CN103118366A

CN103118366A - Wireless access point login method and user authentication method and device of wireless access point login

Info

Publication number: CN103118366A
Application number: CN2013100244251A
Authority: CN
Inventors: 胡虹; 范成龙
Original assignee: Beijing Autelan Technology Co Ltd
Current assignee: Beijing Hua Xinaotian Network Technology Co ltd
Priority date: 2013-01-23
Filing date: 2013-01-23
Publication date: 2013-05-22
Anticipated expiration: 2033-01-23
Also published as: CN103118366B

Abstract

Provided are a wireless access point login method and a user authentication method and a device of the wireless access point login. The wireless access point access point (AP) login method comprises carrying out the following steps in a first network device: (1) receiving login requests including a media access control (MAC) address and a first radio frequency mouth identification of the AP, (2) determining whether login is allowed to be carried out on the AP according to the received login requests and AP configuration information which is previously stored, wherein the AP configuration information comprises multiple AP configuration items, and each of the AP configuration items comprises the MAC address and the number of the radio frequency mouths on the AP, and (3) mapping the first radio frequency mouth identification to a second radio frequency mouth identification on the first network device if the fact whether login is allowed to be carried out on the AP is determined, then sending an activation request to a second network device, inserting an AP login item in AB login status message which is protected when activation responses including the second radio frequency mouth identification are received from the second network device, and then sending a response indicating and allowing the login of the AP, of the login request.

Description

WAP (wireless access point) register method and user authen method and device thereof

Technical field

The application relates to method, the user authen method of a kind of registration WAP (wireless access point) (AP) and the device that uses described method, relate in particular to and a kind ofly come burst ground that cordless communication network is managed by Radio Access Controller (AC) being carried out relaying, thereby support the technology of dissimilar AP.

Background technology

The framework of existing wireless lan (wlan) as shown in Figure 1, each AP communicates by letter with Radio Access Controller (AC) by bearer network, AC is configured and controls according to the AP of CAPWAP agreement to its management.In this framework, AC becomes unique management and the business outlet of whole WLAN.

But along with the progressively expansion of network size, single AC needs to manage up to ten thousand AP sometimes, and this has also proposed Secretary to WLAN.

At first, the enterprise with branch (such as each office of far-end) is when carrying out unified management, if adopt at present simple AC the AP scheme, can make network traffics roll up, easily be subject to the impact of network congestion, the efficiency of management is low; Simultaneously, if the network service of branch and general headquarters is broken down, also can cause the wireless coverage of branch to go wrong.

Secondly, also have the appearance of the AP of different forms in different zones, these AP also have different management expectancys.AC certainly will cause the increase of upgrading frequently and complexity for the characteristics of compatible these concrete AP.

Again, AC executes in complete or collected works and controls, and also easily causes AC to break down, thereby causes wireless coverage to go wrong.More typical example is, AC breaks down, and causes switching roaming between the AP of the user under whole AP and goes wrong.

Summary of the invention

The object of the present invention is to provide a kind of network equipment that is used for relay portion AC function by interpolation, WLAN is carried out the method and apparatus of split blade type management, thereby can support non-homogeneous AP in WLAN.

Another object of the present invention is to provide a kind of network equipment that is used for relay portion AC function by interpolation, WLAN is carried out the method and apparatus of split blade type management, thereby when AC breaks down, do not affect accessed user's communication function.

According to an aspect of the present invention, the method of a kind of registration WAP (wireless access point) (AP) is provided, be included in first network equipment and carry out following steps: A) receive from AP the registration request that comprises its MAC Address and the first radio frequency mouth sign, described the first radio frequency mouth sign is the sequence number of radio frequency mouth on described AP; B) determine whether to allow described AP registration according to the registration request that receives and pre-stored AP configuration information, described AP configuration information comprises a plurality of AP configuration items, and each AP configuration item comprises the MAC Address of AP and the number of the upper radio frequency mouth of described AP; C) if determine to allow described AP to register, carry out following operation: the second radio frequency mouth that described the first radio frequency mouth sign is mapped on first network equipment identifies; Send activation request to second network equipment, described activation request comprises MAC Address and the second radio frequency mouth sign of first network equipment; When receiving the activation response that comprises the second radio frequency mouth sign from second network equipment, insert the AP registration entries of the MAC Address, the first radio frequency mouth sign and the second radio frequency mouth sign that comprise AP in the AP registration status information of safeguarding, and send to described AP the response that indication allows the registration request of AP registration.

