WO2017092501A1

WO2017092501A1 - Method and system for network certification

Info

Publication number: WO2017092501A1
Application number: PCT/CN2016/101386
Authority: WO
Inventors: 乐毅
Original assignee: 上海斐讯数据通信技术有限公司
Priority date: 2015-12-04
Filing date: 2016-09-30
Publication date: 2017-06-08
Also published as: CN105376739A; CN105376739B

Abstract

The present invention provides a method and system for network certification, the method comprising: establishing a roaming group at a cloud AC, and dividing APs from one same roaming group into one same Layer 2 multicast domain, such that upon sending out a certification request by a station to a target AP, it is determined whether or not a local certification list of the target AP includes association certification information between a roaming group AP where the target AP is located and the station; if the local certification list of the target AP includes the association certification information between the roaming group AP where the target AP is located and the station, approving the certification via the station. When the cloud AC and the AP are located in different local area networks, the method for network certification reduces processes when requesting certification across public networks and increases certification efficiency, thereby achieving painless certification at a station.

Description

Network authentication method and system

The present application claims priority to Chinese Patent Application No. 201510891807.3, entitled "Network Authentication Method and System", filed on Dec. 4, 2015, the entire disclosure of which is incorporated herein.

Technical field

The present invention relates to the field of communications technologies, and in particular, to a network authentication method and system.

Background technique

The coverage of current wireless networks is getting larger and larger, and mobile terminal devices such as mobile phones are becoming more and more popular. Internet access through WiFi (WIreless-FIdelity) has become the mainstream method. The traditional wireless network management mode AC (Access Controller or Wireless Access Point) The controller (access controller) and the AP (Wireless Access Point) are deployed locally, and belong to the centralized management of the same LAN (Local Area Network) network, and the data services of the AP are all controlled by the AC. And forwarding, so when the terminal roams, all terminals are still authenticated by the Radius server in the same LAN network. However, when the end user roams and switches every time, a Portal authentication request is initiated, and the user inputs a user name password or a short message authentication, thereby seriously affecting the user experience.

For this reason, the existing wireless roaming non-aware authentication is established in the same LAN network management mode. When the first Portal authentication is performed by the Radius server, the terminal MAC address is previously bound to the username and password. The AP, the AC, and the Radius server automatically participate in and complete the Portal authentication, so that the user experiences non-aware authentication (ie, roaming-free authentication). ), greatly improving the user experience. Moreover, since the forwarding delay of the authentication packet is very small, the authentication packet forwarding efficiency is high because the AP and the AC are in the same LAN network.

When the WLAN is deployed on the cloud, the AC is deployed on the public cloud server. The AP is not in the same LAN as the AP. The AP does not manage the AP. The data service of the AP is not controlled and forwarded by the cloud. At the same time, the cloud AC also integrates the authentication service function, which enables remote authentication across the Internet.

In the cloud AC, if the roaming non-aware authentication is still used in the traditional mode, frequent authentication interactions between the AP and the cloud AC will seriously affect the roaming experience of the user. This is because in the cloud AC mode, the AP and the cloud AC are transmitted across the public network. When the network status is poor, the forwarding delay of authentication packets will be multiplied, and even packets will be lost, causing users to switch when roaming. Very slow, even roaming failure, seriously affecting the user's roaming experience.

Summary of the invention

In view of the above-mentioned shortcomings of the prior art, an object of the present invention is to provide a network authentication method and system for solving the problems of long delay in network authentication, packet loss and low authentication efficiency in the prior art.

To achieve the above and other related purposes, the present invention provides a network authentication method, where the network authentication method includes the following steps: a cloud AC establishes a roaming group, and the APs in the same roaming group are divided into the same layer 2 multicast domain. The roaming group includes two or more APs, and the AP includes a local authentication list of the roaming group in which the AP is located. When the website sends an authentication request to the target AP, it is determined whether the target authentication list includes the target in the local authentication list. The association authentication information between the AP and the site in the roaming group where the AP is located; if yes, the site passes the authentication.

In an embodiment of the present invention, when the site sends an authentication request to the target AP, if the local authentication list of the target AP does not include the associated authentication information of the AP and the site in the roaming group where the target AP is located, The site sends a Portal authentication request to the cloud AC.

In an embodiment of the present invention, when the site sends a Portal authentication request to the cloud AC, if the authentication is passed, the associated authentication information of the target AP and the site is formed, and the associated authentication is formed. The information is stored in a local authentication list of the target AP.

