CN105049413A - Authentication method for free wireless Internet access - Google Patents
Authentication method for free wireless Internet access Download PDFInfo
- Publication number
- CN105049413A CN105049413A CN201510297638.0A CN201510297638A CN105049413A CN 105049413 A CN105049413 A CN 105049413A CN 201510297638 A CN201510297638 A CN 201510297638A CN 105049413 A CN105049413 A CN 105049413A
- Authority
- CN
- China
- Prior art keywords
- mobile terminal
- micro
- message
- letter
- tcp
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L1/00—Arrangements for detecting or preventing errors in the information received
- H04L1/12—Arrangements for detecting or preventing errors in the information received by using return channel
- H04L1/16—Arrangements for detecting or preventing errors in the information received by using return channel in which the return channel carries supervisory signals, e.g. repetition request signals
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
- H04L63/0876—Network architectures or network communication protocols for network security for authentication of entities based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L67/00—Network arrangements or protocols for supporting network services or applications
- H04L67/01—Protocols
- H04L67/02—Protocols based on web technology, e.g. hypertext transfer protocol [HTTP]
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
- H04W12/06—Authentication
Landscapes
- Engineering & Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Computer Security & Cryptography (AREA)
- Computer Hardware Design (AREA)
- Computing Systems (AREA)
- General Engineering & Computer Science (AREA)
- Power Engineering (AREA)
- Mobile Radio Communication Systems (AREA)
Abstract
The invention provides an authentication method for free wireless Internet access. The authentication method comprises the following steps that (A1) wireless network setting of a mobile terminal is opened, free WIFI of a hotel or market and the like is selected and connected to; (A2) the mobile terminal emits a message to detect the network, the message is processed so that an authentication page is automatically popped up in the mobile terminal, and a user clicks a We-Chat authentication manner; (A3) the We-Chat is automatically started, and the user input the We-Chat public code of the hotel or market and the like; and (A4) information of the hotel or market and the like is popped up in We-Chat, the user clicks ''follow'', and authentication for free Internet access is completed. The method has the advantages of good and convenient experience.
Description
Technical field
The present invention relates to networking technology area, particularly free authentication method of getting online without being tethered to a cable.
Background technology
Free WIFI wireless Internet access environment is all provided in the communal facilitys such as existing megastore, shopping center, office building, restaurant, connection AP is carried out in the WIFI setting that user first can open smart mobile phone, then need to input my phone number, initiate application authentication request.Public WIFI Cloud Server generates corresponding network access authentication code according to application authentication request, and is returned to the phone number of user's input.User needs this network access authentication code to be input in corresponding input frame to generate network access authentication request, and Cloud Server certification issues authentication result to AP after passing through, the access of the user of AP clearance subsequently, and user normally can access the Internet.
Fig. 1 schematically illustrates the structure chart of public WIFI environment networking in prior art, and as shown in Figure 1, system is made up of AP and public WIFI operator Cloud Server, is hereinafter called for short Cloud Server.AP also may be exactly a wireless router, is responsible for communicating with Cloud Server.Completing user management on Cloud Server, agent administration and equipment are checked.AP is responsible for obtaining authentication mode from Cloud Server, issues authentication result by Cloud Server.Cloud Server generally comprises authentication management server and PORTAL server, and hereinafter described portal refers to a part for Cloud Server in fact.
Fig. 2 schematically illustrates the flow chart of getting online without being tethered to a cable in prior art, and as shown in Figure 2, existing methodical step is as follows:
The wireless network that step 1, user open mobile phone terminal is arranged, and selects and connects the free WIFI of retail shop, successfully.Now can not appliance for releasing single PORTAL certification, user yet not through system authentication, cannot access INTERNET.
Step 2, user need the browser oneself opening mobile phone, input the network address that will access, as WWW.BAIDU.COM, so that triggering authentication.
The access of step 3, browser is redirected to a PORTAL page by AP, page prompts user input handset number, clicks and obtains identifying code.
The arrival of the codes to be verified such as step 4, user need, then at certification page input validation code.
Step 5, complete the verification process of terminal in free WIFI system, normally can access the Internet afterwards.
There is many deficiencies in above-mentioned network access, as:
1. go up the very tired lock of network process, cell-phone number always has 11, identifying code has 6-8 position, and must input nearly 20 numerals or letter to surf the Net, mobile phone terminal itself is designed to facilitate touch operation but not input operation, add also there is a process waiting identifying code, sometimes because Short Message Service Gateway reason, identifying code also sends unsuccessful, and all of these factors taken together is added up, the efficiency that result in whole certification is very low, Consumer's Experience extreme difference.
2. some user thinks and adds that WIFI just can use, and does not have recognized the need to oneself to open a browser and goes triggering authentication.When user directly open micro-letter but find have more than is needed time, can suspect that the reasons such as wireless signal cause can not enter net, directly abandon use, this can cause businessman directly to lose this crowd of user undoubtedly.
Summary of the invention
In order to solve the deficiency in above-mentioned prior art, the invention provides the authentication method of the good free wireless Internet access of a kind of Consumer's Experience.