Preferably, by CAPWAP management tunnel sending and receiving registration request and a response thereof, pass through the 2nd CAPWAP management tunnel sending and receiving activation request and response thereof between first network equipment and second network equipment between first network equipment and AP.

Preferably, step C) also comprise: when receiving the registration request that comprises its MAC Address and the first radio frequency mouth sign from AP, search in the AP of its maintenance registration status information with the registration request that receives in MAC Address and the marking matched AP registration entries of the first radio frequency mouth, and if find the AP registration entries of coupling, send to described AP the response that indication allows the registration request of AP registration.

Preferably, the AP configuration item also comprises the information about the AP type.

Preferably, at step B) in, if the first radio frequency mouth that receives is identified in scope into the number of the radio frequency mouth in the AP configuration item of described AP configuration, determine to allow described AP registration.

Preferably, described method also comprises: if D) receive the response of the refusal activation that comprises the second radio frequency mouth sign from second network equipment, send the response of the registration request of indication refusal AP registration to described AP.

Preferably, described method also comprises: if receive the un-register request of the MAC Address that comprises AP and the first radio frequency mouth sign from AP, send to second network equipment and cancel activation request, MAC Address and the second radio frequency mouth sign that request comprises first network equipment cancelled in described activation, reception comprises that the activation of cancelling of the second radio frequency mouth sign responds, comprise the AP configuration item of MAC Address and the first radio frequency mouth sign of AP from described AP registration status information deletion, and send the response of un-register request to described AP.

According to a further aspect in the invention, the method of a kind of registration WAP (wireless access point) (AP) is provided, is included in second network equipment and carries out following steps: comprise the MAC Address of first network equipment and the activation request of the second radio frequency mouth sign from the reception of first network equipment; Determine whether that according to described activation request and pre-stored virtual AP configuration information the second radio frequency mouth that allows to activate first network equipment identifies the radio frequency mouth of indicating, described virtual AP configuration information comprises a plurality of virtual AP configuration items, the MAC Address that each virtual AP configuration item comprises first network equipment with and the number of the radio frequency mouth supported; If determine that the second radio frequency mouth that allows to activate first network equipment identifies the radio frequency mouth of indicating, insertion comprises the MAC Address of first network equipment and the virtual AP registration entries of the second radio frequency mouth sign in the virtual AP registration status information of second network plant maintenance, and sends the activation response that comprises the second radio frequency mouth sign to described first network equipment.

Preferably, pass through the 2nd CAPWAP management tunnel sending and receiving activation request and response thereof between first network equipment and second network equipment.

Preferably, when receiving the activation request of the MAC Address that comprises first network equipment and the second radio frequency mouth sign from first network equipment, determine whether to have existed in described virtual AP registration status information and the MAC Address of first network equipment and the marking matched virtual AP registration entries of the second radio frequency mouth, if existed and the MAC Address of first network equipment and the marking matched virtual AP registration entries of the second radio frequency mouth, sent the activation response of the second radio frequency mouth sign in the virtual AP registration entries that comprises coupling to described first network equipment.

Preferably, in the step of the radio frequency mouth of the second radio frequency mouth sign indication that determines whether to allow to activate first network equipment according to described activation request and pre-stored virtual AP configuration information, if the second radio frequency mouth that receives is identified in scope into the number of the radio frequency mouth in the virtual AP configuration item of described first network equipment configuration, determine to allow to activate the radio frequency mouth of the second radio frequency mouth sign indication of first network equipment.

Preferably, described method also comprises: if determine that the second radio frequency mouth that does not allow to activate first network equipment identifies the radio frequency mouth of indicating, and comprises to the transmission of first network equipment the response that the refusal of the second radio frequency mouth sign activates.

Preferably, described method also comprises: if receive the activation request of cancelling of the MAC Address that comprises first network equipment and the second radio frequency mouth sign from first network equipment, the marking matched virtual AP registration entries of deletion and the MAC Address of first network equipment and the second radio frequency mouth from described virtual AP registration status information, and send to first network equipment and comprise that cancelling of the second radio frequency mouth sign activate response.