In an embodiment of the present invention, after the roaming group is established in the cloud AC, and the AP in the same roaming group is divided into the same layer 2 multicast domain, the network authentication method further includes: the cloud AC The roaming group ID of the roaming group and the broadcast domain local area network ID of the layer 2 multicast domain notify all APs in the roaming group, and the roaming group ID is in one-to-one correspondence with the broadcast domain local area network ID.

In an embodiment of the invention, the association authentication information includes an association relationship between a feature code of the AP and a MAC address of the site.

In an embodiment of the present invention, the association authentication information further includes a site status corresponding to a MAC address of the site, where the site status includes an active state, an intermediate state, and an invalid state; and the AP receives an association request of the site. When the AP receives the de-association request from the site, the site status of the associated authentication information corresponding to the site that sends the association request is modified to The intermediate state; when the time when the site state is in the intermediate state exceeds the first time threshold in the associated authentication information, the site state of the site in the associated authentication information is modified to an invalid state.

In an embodiment of the present invention, the network authentication method further includes updating a local authentication list of the AP every second time threshold; updating the local authentication list of the AP every second time threshold includes: The second time threshold is that the AP sends Layer 2 multicast packets to all the APs in the roaming group. The Layer 2 multicast packet includes the AP and the site status of the Layer 2 multicast packet being in the intermediate state and valid. The associated authentication information of the site in the state and the roaming group ID of the roaming group where the AP transmitting the Layer 2 multicast message is located; each AP in the roaming group receives the Layer 2 multicast packet, and according to the second layer The roaming group ID in the multicast packet is confirmed to be in the same roaming group as the AP that sends the Layer 2 multicast packet; if yes, the associated authentication information in the Layer 2 multicast packet is added to its local authentication list, and the added association is recorded. The broadcast domain LAN ID corresponding to the authentication information.

In an embodiment of the present invention, the network authentication method further includes: if the AP does not send Layer 2 multicast packets to all APs in the roaming group in which the AP is within the third time threshold, the other roaming group The AP deletes the associated authentication information of the AP in its local authentication list.

Correspondingly, the present invention further provides a network authentication system, where the network authentication system includes: a cloud AC, which is used to establish a roaming group, and divides the APs in the same roaming group into the same layer 2 multicast domain. The roaming group includes two or more APs; the AP includes a local authentication list of the roaming group in which the roaming group is located, and the AP is configured to receive an authentication request sent by the station, and determine whether the local authentication list includes the AP in the roaming group and the The associated authentication information of the site; and when the local authentication list includes the associated authentication information of the AP in the roaming group and the site, the site is authenticated; the site is used to send an authentication request to the target AP, and When the local authentication list of the target AP does not include the association authentication information between the AP and the site in the roaming group where the target AP is located, the portal authentication request is sent to the cloud AC; the target AP is also used at the site. When the portal authentication is performed, the association authentication information of the target AP and the site is formed, and the formed association authentication information is stored in a local authentication column of the target AP. In.

In an embodiment of the present invention, the cloud AC further includes: a roaming group establishing unit, configured to establish a roaming group, and divide the APs in the same roaming group into the same layer 2 multicast domain; The portal user authentication information is verified at the receiving site.

In an embodiment of the present invention, the AP further includes: a storage unit, configured to store a local authentication list of the roaming group where the AP is located; an authentication request receiving unit, configured to receive an authentication request sent by the station; and an authentication verification unit, And the connection between the authentication request receiving unit and the storage unit, configured to determine whether the local authentication list includes the associated authentication information of the AP in the roaming group and the site, and is used to include the roaming group in the local authentication list. When the AP associates the authentication information with the site, the site is authenticated.

In an embodiment of the present invention, the cloud AC further includes a group information sending unit, configured to notify the roaming group ID of the roaming group and the broadcast domain local area network ID of the layer 2 multicast domain to all APs in the roaming group. The roaming group ID is in one-to-one correspondence with the broadcast domain local area network ID. The AP further includes a group information receiving unit, configured to receive a roaming group ID of the roaming group where the AP is located, and a broadcast domain local area network of the layer 2 multicast domain. The storage unit is connected to the group information receiving unit, and the storage unit is further configured to store a roaming group ID of the roaming group where the AP is located and a broadcast domain local area network ID of the layer 2 multicast domain.