The object of the invention is to be achieved through the following technical solutions:
An authentication method for free wireless Internet access, described authentication method comprises the following steps:
(A1) wireless network opening mobile terminal is arranged, and selects and connects the free WIFI of businessman;
(A2) described mobile terminal sends the message of detection network, processes described message, makes mobile terminal automatic spring certification page, and user clicks micro-letter authentication mode;
(A3) micro-letter is opened automatically, and user inputs micro-letter public number of described businessman.
(A4) micro-letter ejects the information of businessman, and user clicks " concern ", thus completes Free Internet Access certification.
According to above-mentioned authentication method, preferably, in step (A3), user sweeps function with sweeping, micro-letter public number of scanning businessman, thus inputs micro-letter public number.
According to above-mentioned authentication method, alternatively, in step (A2):
If user had paid close attention to micro-letter public number of businessman, when again coming this businessman, user only need open the micro-letter public number of businessman in micro-letter, enters the function interface of businessman, clicks " surfing the Net immediately " function button.
According to above-mentioned authentication method, preferably, in step (A2):
The processing method of described message is: check whether message meets probe messages condition, if met, processes; If do not met, termination message.
According to above-mentioned authentication method, alternatively, described message meets following requirement:
Be TCP message, destination interface is 80, with PSH flag bit, message content meets http protocol form.
According to above-mentioned authentication method, preferably, HTTP head User-Agent: comprise character string " CaptiveNetworkSupport ", or the URL address that HTTP head comprises is: "/library/test/success.html " or User-Agent comprise character string: " wispr ".
According to above-mentioned authentication method, preferably, in step (A2):
The processing method of described message is:
The response message of structure server sends to described mobile terminal, and the content of response message band is " HTTP302FOUND r n ", and brings corresponding parameter.
According to above-mentioned authentication method, preferably, the method constructing the response message of server is:
(B1) in LINUX kernel, a SKB is created;
(B2) calculate the TCP request message of described mobile terminal, obtain TCP length, TCPSEQ sequence number, both are added, as No. ACK of reply TCP message;
With No. ACK sequence number as reply TCP message of described mobile terminal; The TCP load that will reply assembles a TCP message content;
(B3) by the transport layer position of described TCP message copy content to SKB;
(B4) according to the IP address information of mobile terminal, assemble the IP message structure head of a standard, copy the network layer position of SKB to;
(B5) send function dev_queue_xmit (skb) by network protocol stack, above-mentioned SKB is sent.
According to above-mentioned authentication method, alternatively,
When having replied 302 to after described mobile terminal, described mobile terminal can be initiated second time according to 302 re-direction prompt and be connected, and the destination address now connected will point to AP;
Mobile terminal according to 302 result, the local WEB server of the AP that is certainly dynamically connected; AP just can reply the page with ad content in the response.
According to above-mentioned authentication method, alternatively, described with the page of ad content in embed the URL link of a setting, point to a blank horizontal line picture of PORTAL server:
If judge that mobile terminal shows the PORTAL page completely, just the detecting periodically request follow-up to mobile terminal can reply successful result, like this, mobile terminal just can think that wireless is available, demonstrates the wireless icon that success connects; Otherwise attempt can not get successful result, mobile terminal can think wireless unreachable and by wireless automatic closedown always.
According to above-mentioned authentication method, preferably, the method for the termination of non-probe messages is:
If the terminal message received be TCP80 port SYN request, then dropping packets and with destination address identity go reply SYN-ACK;
If that the terminal message TCP80 port received is ACK, is not with data, then directly abandons;
If the terminal message received is DNS message, be then redirected to local dns proxy server;
If what receive is the icmp packet of terminal, then directly let pass, so that carry out the diagnosis of network;
Other messages, directly abandon.
According to above-mentioned authentication method, preferably, step (A3) is further comprising the steps:
(C1) when user sweeps with micro-letter the micro-signal sweeping function Sao Liao businessman, mobile terminal sends a HTTP request to micro-letter;
(C2) domain name of the pre-configured micro-letter of AP and IP address, so that AP directly lets pass; When AP receives the message of this object IP of access, directly forward to micro-telecommunications services device;
(C3), when user clicks " concern " button in micro-letter details page of businessman, mobile terminal can send a HTTPGET request to the server address of businessman, asks the URL parameter bringing to appoint;
When AP identifies this character string, be redirected to backstage cloud server system; The information of described user is recorded in high in the clouds;
(C4) described cloud server system receives request, judges that user authentication passes through, and revises user in online subscriber's meter for certification, issues result to AP, and request AP lets pass this terminal;
(C5) this mobile terminal subsequent access is let pass by AP.
According to above-mentioned authentication method, preferably,
Described AP dynamically upgrades IP corresponding to domain name, converts IP white list to and carries out Business Processing, thus makes to carry out TCP at mobile terminal and micro-telecommunications services device and be connected stage of shaking hands and just correctly put logical.
