京)有限公司 Identity verification method and device, electronic equipment and storage medium

Family Cites Families (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20130100819A1 (en) * 2011-10-19 2013-04-25 Qualcomm Incorporated Selectively acquiring and advertising a connection between a user equipment and a wireless local area network
CN103716793B (en) * 2013-12-20 2017-06-16 小米科技有限责任公司 Access-in point information sharing method and device
CN103702375A (en) * 2013-12-25 2014-04-02 北京邮电大学 Method and system for switching WTRU (wireless transmit receive unit) in WLAN (wireless logic area network) by using cellular network
CN103856332B (en) * 2014-03-22 2017-02-08 中国科学院信息工程研究所 Implementation method of one-to-multiple account mapping binding of convenient and rapid multi-screen multi-factor WEB identity authentication

Also Published As

Publication number Publication date
CN104144163A (en) 2014-11-12

Similar Documents

Publication Publication Date Title
CN104144163B (en) Auth method, apparatus and system
US11089044B2 (en) Method and system for assessing data security
CN104158808B (en) Portal authentication method and its device based on APP applications
KR102581559B1 (en) Log access point detection using multi-path verification
CN101702717B (en) Method, system and equipment for authenticating Portal
KR101214836B1 (en) Authentication method and authentication system
CN112260995A (en) Access authentication method, device and server
CN104270250B (en) WiFi internets online connection authentication method based on asymmetric whole encryption
CN109587097A (en) A kind of system, method and apparatus for realizing secure access internal network
CN110266642A (en) Identity identifying method and server, electronic equipment
CN108270882A (en) The analysis method and device of domain name, storage medium, electronic device
CN108880822A (en) A kind of identity identifying method, device, system and a kind of intelligent wireless device
US9332432B2 (en) Methods and system for device authentication
CN109150874A (en) Access authentication method, device and authenticating device
CN108322416B (en) Security authentication implementation method, device and system
CN107508822A (en) Access control method and device
CN114995214A (en) Method, system, device, equipment and storage medium for remotely accessing application
CN105991518B (en) Network access verifying method and device
CN110505188A (en) A kind of terminal authentication method, relevant device and Verification System
CN104662871A (en) Method and device for securely accessing a web service
CN113271299B (en) Login method and server
CN106161475A (en) The implementation method of subscription authentication and device
CN110336870A (en) Method for building up, device, system and the storage medium in telecommuting O&M channel
CN109218334A (en) Data processing method, device, access control equipment, certificate server and system
CN106230788A (en) The reorientation method of a kind of portal certification, radio reception device, portal server

Legal Events

Date Code Title Description
C06 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
GR01 Patent grant
GR01 Patent grant