In an embodiment of the invention, the association authentication information includes an association between a feature code of the AP and a MAC address of the site. a relationship and a site status corresponding to the MAC address of the site; the site state includes a valid state, an intermediate state, and an invalid state; the AP further includes: a multicast packet sending unit, connected to the storage unit, configured to: Sending, by the second time threshold, the Layer 2 multicast packet to all the APs in the roaming group where the AP is located, where the Layer 2 multicast packet includes the AP and the site status of the Layer 2 multicast packet being in an intermediate state. The associated authentication information of the site in the active state and the roaming group ID of the roaming group in which the AP is located; the multicast packet receiving unit is configured to receive the Layer 2 multicast packet sent by the AP in the roaming group of the AP; the association request receiving unit And an association request and a disassociation request for receiving the site; the list update unit is connected to the storage unit, the multicast packet receiving unit, and the association request receiving unit, and configured to receive the association request of the site at the association request receiving unit. Modifying the site status of the corresponding station in the associated authentication information to a valid state; and when the association request receiving unit receives the disassociation request of the site, the associated authentication is performed. Modifying the site status of the corresponding station in the information to an intermediate state; and modifying the site state of the site in the associated authentication information to an invalid state when the time when the site state is in the intermediate state exceeds the first time threshold in the associated authentication information; The list updating unit is further configured to: when the roaming group ID in the Layer 2 multicast packet is confirmed, the AP and the AP that sends the Layer 2 multicast packet are in the same roaming group, and the associated authentication information is in the Layer 2 multicast packet. Adding to the local authentication list of the AP, and recording the broadcast domain local area network ID corresponding to the added associated authentication information.

In an embodiment of the present invention, the list updating unit is further configured to delete the local authentication list including the AP when the layer 2 multicast packet sent by the AP in the roaming group is not received within the third time threshold range. Associate authentication information.

As described above, the network authentication method and system of the present invention have the following beneficial effects:

The cloud AC establishes a roaming group, and divides the APs in the same roaming group into the same layer 2 multicast domain, so that when the site sends an authentication request to the target AP, it is first determined whether the local authentication list of the target AP includes the The association authentication information of the AP and the site in the roaming group where the target AP is located; and when the local authentication list of the target AP includes the association authentication information between the AP and the site in the roaming group where the target AP is located, the site passes Certification. When the AC and the AP are in different LANs, when the site passes the authentication of an AP in the roaming group, the successful authentication result is notified to other APs in the roaming group in the form of associated authentication information, thereby roaming to the roaming group at the site. The other APs are authenticated by the local authentication list, so that the site does not need to participate in the secondary portal authentication. This prevents the remote cloud from obtaining authentication information and reduces cross-public authentication requirements. The process improves the authentication efficiency and achieves the siteless authentication.

DRAWINGS

FIG. 1 is a schematic flowchart showing an embodiment of a network authentication method according to an embodiment of the present invention.

FIG. 2 is a schematic structural diagram of an embodiment of a network authentication system according to the present invention.

FIG. 3 is a schematic structural diagram of a cloud AC in an embodiment of a network authentication system according to the present invention.

FIG. 4 is a schematic structural diagram of an AP in an embodiment of a network authentication system according to the present invention.

Component label description

1 Network authentication system

21 Cloud AC

22 roaming group

221, 222, 223 AP

3 Cloud AC

31 roaming group building unit

32 certification unit

33 group information sending unit

4 AP

41 storage unit

42 authentication request receiving unit

43 Certification Verification Unit

44 group information receiving unit

45 Multicast Packet Sending Unit

46 Multicast Packet Receiving Unit

47 association request receiving unit

48 list update unit

S11~S16 steps

detailed description

The embodiments of the present invention are described below by way of specific examples, and those skilled in the art can readily understand other advantages and effects of the present invention from the disclosure of the present disclosure. The present invention may be embodied or applied in various other specific embodiments, and various modifications and changes can be made without departing from the spirit and scope of the invention. It should be noted that the features in the following embodiments and embodiments may be combined with each other without conflict.

It should be noted that the illustrations provided in the following embodiments merely illustrate the basic concept of the present invention in a schematic manner, and only the components related to the present invention are shown in the drawings, rather than the number and shape of components in actual implementation. Dimensional drawing, the actual type of implementation of each component type, number and proportion can be a random change, and its component layout type may also be more complex miscellaneous.