According to above-mentioned authentication method, preferably, put logical micro-letters and calls to ask and comprise the following steps:
(D1) pre-configured good micro-letter domain name in AP;
(D2) pre-configured good micro-letter other server ip lists outer in AP;
(D3) mobile terminal is connected with micro-telecommunications services device:
If based on domain name, and do not have CACHE, then first can send DNS query, AP intercepts and captures DNS response, and the host name of matching inquiry comprises the domain name of micro-letter, refreshes IP address in IP white list; Enter step (D4);
If there is DNSCACHE mobile terminal this locality, then DNS query can be skipped; Enter step (D5);
(D4) mobile terminal and micro-telecommunications services device are initiated TCP and are shaken hands, and send SYN message, AP judges that Target IP belongs to IP white list, this IP message of directly letting pass;
(D5) because mobile terminal does not send out the IP initiation HTTP access of DNS directly to micro-telecommunications services device, this fashion of AP does not possess corresponding IP white list, and therefore judge that Target IP does not belong to IP white list, AP directly replys SYN-ACK, carries out finalization process;
(D6) mobile terminal responds ACK to SYN-ACK, and TCP shakes hands successfully.After AP receives ACK, abandon and do not need process;
(D7) the access GET that mobile terminal sends micro-letter asks, AP intercepts and captures the domain name whether rear HOST territory judging that GET asks contains micro-letter, if, then reply TCPRST message, the TCP this established connects disconnection, simultaneously, the object IP that mobile terminal is accessed is added to IP white list, correspond to the white list state described in (D5), to this step, AP inside has just possessed corresponding IP white list.AP ensure that on the basis that IP white list correctly refreshes, and forces mobile terminal again to walk flow process (D4), correctly to put the access of logical micro-letter;
When mobile terminal is from 4G/3G environment changing to the WIFI network of businessman, the scene that terminal inner has DNSCACHE often occurs, under this scene, terminal is before the micro-letter HTTP of request accesses, DNS query can not be sent, by said method, under solving this scene, the problem of being tackled by mistake is accessed to micro-letter HTTP.
Compared with prior art, the beneficial effect that the present invention has is:
1, no matter be pay close attention to certification or subsequent authentication first, user does not need input character, meets the operating habit of the mobile terminals such as mobile phone, significantly improves the experience of user;
User only needs to utilize micro-letter to sweep and sweeps just can realize network access authentication, easy and simple to handle, avoids inputting cumbersome phone number identifying code, improves efficiency, allows user have better experience;
Businessman can also sweep by this sweeping the function that micro-letter completes certification, reaches the advertising effects promoting the micro-letter of businessman, and can attract rapidly micro-letter bean vermicelli;
2, user's automatic spring PORTAL certification page after connection WIFI, clearly informs and cannot not use network before completing certification, decrease user misoperation.
Accompanying drawing explanation
With reference to accompanying drawing, disclosure of the present invention will be easier to understand.Those skilled in the art it is easily understood that: these accompanying drawings only for illustrating technical scheme of the present invention, and and are not intended to be construed as limiting protection scope of the present invention.In figure:
Fig. 1 is the structure chart of public WIFI environment networking in prior art;
Fig. 2 is the flow chart of getting online without being tethered to a cable in prior art;
Fig. 3 is the flow chart of the wireless Internet access according to the embodiment of the present invention;
Fig. 4 is the flow chart of the step (A2) according to the embodiment of the present invention;
Fig. 5 is the flow chart of micro-letter certification in the step (A3) according to the embodiment of the present invention;
Fig. 6 is the flow chart that in the step (A3) according to the embodiment of the present invention, micro-telecommunications services device access is let pass.
Embodiment
Fig. 3-6 and following description describe Alternate embodiments of the present invention and how to implement to instruct those skilled in the art and to reproduce the present invention.In order to instruct technical solution of the present invention, simplifying or having eliminated some conventional aspects.Those skilled in the art should understand that the modification that is derived from these execution modes or replace will within the scope of the invention.Those skilled in the art should understand that following characteristics can combine to form multiple modification of the present invention in every way.Thus, the present invention is not limited to following Alternate embodiments, and only by claim and their equivalents.
Embodiment:
Fig. 3 schematically illustrates the flow chart of the authentication method of the free wireless Internet access of the embodiment of the present invention, and as shown in Figure 3, described authentication method comprises the following steps:
(A1) wireless network opening mobile terminal (as mobile phone, IPAD etc.) is arranged, and selects and connects the free WIFI of businessman;
(A2) Fig. 4 schematically illustrates the flow chart of the step (A2) of the embodiment of the present invention, as shown in Figure 4, described mobile terminal sends the message of detection network, processes described message, make mobile terminal automatic spring certification page, user clicks micro-letter authentication mode; If user had paid close attention to micro-letter public number of businessman, when again coming this businessman, user only need open the micro-letter public number of businessman in micro-letter, enters the function interface of businessman, clicks " surfing the Net immediately " function button; Be specially:
The processing method of described message is:
Check whether message meets probe messages condition: message must be TCP message, destination interface is 80, with PSH flag bit, message content meets http protocol form.HTTP head User-Agent: comprise character string " CaptiveNetworkSupport ", or the URL address that HTTP head comprises is: "/library/test/success.html " or User-Agent comprise character string: " wispr ", if met, process; The response message of structure server sends to described mobile terminal, and the content of response message band is " HTTP302FOUND r n ", and brings corresponding parameter.Design parameter is as follows:
"HTTP/1.1302Found\r\nLocation:http://％u.％u.％u.％u/cgi-bin/userLogin.cgi？redirect＝code&ip＝％u.％u.％u.％u&mac＝％02x:％02x:％02x:％02x:％02x:％02x&Id＝http://％s％s\r\nContent-Type:text/html；charset＝iso-8859-1\r\nContent-length:0\r\nCache-control:no-cache\r\n\r\n"
Parameter declaration:
The method of the response message of structure server is:
(B1) in LINUX kernel, a SKB is created;
(B2) calculate the TCP request message of described mobile terminal, obtain TCP length, TCPSEQ sequence number, both are added, as No. ACK of reply TCP message;
With No. ACK sequence number as reply TCP message of described mobile terminal; The TCP load that will reply assembles a TCP message content;
(B3) by the transport layer position of described TCP message copy content to SKB;
(B4) according to the IP address information of mobile terminal, assemble the IP message structure head of a standard, copy the network layer position of SKB to;
(B5) send function dev_queue_xmit (skb) by network protocol stack, above-mentioned SKB is sent.