According to a further aspect in the invention, a kind of method that the user of wireless network is authenticated is provided, be included in and carry out following steps on first network equipment: comprise the MAC Address of user authentication information, AP and the first user authentication request of the first radio frequency mouth sign from WAP (wireless access point) (AP) reception, described the first radio frequency mouth sign is the sequence number of radio frequency mouth on described AP; Search from the AP registration status information of its maintenance and the MAC Address of described AP and the marking matched AP registration entries of the first radio frequency mouth, described AP registration status information comprises a plurality of AP registration entries, and each AP registration entries comprises MAC Address, the first radio frequency mouth sign and the second radio frequency mouth sign of AP; Send the second user authentication request of the second radio frequency mouth sign in the AP registration entries of the MAC Address of the user authentication information comprise reception, first network equipment and coupling to second network equipment; Receive the response of the second user authentication request from second network equipment, the response of described the second user authentication request comprises user ID, the second radio frequency mouth sign and indicates whether information by authentication; If determine by authentication according to the response of the second user authentication request that receives, insertion comprises the first user authentication state item of MAC Address and the first radio frequency mouth sign of user ID, AP in the first user authentication state information of safeguarding, and sends the response of indicating by the first user authentication request that authenticates to described AP.

Preferably, by CAPWAP management tunnel sending and receiving first user authentication request and a response thereof, pass through the 2nd CAPWAP management tunnel sending and receiving the second user authentication request and response thereof between first network equipment and second network equipment between first network equipment and AP.

Preferably, comprise the response of the information of the second user authentication request of the information by authentication of user ID, the second radio frequency mouth sign and indication if receive from second network equipment, send to described AP and comprise the response of the first user authentication request of the information by authentication of described user ID and indication.

preferably, described method also comprises: when receiving described first user authentication request from described AP, search the first user authentication state item with the user ID coupling that receives in first user authentication state information, if find the MAC Address of the AP in the first user authentication state item of the first user authentication state item of coupling and coupling different from the MAC Address of the AP of reception, carry out following operation: search and the MAC Address of the AP that receives and the marking matched AP registration entries of the first radio frequency mouth from the AP registration status information, to comprise user ID, the user of the second radio frequency mouth sign in the AP registration entries of the MAC Address of first network equipment and coupling authenticates update request and sends to second network equipment, receive from second network equipment the response that the user who comprises user ID and the second radio frequency mouth sign authenticates update request, the MAC Address of AP in the first user authentication state item of coupling and the first radio frequency mouth sign are updated to respectively MAC Address and the first radio frequency mouth sign of the AP in the first user authentication request of reception, and will comprise that user ID and indication send to described AP by the response of the first user authentication request of authentication.

Preferably, described method also comprises: if receive the cancellation authentication request that comprises user ID from described AP, and the first user authentication state item that deletion and described user ID are mated from first user authentication state information.

According to a further aspect in the invention, provide a kind of method that the user of wireless network is authenticated, be included in and carry out following steps on second network equipment:

Comprise the MAC Address of user authentication information, first network equipment and the user authentication request of radio frequency mouth sign from the reception of first network equipment;

Use the user authentication information in the user authentication request that receives, by certificate server, the user is carried out authentication;

If from certificate server obtain by the authentication authentication result, insertion comprises the MAC Address of user ID, first network equipment and the user authentication status item that the radio frequency mouth identifies in the user authentication status information of safeguarding, and send the response of described user authentication request to first network equipment, the response of described user authentication request comprises that user ID, the second radio frequency mouth sign and indication are by the information of authentication.

Preferably, pass through the 2nd CAPWAP management tunnel sending and receiving user authentication request and response thereof between first network equipment and second network equipment.

Preferably, described method also comprises: if obtain the authentication result of not passing through authentication from certificate server, send to first network equipment the response that comprises that user ID, the second radio frequency mouth identify and indicate the user authentication request of the information of passing through authentication.

preferably, described method also comprises: comprise user authentication information when receiving from first network equipment, during the user authentication request of the MAC Address of first network equipment and the second radio frequency mouth sign, the user authentication status item of the user ID coupling of searching in described user authentication status information and receiving, if find the user authentication status item of coupling, the MAC Address and the second radio frequency mouth that MAC Address and the 2nd Raido sign of the first network equipment in the user authentication status item of coupling are updated to respectively the first network equipment in the user authentication request of reception identify, and send to first network equipment and comprise user ID, the second radio frequency mouth sign and indication are by the response of the user authentication request of the information of authentication.

preferably, described method also comprises: comprise user ID if receive from first network equipment, the user of the MAC Address of first network equipment and the second radio frequency mouth sign authenticates update request, MAC Address and the second radio frequency mouth that the user that the MAC Address that will authenticate the first network equipment in the user authentication status item of the user ID coupling in update request with the user who receives and the 2nd Raido sign are updated to respectively reception authenticates the first network equipment in update request identify, and comprise that to the transmission of first network equipment the user of the second radio frequency mouth sign of user ID and reception authenticates the response of update request.