When the cloud AC and the AP are in different LANs, the cloud AC establishes a roaming group and divides the APs in the same roaming group from the same Layer 2 multicast domain. After the site passes the AP authentication in the roaming group, the AP is formed. Correlation authentication information with the site; and the formed association authentication information is sent to all APs in the roaming group by means of Layer 2 multicast; thereby, when the site roams to other APs in the roaming group, according to local authentication of other APs The authentication information in the list is used to authenticate the local authentication. This prevents local authentication to the secondary AC. This prevents the remote network from obtaining authentication information. This reduces the process of cross-public authentication and improves the authentication efficiency. Non-inductive certification.

Referring to FIG. 1 , the present invention provides a schematic flowchart of a network authentication method. The network authentication method in Figure 1 includes:

In step S11, the cloud AC establishes a roaming group, and divides the APs in the same roaming group into the same layer 2 multicast domain. At this time, the cloud AC establishes a TCP management channel with each AP, thereby implementing management on the AP.

In this embodiment, the roaming group includes two or more APs, and the AP includes a local authentication list of the roaming group in which the AP is located.

Specifically, the number of APs included in each roaming group should not be too large, and 32 APs can be defaulted. Generally, only one roaming group is included in a Layer 2 multicast domain, and each roaming group has only one group owner. An AP may be in two Layer 2 multicast domains, that is, the AP may be in two roaming groups. However, in the same Layer 2 multicast domain, it is impossible to include two roaming groups. All APs in the same roaming group communicate through Layer 2 multicast.

In step S12, the station sends an authentication request to the target AP.

In step S13, it is determined whether the local authentication list of the target AP includes the associated authentication information of the AP and the site in the roaming group where the target AP is located.

In step S13, if the local authentication list of the target AP includes the associated authentication information of the AP and the site in the roaming group where the target AP is located, step S14 is performed; if the local authentication list of the target AP is not Step S15, the site sends a Portal authentication request to the cloud AC, and then performs step S16, and when the Portal authentication is passed, the method is formed, including the association authentication information of the AP and the site in the roaming group where the target AP is located. The associated authentication information of the target AP and the site is stored, and the formed associated authentication information is stored in a local authentication list of the target AP.

In this embodiment, the cloud AC establishes a roaming group, and divides the APs in the same roaming group into the same layer 2 multicast domain, so as to determine the local authentication of the target AP when the station sends an authentication request to the target AP. Whether the association authentication information of the AP and the site in the roaming group where the target AP is located is included in the list; and the local authentication list of the target AP includes the association authentication between the AP and the site in the roaming group where the target AP is located. When the information is available, the site is certified. When the AC and the AP are in different LANs, when the site passes the authentication of an AP in the roaming group, the successful authentication result is notified to other APs in the roaming group in the form of associated authentication information, thereby roaming to the roaming group at the site. In other APs, the site is directly authenticated according to the associated authentication information in its local authentication list, without the need for the cloud AC to participate in the second time. Portal authentication avoids obtaining authentication information from the remote cloud AC, reduces the process of cross-public network authentication request, improves authentication efficiency, and achieves site-insensitive authentication.

In an embodiment, after the roaming group is established in the cloud AC, and the APs in the same roaming group are divided into the same layer 2 multicast domain, the network authentication method further includes: the cloud AC to the roaming group The roaming group ID and the broadcast domain local area network ID of the layer 2 multicast domain notify all APs in the roaming group, and the roaming group ID is in one-to-one correspondence with the broadcast domain local area network ID. While the cloud AC notifies the roaming group ID and the broadcast domain local area network ID to all APs in the roaming group, the roaming group AP synchronously switches to the roaming authentication mode.

In another embodiment, the association authentication information includes an association relationship between a feature code (SN) of the AP and a MAC address (STA MAC) of the station. For example, it can be recorded as <AP SN, STA MAC>. The association authentication information further includes a site status corresponding to a MAC address of the site, and the site state includes an active state, an intermediate state, and an invalid state.

Specifically, when the AP receives the association request of the site, the AP changes the site status of the associated authentication information corresponding to the site that sends the association request to a valid state; when the AP receives the association request of the site, the AP sends an association request with the association request. The site status of the associated authentication information in the site is modified to an intermediate state. When the time when the site state is in the intermediate state exceeds the first time threshold in the associated authentication information, the site state of the site in the associated authentication information is modified to an invalid state.

Specifically, the site may be disassociated from the AP according to an IEEE 802.11 standard protocol.