When having replied 302 to after described mobile terminal, described mobile terminal can be initiated second time according to 302 re-direction prompt and be connected, and the destination address now connected will point to AP;
Mobile terminal according to 302 result, the local WEB server of the AP that is certainly dynamically connected; AP just can reply the page with ad content in the response.
Further, in order to the ejection allowing system validation mobile terminal complete the PORTAL page, in this page, embed the URL link of a setting, point to a blank horizontal line picture of PORTAL server.Like this, when systems axiol-ogy has crossed this blank horizontal line picture resource to mobile terminal Outside Access, just can judge that mobile terminal has flicked the PORTAL page completely.
If judge that mobile terminal shows the PORTAL page completely, just the detecting periodically request follow-up to mobile terminal can reply successful result, like this, mobile terminal just can think that wireless is available, demonstrates the wireless icon that success connects.Otherwise attempt can not get successful result, mobile terminal can think wireless unreachable and by wireless automatic closedown always.
Above-mentioned successful result is a HTTP200OK, and the content of concrete band is as follows:
"HTTP/1.0200OK\r\n"
"Content-Type:text/html\r\n"
"Content-length:68\r\n"
"Date:Wed,04Mar201507:40:42GMT\r\n"
"Connection:close\r\n"
"\r\n"
"<HTML><HEAD><TITLE>Success</TITLE></HEAD><BODY>Success</BODY></HTML>"；
If message does not meet detection messages condition, then terminate message, and the method for concrete termination is:
If the terminal message received be TCP80 port SYN request, then dropping packets and with destination address identity go reply SYN-ACK;
If that the terminal message TCP80 port received is ACK, is not with data, then directly abandons;
If the terminal message received is DNS message, be then redirected to local dns proxy server;
If what receive is the icmp packet of terminal, then directly let pass, so that carry out the diagnosis of network;
Other messages, directly abandon.
(A3) Fig. 5 schematically illustrates the flow chart of the step (A3) of the embodiment of the present invention, and as shown in Figure 5, micro-letter is opened automatically, and user sweeps function with sweeping, micro-letter public number of scanning businessman, thus inputs micro-letter public number; Be specially:
(C1) when user sweeps with micro-letter the micro-signal sweeping function Sao Liao businessman, mobile terminal sends a HTTP request to micro-letter;
(C2) domain name of the pre-configured micro-letter of AP and IP address, so that AP directly lets pass; When AP receives the message of this object IP of access, directly forward to micro-telecommunications services device;
Described AP dynamically upgrades IP corresponding to domain name, converts IP white list to and carries out Business Processing, thus makes to carry out TCP at mobile terminal and micro-telecommunications services device and be connected stage of shaking hands and just correctly put logical.
(C3), when user clicks " concern " button in micro-letter details page of businessman, mobile terminal can send a HTTPGET request to the server address of businessman, asks the URL parameter bringing to appoint;
When AP identifies this character string, be redirected to backstage cloud server system; The information of described user is recorded in high in the clouds;
(C4) described cloud server system receives request, judges that user authentication passes through, and revises user in online subscriber's meter for certification, issues result to AP, and request AP lets pass this terminal;
The feature of above-mentioned agreement parameter 1 is: comprise following word string in URL: "? action=weixin & sessionid=%s "
Value wherein in sessionid is a random value, dynamically generates.
The feature of above-mentioned agreement parameter 2 is: comprise following character string in URL: "? the actual mobile terminal mac> of redirect=weixin & sessionid=%s & ip=< actual mobile terminal ip> & mac=< "
(C5) this mobile terminal subsequent access is let pass by AP.
In this step (A3), in order to correctly put the logical access to micro-telecommunications services device, need domain name addresses and the IP address of pre-configured micro-telecommunications services device.In addition, also need dynamically to upgrade IP corresponding to domain name by AP, convert IP white list to and carry out Business Processing, to be connected the stage of shaking hands at mobile terminal and micro-telecommunications services device and just correctly to put logical carrying out TCP.Meanwhile, mobile terminal this locality has the scene of DNS cache to need to process especially, to prevent whether AP None-identified IP address under this scene from being white list IP.
The flow chart that the micro-telecommunications services device that Fig. 6 schematically illustrates the embodiment of the present invention is let pass, as shown in Figure 6, put the detailed step that logical micro-letters and calls ask as follows:
(D1) pre-configured good micro-letter domain name in AP;
(D2) pre-configured good micro-letter other server ip lists outer in AP;
(D3) mobile terminal is connected with micro-telecommunications services device:
If based on domain name, and do not have CACHE, then first can send DNS query, AP intercepts and captures DNS response, and the host name of matching inquiry comprises the domain name of micro-letter, refreshes IP address in IP white list; Enter step (D4);
If there is DNSCACHE mobile terminal this locality, then DNS query can be skipped; Enter step (D5);
(D4) mobile terminal and micro-telecommunications services device are initiated TCP and are shaken hands, and send SYN message, AP judges that Target IP belongs to IP white list, this IP message of directly letting pass;
(D5) because mobile terminal does not send out the IP initiation HTTP access of DNS directly to micro-telecommunications services device, this fashion of AP does not possess corresponding IP white list, and therefore judge that Target IP does not belong to IP white list, AP directly replys SYN-ACK, carries out finalization process;
(D6) mobile terminal responds ACK to SYN-ACK, and TCP shakes hands successfully.After AP receives ACK, abandon and do not need process;
(D7) the access GET that mobile terminal sends micro-letter asks, AP intercepts and captures the domain name whether rear HOST territory judging that GET asks contains micro-letter, if, then reply TCPRST message, the TCP this established connects disconnection, simultaneously, the object IP that mobile terminal is accessed is added to IP white list, correspond to the white list state described in (D5), to this step, AP inside has just possessed corresponding IP white list.AP ensure that on the basis that IP white list correctly refreshes, and forces mobile terminal again to walk flow process (D4), correctly to put the access of logical micro-letter;
When mobile terminal is from 4G/3G environment changing to the WIFI network of businessman, the scene that terminal inner has DNSCACHE often occurs, under this scene, terminal is before the micro-letter HTTP of request accesses, DNS query can not be sent, by said method, under solving this scene, the problem of being tackled by mistake is accessed to micro-letter HTTP.
(A4) micro-letter ejects the information of businessman, and user clicks " concern ", thus completes Free Internet Access certification.
Above-described embodiment is only exemplarily give execution mode, essence of the present invention is: (1) is by detecting the probe requests thereby after wireless terminal association, for probe requests thereby forges the response of response server, make terminal automatic spring PORTAL certification page; (2) detect based on DNS detection and HTTP request head HOST host name, realize letting pass to the access of micro-telecommunications services device with domain name white list conversion IP white list.(3), termination unauthenticated user access, avoid interference upstream gateway.
Claims (10)
1. a free authentication method of getting online without being tethered to a cable, described authentication method comprises the following steps:
(A1) wireless network opening mobile terminal is arranged, and selects and connects the free WIFI of businessman;
(A2) described mobile terminal sends the message of detection network, processes described message, makes mobile terminal automatic spring certification page, and user clicks micro-letter authentication mode;
(A3) micro-letter is opened automatically, and user inputs micro-letter public number of described businessman;
(A4) micro-letter ejects the information of businessman, and user clicks " concern ", thus completes Free Internet Access certification.
2. authentication method according to claim 1, is characterized in that: in step (A2):
The processing method of described message is: check whether message meets probe messages condition, if met, processes; If do not met, termination message; Described message meets following requirement:
Be TCP message, destination interface is 80, with PSH flag bit, message content meets http protocol form.
3. authentication method according to claim 2, it is characterized in that: HTTP head User-Agent: comprise character string " CaptiveNetworkSupport ", or the URL address that HTTP head comprises is: "/library/test/success.html " or User-Agent comprise character string: " wispr ".
4. authentication method according to claim 1, is characterized in that: in step (A2):
The processing method of described message is:
The response message of structure server sends to described mobile terminal, and the content of response message band is " HTTP302FOUND r n ", and brings corresponding parameter.
5. authentication method according to claim 4, is characterized in that: the method for the response message of structure server is:
(B1) in LINUX kernel, a SKB is created;
(B2) calculate the TCP request message of described mobile terminal, obtain TCP length, TCPSEQ sequence number, both are added, as No. ACK of reply TCP message;
With No. ACK sequence number as reply TCP message of described mobile terminal; The TCP load that will reply assembles a TCP message content;
(B3) by the transport layer position of described TCP message copy content to SKB;
(B4) according to the IP address information of mobile terminal, assemble the IP message structure head of a standard, copy the network layer position of SKB to;
(B5) send function dev_queue_xmit (skb) by network protocol stack, above-mentioned SKB is sent.
6. authentication method according to claim 4, is characterized in that: when having replied 302 to after described mobile terminal, and described mobile terminal can be initiated second time according to 302 re-direction prompt and be connected, and the destination address now connected will point to AP;
Mobile terminal according to 302 result, the local WEB server of the AP that is certainly dynamically connected; AP just can reply the page with ad content in the response.