In this embodiment, the network authentication method further includes updating the local authentication list of the AP every second time threshold. Updating the local authentication list of the AP every second time threshold specifically includes:

The AP sends a Layer 2 multicast packet to all APs in the roaming group in the second time threshold. The Layer 2 multicast packet includes the AP and the site status of the Layer 2 multicast packet. The associated authentication information of the site in the state and the valid state, and the roaming group ID of the roaming group where the AP transmitting the Layer 2 multicast message is located;

Each AP in the roaming group receives the Layer 2 multicast packet, and confirms whether it is in the same roaming group as the AP that sends the Layer 2 multicast packet according to the roaming group ID in the Layer 2 multicast packet; if yes, The associated authentication information in the layer multicast packet is added to its local authentication list, and the broadcast domain local area network ID corresponding to the added associated authentication information is recorded.

In this embodiment, when the associated authentication information in the Layer 2 multicast packet is added to the local authentication list, the broadcast domain local area network ID corresponding to the added associated authentication information is also recorded. Therefore, in an AP that is in a different roaming group, it is convenient to distinguish the associated authentication information of different roaming groups.

Specifically, the second time threshold may be an integer multiple of the first time threshold, so that the site status of the site in the associated authentication information is modified when the local authentication list is updated.

Compared with the first embodiment, the present embodiment only multicasts all the APs in the roaming group in the form of Layer 2 multicast packets by using the associated authentication information in the active state and the intermediate state of the site to filter and remove the site status. Invalid state Associate authentication information to reduce unnecessary Layer 2 multicast packet transmission, improve packet transmission rate, and improve authentication efficiency.

In another embodiment, the network authentication method further includes: if the AP does not send Layer 2 multicast packets to all APs in the roaming group in the third time threshold, the other APs in the roaming group are deleted. The local authentication list includes the associated authentication information of the AP.

Specifically, the third time threshold may be an integer multiple of the first time threshold, so that the associated authentication information in the local authentication list is filtered when the local authentication list is updated, so that the local authentication list of the AP implements an aging mechanism, thereby In the network authentication process, when determining whether the local authentication list includes the associated authentication information of other APs in the roaming group and the site, the amount of information screening is reduced, and the authentication efficiency is improved.

Please refer to FIG. 2 , which is a schematic structural diagram of a network authentication system according to an embodiment of the present invention. The network authentication system 2 in Figure 2 includes:

The cloud AC21 is configured to establish the roaming group 22, and divide the AP221 and the AP 222 in the same roaming group 22 into the same layer 2 multicast domain, where the roaming group 22 includes two APs;

Both the AP221 and the AP 222 include a local authentication list of the roaming group 22 in which the AP221 (or the AP 222) is configured to receive the authentication request sent by the station, and determine whether the local authentication list includes the AP 222 (or the AP 221) in the roaming group. The associated authentication information of the site; and when the local authentication list includes the associated authentication information of the AP 222 (or the AP 221) in the roaming group and the site, the site is authenticated;

a site (not shown), configured to send an authentication request to the target AP (AP221 or AP 222), and does not include the roaming of the target AP (AP221 or AP222) in the local authentication list of the target AP (AP221 or AP222) Sending a Portal authentication request to the cloud AC 21 when the AP (AP 222 or AP 221) associates the authentication information with the site;

The target AP (AP221 or AP222) is further configured to form association authentication information of the target AP (AP221 or AP222) with the site when the site passes the portal authentication, and form the associated authentication information. It is stored in the local authentication list of the target AP (AP221 or AP222).

In this embodiment, the roaming group 22 includes two APs (AP221 and AP222), and both the AP221 and the AP222 include a local authentication list of the roaming group 22 in which they are located.

In other embodiments, the roaming group 22 may further include two or more APs, such as three, four, and ten APs, but is not limited thereto.

Specifically, the number of APs included in each roaming group should not be too large, and 32 APs can be defaulted. Generally, only one roaming group is included in a Layer 2 multicast domain, and each roaming group has only one group owner. An AP may be in two Layer 2 multicast domains, that is, the AP may be in two roaming groups. However, in the same Layer 2 multicast domain, it is impossible to include two roaming groups. All APs in the same roaming group communicate through Layer 2 multicast. As shown in Figure 2, the three APs AP221, AP222, and AP223 managed by the cloud AC may be in another Layer 2 multicast domain with the AP223 to form another roaming group.

In this embodiment, the site is used for connecting a mobile terminal (such as a mobile phone, a tablet, etc.) with an AP.