7. authentication method according to claim 6, is characterized in that: described with the page of ad content in embed the URL link of a setting, point to a blank horizontal line picture of PORTAL server:
If judge that mobile terminal shows the PORTAL page completely, just the detecting periodically request follow-up to mobile terminal can reply successful result, like this, mobile terminal just can think that wireless is available, demonstrates the wireless icon that success connects; Otherwise mobile terminal can think wireless unreachable and by wireless automatic closedown.
8. authentication method according to claim 1, is characterized in that: step (A3) is further comprising the steps:
(C1) when user sweeps with micro-letter the micro-signal sweeping function Sao Liao businessman, mobile terminal sends a HTTP request to micro-letter;
(C2) domain name of the pre-configured micro-letter of AP and IP address, so that AP directly lets pass; When AP receives the message of this object IP of access, directly forward to micro-telecommunications services device;
(C3), when user clicks " concern " button in micro-letter details page of businessman, mobile terminal can send a HTTPGET request to the server address of businessman, asks the URL parameter bringing to appoint;
When AP identifies this character string, be redirected to backstage cloud server system; The information of described user is recorded in high in the clouds;
(C4) described cloud server system receives request, judges that user authentication passes through, and revises user in online subscriber's meter for certification, issues result to AP, and request AP lets pass this terminal;
(C5) this mobile terminal subsequent access is let pass by AP.
9. authentication method according to claim 8, is characterized in that:
Described AP dynamically upgrades IP corresponding to domain name, converts IP white list to and carries out Business Processing, thus makes to carry out TCP at mobile terminal and micro-telecommunications services device and be connected stage of shaking hands and just correctly put logical.
10. authentication method according to claim 9, is characterized in that: put logical micro-letters and calls and ask and comprise the following steps:
(D1) pre-configured good micro-letter domain name in AP;
(D2) pre-configured good micro-letter other server ip lists outer in AP;
(D3) mobile terminal is connected with micro-telecommunications services device:
If based on domain name, and do not have CACHE, then first can send DNS query, AP intercepts and captures DNS response, and the host name of matching inquiry comprises the domain name of micro-letter, refreshes IP address in IP white list; Enter step (D4);
If there is DNSCACHE mobile terminal this locality, then DNS query can be skipped; Enter step (D5);
(D4) mobile terminal and micro-telecommunications services device are initiated TCP and are shaken hands, and send SYN message, AP judges that Target IP belongs to IP white list, this IP message of directly letting pass;
(D5) because mobile terminal does not send out the IP initiation HTTP access of DNS directly to micro-telecommunications services device, this fashion of AP does not possess corresponding IP white list, and therefore judge that Target IP does not belong to IP white list, AP directly replys SYN-ACK, carries out finalization process;
(D6) mobile terminal responds ACK to SYN-ACK, and TCP shakes hands successfully.After AP receives ACK, abandon and do not need process;
(D7) the access GET that mobile terminal sends micro-letter asks, AP intercepts and captures the domain name whether rear HOST territory judging that GET asks contains micro-letter, if, then reply TCPRST message, the TCP this established connects disconnection, simultaneously, the object IP that mobile terminal is accessed is added to IP white list, correspond to the white list state described in (D5), to this step, AP inside has just possessed corresponding IP white list.AP ensure that on the basis that IP white list correctly refreshes, and forces mobile terminal again to walk flow process (D4), correctly to put the access of logical micro-letter;
When mobile terminal is from 4G/3G environment changing to the WIFI network of businessman, the scene that terminal inner has DNSCACHE often occurs, under this scene, terminal is before the micro-letter HTTP of request accesses, DNS query can not be sent, by said method, under solving this scene, the problem of being tackled by mistake is accessed to micro-letter HTTP.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201510297638.0A CN105049413A (en) | 2015-06-02 | 2015-06-02 | Authentication method for free wireless Internet access |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201510297638.0A CN105049413A (en) | 2015-06-02 | 2015-06-02 | Authentication method for free wireless Internet access |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN105049413A true CN105049413A (en) | 2015-11-11 |
Family
ID=54455624
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201510297638.0A Pending CN105049413A (en) | 2015-06-02 | 2015-06-02 | Authentication method for free wireless Internet access |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN105049413A (en) |