In this embodiment, when the cloud AC and the AP are in different local area networks, when the site passes the authentication of one AP in the roaming group, the result of the successful authentication is notified to other APs in the roaming group in the form of the associated authentication information, thereby When the site roams to other APs in the roaming group, the site is directly authenticated according to the associated authentication information in the local authentication list. The cloud AC does not need to participate in the secondary portal authentication, and the authentication information is obtained from the remote cloud AC. The process of network authentication request improves the authentication efficiency and realizes the siteless authentication.

Referring to FIG. 3, it is a schematic structural diagram of a cloud AC in an embodiment of the network authentication system of the present invention. The cloud AC3 in Figure 3 includes:

The roaming group establishing unit 31 is configured to establish a roaming group, and divide the APs in the same roaming group into the same layer 2 multicast domain;

The authentication unit 32 is configured to receive a Portal authentication request of the site, and verify user information of the site.

The group information sending unit 33 is connected to the roaming group establishing unit 31, and is configured to notify the roaming group ID of the roaming group and the broadcast domain local area network ID of the layer 2 multicast domain to all APs in the roaming group, the roaming The group ID is in one-to-one correspondence with the broadcast domain local area network ID.

In another embodiment, the cloud AC3 may not include the group information sending unit 33.

FIG. 4 is a schematic structural diagram of an AP in an embodiment of a network authentication system according to the present invention. In this embodiment, the association authentication information includes an association between a feature code of the AP and a MAC address of the site, and a site status corresponding to the MAC address of the site (recordable as <AP SN, STA MAC>); The site status includes a valid state, an intermediate state, and an invalid state; in Figure 4, AP4 includes:

The storage unit 41 is configured to store a local authentication list of the roaming group where the AP is located;

The authentication request receiving unit 42 is configured to receive an authentication request sent by the station;

The authentication verification unit 43 is connected to the authentication request receiving unit 42 and the storage unit 41, and is configured to determine whether the local authentication list includes the associated authentication information of the AP in the roaming group and the site, and is used in the local authentication list. When the associated authentication information of the AP in the roaming group and the site is included in the roaming group, the site is authenticated;

The group information receiving unit 44 is connected to the storage unit 41, and configured to receive the roaming group ID of the roaming group where the AP is located and the broadcast domain local area network ID of the layer 2 multicast domain; the storage unit 41 is further configured to store the The roaming group ID of the roaming group where the AP is located and the broadcast domain local area network ID of the layer 2 multicast domain;

The multicast packet sending unit 45 is connected to the storage unit 41, and is configured to send a Layer 2 multicast packet to all APs in the roaming group where the AP is located every second time threshold, where the Layer 2 multicast packet includes The association authentication information of the AP that sends the Layer 2 multicast packet and the site whose site status is the intermediate state and the active state, and the roaming group ID of the roaming group where the AP is located;

The multicast packet receiving unit 46 is configured to receive a Layer 2 multicast packet sent by the AP in the roaming group of the AP.

The association request receiving unit 47 is configured to receive an association request and a disassociation request of the site;

The list updating unit 48 is connected to the storage unit 41, the multicast packet receiving unit 46, and the association request receiving unit 47, and is configured to associate the authentication information when the association request receiving unit 47 receives the association request of the site. Modifying the site status of the corresponding station to an active state; when the association request receiving unit 47 receives the de-association request of the site, modifying the site status of the corresponding station in the associated authentication information to an intermediate state; When the time when the site state is in the intermediate state exceeds the first time threshold, the site state of the site in the associated authentication information is modified to an invalid state; the list updating unit 48 is further configured to roam in the layer 2 multicast packet. When the group ID confirms that the AP is in the same roaming group as the AP that sends the Layer 2 multicast packet, the associated authentication information in the Layer 2 multicast packet is added to the local authentication list of the AP, and the associated authentication information is recorded. Corresponding broadcast domain LAN ID.

In this embodiment, when the associated authentication information in the Layer 2 multicast packet is added to the local authentication list, the list update unit 48 also records the broadcast domain local area network ID corresponding to the added associated authentication information. Therefore, in an AP that is in a different roaming group, it is convenient to distinguish the associated authentication information of different roaming groups.

In this embodiment, the network authentication system multicasts all the APs in the roaming group in the form of Layer 2 multicast packets to the associated authentication information in the active state and the intermediate state. Authentication information reduces unnecessary Layer 2 multicast packet transmission, improves packet transmission rate, and improves authentication efficiency.