Cited By (16)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN105530638A (en) * | 2016-01-12 | 2016-04-27 | 杭州敦崇科技股份有限公司 | Free WIFI authentication system based on friend circle sharing |
| CN105792202A (en) * | 2016-02-23 | 2016-07-20 | 上海斐讯数据通信技术有限公司 | Authentication method for wireless network and authentication system |
| CN105979521A (en) * | 2016-06-23 | 2016-09-28 | 福建富士通信息软件有限公司 | Method for no-perception authentication free Internet access of fat WiFi AP and thin WiFi AP |
| CN106102060A (en) * | 2016-06-04 | 2016-11-09 | 杭州敦崇科技股份有限公司 | A kind of free WIFI authentication mode increasing information exposure rate |
| CN106102063A (en) * | 2016-06-27 | 2016-11-09 | 杭州华三通信技术有限公司 | A kind of wireless network authorization method, Apparatus and system |
| CN106304073A (en) * | 2016-08-30 | 2017-01-04 | 福建富士通信息软件有限公司 | A kind of authentication management method and system of WIFI Portal |
| CN106506675A (en) * | 2016-11-25 | 2017-03-15 | 杭州华三通信技术有限公司 | A kind of page reorientation method and device |
| CN106572515A (en) * | 2016-11-10 | 2017-04-19 | 上海斐讯数据通信技术有限公司 | Method and device for making portal page maintain popping up |
| CN106789937A (en) * | 2016-11-29 | 2017-05-31 | 上海斐讯数据通信技术有限公司 | Application authentication method and its system in captive portals environment, wireless aps |
| CN107172599A (en) * | 2017-05-17 | 2017-09-15 | 沈阳林科信息技术有限公司 | A kind of collocation method for advertising pictures broadcast strategy when connecting public WIFI |
| CN107294995A (en) * | 2017-07-06 | 2017-10-24 | 上海斐讯数据通信技术有限公司 | Prevent application authentication method and system, the radio reception device of Portal ejections |
| CN107481156A (en) * | 2017-07-27 | 2017-12-15 | 中兴软创科技股份有限公司 | A kind of method that bean vermicelli is received in wechat certification based on wireless network |
| CN107949037A (en) * | 2018-01-11 | 2018-04-20 | 北京小米移动软件有限公司 | Method for network access, apparatus and system, storage medium |
| CN109688588A (en) * | 2018-12-24 | 2019-04-26 | 中电福富信息科技有限公司 | A kind of wechat pressure suction powder method based on Portal certification |
| CN110830516A (en) * | 2019-12-19 | 2020-02-21 | 深信服科技股份有限公司 | Network access method, device, network control equipment and storage medium |
| CN110972139A (en) * | 2019-11-07 | 2020-04-07 | 锐捷网络股份有限公司 | Method and gateway for realizing internet access authentication of mobile terminal |
Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN103826226A (en) * | 2014-02-20 | 2014-05-28 | 深信服网络科技（深圳）有限公司 | Method and device for controlling wireless internet access |
| CN103825881A (en) * | 2013-12-13 | 2014-05-28 | 福建三元达通讯股份有限公司 | Method and apparatus for realizing redirection of WLAN user based on wireless access controller (AC) |
| CN104158808A (en) * | 2014-08-19 | 2014-11-19 | 杭州华三通信技术有限公司 | Portal authentication method based on APP application and device |
| CN104243286A (en) * | 2014-09-23 | 2014-12-24 | 上海佰贝科技发展有限公司 | Method for achieving public wifi authentication through WeChat |
| CN104394139A (en) * | 2014-11-22 | 2015-03-04 | 深圳市梧桐世界科技有限公司 | Implementation method for having free of charge wifi by paying close attention to micro letter public name |
| CN104486326A (en) * | 2014-12-11 | 2015-04-01 | 深圳市银河风云网络系统股份有限公司 | Authentication method for recognizing access network by using wechat |
-
2015
- 2015-06-02 CN CN201510297638.0A patent/CN105049413A/en active Pending
Patent Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN103825881A (en) * | 2013-12-13 | 2014-05-28 | 福建三元达通讯股份有限公司 | Method and apparatus for realizing redirection of WLAN user based on wireless access controller (AC) |
| CN103826226A (en) * | 2014-02-20 | 2014-05-28 | 深信服网络科技（深圳）有限公司 | Method and device for controlling wireless internet access |
| CN104158808A (en) * | 2014-08-19 | 2014-11-19 | 杭州华三通信技术有限公司 | Portal authentication method based on APP application and device |
| CN104243286A (en) * | 2014-09-23 | 2014-12-24 | 上海佰贝科技发展有限公司 | Method for achieving public wifi authentication through WeChat |
| CN104394139A (en) * | 2014-11-22 | 2015-03-04 | 深圳市梧桐世界科技有限公司 | Implementation method for having free of charge wifi by paying close attention to micro letter public name |
| CN104486326A (en) * | 2014-12-11 | 2015-04-01 | 深圳市银河风云网络系统股份有限公司 | Authentication method for recognizing access network by using wechat |
Non-Patent Citations (1)
| Title |
|---|
| WINTERTH: ""关于Apple的Captive Network Assistant"", 《HTTPS://BLOG.CSDN.NET/WINTERTH/ARTICLE/DETAILS/8485072》 * |
Cited By (21)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN105530638B (en) * | 2016-01-12 | 2018-12-21 | 杭州敦崇科技股份有限公司 | A kind of free WIFI Verification System shared based on circle of friends |
| CN105530638A (en) * | 2016-01-12 | 2016-04-27 | 杭州敦崇科技股份有限公司 | Free WIFI authentication system based on friend circle sharing |
| CN105792202A (en) * | 2016-02-23 | 2016-07-20 | 上海斐讯数据通信技术有限公司 | Authentication method for wireless network and authentication system |
| CN105792202B (en) * | 2016-02-23 | 2019-08-16 | 上海斐讯数据通信技术有限公司 | A kind of authentication method and Verification System of wireless network |