In another embodiment, the list updating unit 48 is further configured to delete the association of the AP in the local authentication list when the Layer 2 multicast packet sent by the AP in the roaming group is not received within the third time threshold. Certification Information. The aging mechanism of the local authentication list of the AP is implemented, so that when the local authentication list includes the associated authentication information of other APs in the roaming group and the site in the network authentication process, the amount of information screening is reduced, and the authentication efficiency is improved.

In summary, the network authentication method and system of the present invention, when the cloud AC and the AP are in different local area networks, notify the location of the successful authentication result in the form of associated authentication information when the site passes the authentication of one AP in the roaming group. The other APs in the roaming group, so that when the site roams to other APs in the roaming group, the site is directly authenticated according to the associated authentication information in the local authentication list, and the cloud AC is not required to participate in the secondary portal authentication. Obtaining the authentication information reduces the process of cross-public network authentication request, improves the authentication efficiency, and realizes the site's non-inductive authentication. Therefore, the present invention effectively overcomes various shortcomings in the prior art and has high industrial utilization value.

The above-described embodiments are merely illustrative of the principles of the invention and its effects, and are not intended to limit the invention. Any familiar with this technique Modifications or variations of the above embodiments may be made by those skilled in the art without departing from the spirit and scope of the invention. Therefore, all equivalent modifications or changes made by those skilled in the art without departing from the spirit and scope of the invention will be covered by the appended claims.

Claims

A network authentication method, characterized in that the network authentication method comprises the following steps:

The cloud AC establishes a roaming group, and divides the APs in the same roaming group into the same layer 2 multicast domain, where the roaming group includes more than two APs, and the AP includes a local authentication list of the roaming group in which the roaming group is located;

When the site sends an authentication request to the target AP, it is determined whether the local authentication list of the target AP includes the associated authentication information between the AP and the site in the roaming group where the target AP is located;

If so, the site is authenticated.
The network authentication method according to claim 1, wherein when the site sends an authentication request to the target AP, if the local authentication list of the target AP does not include the AP and the site in the roaming group where the target AP is located The associated authentication information, the site sends a Portal authentication request to the cloud AC.
The network authentication method according to claim 2, wherein when the site sends a Portal authentication request to the cloud AC, if the authentication is passed, the associated authentication information of the target AP and the site is formed, and The formed associated authentication information is stored in a local authentication list of the target AP.
The network authentication method according to claim 1, wherein after the cloud AC establishes a roaming group and the APs in the same roaming group are divided into the same layer 2 multicast domain, the network authentication method further includes: The cloud AC notifies the roaming group ID of the roaming group and the broadcast domain local area network ID of the layer 2 multicast domain to all APs in the roaming group, and the roaming group ID corresponds to the broadcast domain local area network ID. .
The network authentication method according to claim 4, wherein the association authentication information includes an association relationship between a feature code of the AP and a MAC address of the site.
The network authentication method according to claim 5, wherein the associated authentication information further includes a site status corresponding to a MAC address of the site, and the site state includes an active state, an intermediate state, and an invalid state;

When the AP receives the association request of the site, the site status of the associated authentication information corresponding to the site that sends the association request is modified to a valid state; when the AP receives the disassociation request of the site, the AP corresponds to the site that sends the association request. The site status of the associated authentication information is modified to an intermediate state. When the time when the site state is in the intermediate state exceeds the first time threshold in the associated authentication information, the site state of the site in the associated authentication information is modified to an invalid state.
The network authentication method according to claim 6, wherein the network authentication method further comprises updating a local authentication list of the AP every second time threshold; updating the local authentication of the AP every second time threshold List package include:

The AP sends a Layer 2 multicast packet to all APs in the roaming group in the second time threshold. The Layer 2 multicast packet includes the AP and the site status of the Layer 2 multicast packet. The associated authentication information of the site in the state and the valid state, and the roaming group ID of the roaming group where the AP transmitting the Layer 2 multicast message is located;

Each AP in the roaming group receives the Layer 2 multicast packet, and confirms whether it is in the same roaming group as the AP that sends the Layer 2 multicast packet according to the roaming group ID in the Layer 2 multicast packet; if yes, The associated authentication information in the layer multicast packet is added to its local authentication list, and the broadcast domain local area network ID corresponding to the added associated authentication information is recorded.
The network authentication method according to claim 7, wherein the network authentication method further comprises: if the AP does not send Layer 2 multicast packets to all APs in the roaming group in the third time threshold, The other APs in the roaming group delete the associated authentication information including the AP in the local authentication list.
A network authentication system, characterized in that the network authentication system comprises:

The cloud AC is used to establish a roaming group, and divides the APs in the same roaming group into the same layer 2 multicast domain, where the roaming group includes more than two APs;

The AP includes a local authentication list of the roaming group in which the AP is located, and the AP is configured to receive an authentication request sent by the station, and determine whether the local authentication list includes the associated authentication information of the AP in the roaming group and the site; and locally When the authentication list includes the associated authentication information of the AP in the roaming group and the site, the site is authenticated;

a site, configured to send an authentication request to the target AP, and send a Portal to the cloud AC when the local authentication list of the target AP does not include the associated authentication information of the AP and the site in the roaming group where the target AP is located. Authentication request;

The target AP is further configured to: when the site passes the portal authentication, form association authentication information of the target AP and the site, and store the formed association authentication information in a local authentication list of the target AP. in.
The network authentication system according to claim 9, wherein the cloud AC further comprises:

a roaming group establishing unit, configured to establish a roaming group, and divide the APs in the same roaming group into the same layer 2 multicast domain;

The authentication unit is configured to receive a Portal authentication request of the site, and verify the user information of the site.
The network authentication system according to claim 10, wherein the AP further comprises:

a storage unit, configured to store a local authentication list of the roaming group where the AP is located;

An authentication request receiving unit, configured to receive an authentication request sent by the station;

The authentication verification unit is connected to the authentication request receiving unit and the storage unit, and is configured to determine whether the local authentication list includes the associated authentication information of the AP in the roaming group and the site, and is used to include the local authentication list in the local authentication list. When the AP in the roaming group associates the authentication information with the site, the site is authenticated.
The network authentication system according to claim 11, wherein:

The cloud AC further includes a group information sending unit, configured to notify the roaming group ID of the roaming group and the broadcast domain local area network ID of the layer 2 multicast domain to all APs in the roaming group, the roaming group ID and the Broadcast domain LAN ID one-to-one correspondence;

The AP further includes a group information receiving unit, configured to receive a roaming group ID of the roaming group where the AP is located, and a broadcast domain local area network ID of the layer 2 multicast domain;

The storage unit is connected to the group information receiving unit, and the storage unit is further configured to store a roaming group ID of the roaming group where the AP is located and a broadcast domain local area network ID of the layer 2 multicast domain.
The network authentication system according to claim 12, wherein the associated authentication information includes an association relationship between a feature code of the AP and a MAC address of the site, and a site state corresponding to a MAC address of the site; The active state, the intermediate state, and the invalid state are included; the AP further includes:

The multicast packet sending unit is connected to the storage unit, and is configured to send a Layer 2 multicast packet to all APs in the roaming group where the AP is located, and the Layer 2 multicast packet includes a sending station. The associated authentication information of the AP of the Layer 2 multicast packet and the site whose state is the intermediate state and the active state, and the roaming group ID of the roaming group where the AP is located;

The multicast packet receiving unit is configured to receive a layer 2 multicast packet sent by the AP in the roaming group of the AP;

An association request receiving unit, configured to receive an association request and a disassociation request of the site;

a list updating unit, configured to be connected to the storage unit, the multicast packet receiving unit, and the association request receiving unit, configured to: when the association request receiving unit receives the association request of the site, associate the site status of the corresponding station in the authentication information Modifying to a valid state; when the association request receiving unit receives the disassociation request of the site, modifying the site status of the corresponding station in the associated authentication information to an intermediate state; and for using the site authentication state in the associated authentication information When the time of the state exceeds the first time threshold, the site state of the site in the associated authentication information is changed to an invalid state; the list updating unit is further configured to confirm the AP and send the data according to the roaming group ID in the Layer 2 multicast packet. When the APs of the Layer 2 multicast packets are in the same roaming group, the associated authentication information in the Layer 2 multicast packets is added. Adding to the local authentication list of the AP, and recording the broadcast domain local area network ID corresponding to the added associated authentication information.
The network authentication system according to claim 13, wherein the list updating unit is further configured to delete the local authentication when the layer 2 multicast packet sent by the AP in the roaming group is not received within the third time threshold range. The list includes the associated authentication information of the AP.