| CN106102060A (en) * | 2016-06-04 | 2016-11-09 | 杭州敦崇科技股份有限公司 | A kind of free WIFI authentication mode increasing information exposure rate |
| CN105979521A (en) * | 2016-06-23 | 2016-09-28 | 福建富士通信息软件有限公司 | Method for no-perception authentication free Internet access of fat WiFi AP and thin WiFi AP |
| CN105979521B (en) * | 2016-06-23 | 2019-07-16 | 福建富士通信息软件有限公司 | The method of fat or thin WiFi AP unaware certification free Internet access |
| CN106102063A (en) * | 2016-06-27 | 2016-11-09 | 杭州华三通信技术有限公司 | A kind of wireless network authorization method, Apparatus and system |
| CN106102063B (en) * | 2016-06-27 | 2021-07-30 | 新华三技术有限公司 | Wireless network authorization method, device and system |
| CN106304073A (en) * | 2016-08-30 | 2017-01-04 | 福建富士通信息软件有限公司 | A kind of authentication management method and system of WIFI Portal |
| CN106572515A (en) * | 2016-11-10 | 2017-04-19 | 上海斐讯数据通信技术有限公司 | Method and device for making portal page maintain popping up |
| CN106506675A (en) * | 2016-11-25 | 2017-03-15 | 杭州华三通信技术有限公司 | A kind of page reorientation method and device |
| CN106789937A (en) * | 2016-11-29 | 2017-05-31 | 上海斐讯数据通信技术有限公司 | Application authentication method and its system in captive portals environment, wireless aps |
| CN107172599A (en) * | 2017-05-17 | 2017-09-15 | 沈阳林科信息技术有限公司 | A kind of collocation method for advertising pictures broadcast strategy when connecting public WIFI |
| CN107294995A (en) * | 2017-07-06 | 2017-10-24 | 上海斐讯数据通信技术有限公司 | Prevent application authentication method and system, the radio reception device of Portal ejections |
| CN107481156A (en) * | 2017-07-27 | 2017-12-15 | 中兴软创科技股份有限公司 | A kind of method that bean vermicelli is received in wechat certification based on wireless network |
| CN107949037A (en) * | 2018-01-11 | 2018-04-20 | 北京小米移动软件有限公司 | Method for network access, apparatus and system, storage medium |
| CN109688588A (en) * | 2018-12-24 | 2019-04-26 | 中电福富信息科技有限公司 | A kind of wechat pressure suction powder method based on Portal certification |
| CN110972139A (en) * | 2019-11-07 | 2020-04-07 | 锐捷网络股份有限公司 | Method and gateway for realizing internet access authentication of mobile terminal |
| CN110830516A (en) * | 2019-12-19 | 2020-02-21 | 深信服科技股份有限公司 | Network access method, device, network control equipment and storage medium |
| CN110830516B (en) * | 2019-12-19 | 2022-03-22 | 深信服科技股份有限公司 | Network access method, device, network control equipment and storage medium |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN105049413A (en) | Authentication method for free wireless Internet access | |
| CN110300117B (en) | IOT device and user binding authentication method, device and medium | |
| CN106131079B (en) | Authentication method, system and proxy server | |
| US11451510B2 (en) | Method and apparatus for processing service request | |
| CN104158808B (en) | Portal authentication method and its device based on APP applications | |
| CN109997334A (en) | Session management with the relaying being indirectly connected with and charge applied for Internet of Things in 3GPP network | |
| US11832345B2 (en) | Methods and systems of using remote subscriber identification modules at a device | |
| CN103401884A (en) | Authentication method and system for public wireless environment Internet access based on micro message | |
| US20050153683A1 (en) | Plug and play mobile services | |
| CN105530638B (en) | A kind of free WIFI Verification System shared based on circle of friends | |
| CN102811335B (en) | Set up the method, apparatus and system of video session | |
| CN110248364B (en) | IOT equipment network distribution method, device, equipment and medium | |
| CN106604119B (en) | Network penetration method and system for private cloud equipment of smart television | |
| WO2017215215A1 (en) | Method for switching downloading mode, and control method and control system therefor | |
| CN102843391A (en) | Information transmitting method and gateway | |
| WO2014161478A1 (en) | Switching method for network interfaces, access device and computer storage medium | |
| CN106656648B (en) | Application flow dynamic protection method and system based on home gateway and home gateway | |
| CN110177128A (en) | Data transmission system and method for establishing VPN connection, terminal and VPN proxy thereof | |
| CN105635148B (en) | Portal authentication method and device | |
| US20040054781A1 (en) | Method for establishing point to point or point to multiple points internet connection(s) | |
| CN110856145A (en) | IOT device and user binding method, device and medium based on near field authentication | |
| CN106470252B (en) | The method and communication terminal of application program inquiry IP address | |
| JP4290125B2 (en) | Server device | |
| CN105978774A (en) | Access authentication method and device | |
| CN105791290A (en) | Authentication method and device for network connection |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| WD01 | Invention patent application deemed withdrawn after publication | ||
| WD01 | Invention patent application deemed withdrawn after publication |
Application publication date: 20151111 |