Preferably, described method also comprises: if receive the cancellation authentication request that comprises user ID from first network equipment, and the user authentication status item that deletion and described user ID are mated from user authentication status information.

according to a further aspect in the invention, a kind of device of registering WAP (wireless access point) (AP) on first network equipment is provided, comprise: the first module, be used for receiving from AP the registration request that comprises its MAC Address and the first radio frequency mouth sign, described the first radio frequency mouth sign is the sequence number of radio frequency mouth on described AP, the second module, be used for determining whether to allow described AP registration according to the registration request that receives and pre-stored AP configuration information, described AP configuration information comprises a plurality of AP configuration items, and each AP configuration item comprises the MAC Address of AP and the number of the upper radio frequency mouth of described AP, the 3rd module, if be used for determining to allow described AP registration, described the first radio frequency mouth sign is mapped to the second radio frequency mouth sign on first network equipment, send activation request to second network equipment, described activation request comprises MAC Address and the second radio frequency mouth sign of first network equipment, when receiving the activation response that comprises the second radio frequency mouth sign from second network equipment, insert the MAC Address that comprises AP in the AP registration status information of safeguarding, the AP registration entries of the first radio frequency mouth sign and the second radio frequency mouth sign, and send to described AP the response that indication allows the registration request of AP registration.

Preferably, the 3rd module is when receiving the registration request that comprises its MAC Address and the first radio frequency mouth sign from AP, search in the AP of its maintenance registration status information with the registration request that receives in MAC Address and the marking matched AP registration entries of the first radio frequency mouth, and if find the AP registration entries of coupling, send to described AP the response that indication allows the registration request of AP registration.

Preferably, if the first radio frequency mouth that the second module determine to receive is identified in scope into the number of the radio frequency mouth in the AP configuration item of described AP configuration, the second module determines to allow described AP registration.

Preferably, described device also comprises: four module if be used for receiving from second network equipment the response of the refusal activation that comprises the second radio frequency mouth sign, sends the response of the registration request of indication refusal AP registration to described AP.

Preferably, described device also comprises: the 5th module, receive the MAC Address that comprises AP and the un-register request of the first radio frequency mouth sign if be used for from AP, send to second network equipment and cancel activation request, MAC Address and the second radio frequency mouth sign that request comprises first network equipment cancelled in described activation, reception comprises that the activation of cancelling of the second radio frequency mouth sign responds, comprise the AP configuration item of MAC Address and the first radio frequency mouth sign of AP from described AP registration status information deletion, and send the response of un-register request to described AP.

According to a further aspect in the invention, a kind of device in second network facility registration WAP (wireless access point) (AP) is provided, comprise: the first module is used for comprising the MAC Address of first network equipment and the activation request of the second radio frequency mouth sign from the reception of first network equipment; The second module, be used for determining whether that according to described activation request and pre-stored virtual AP configuration information the second radio frequency mouth that allows to activate first network equipment identifies the radio frequency mouth of indicating, described virtual AP configuration information comprises a plurality of virtual AP configuration items, the MAC Address that each virtual AP configuration item comprises first network equipment with and the number of the radio frequency mouth supported; The 3rd module, if be used for determining that permission activates the radio frequency mouth of the second radio frequency mouth sign indication of first network equipment, insertion comprises the MAC Address of first network equipment and the virtual AP registration entries of the second radio frequency mouth sign in the virtual AP registration status information of second network plant maintenance, and sends the activation response that comprises the second radio frequency mouth sign to described first network equipment.

Preferably, the first module is when receiving the activation request of the MAC Address that comprises first network equipment and the second radio frequency mouth sign from first network equipment, determine whether to have existed in described virtual AP registration status information and the MAC Address of first network equipment and the marking matched virtual AP registration entries of the second radio frequency mouth, if existed and the MAC Address of first network equipment and the marking matched virtual AP registration entries of the second radio frequency mouth, sent the activation response of the second radio frequency mouth sign in the virtual AP registration entries that comprises coupling to described first network equipment.

Preferably, the second module is when the radio frequency mouth of the second radio frequency mouth sign indication that determines whether to allow to activate first network equipment according to described activation request and pre-stored virtual AP configuration information, if the second radio frequency mouth that determine to receive is identified in scope into the number of the radio frequency mouth in the virtual AP configuration item of described first network equipment configuration, the second module determines to allow to activate the radio frequency mouth of the second radio frequency mouth sign indication of first network equipment.

Preferably, described device also comprises: four module if be used for determining that the second radio frequency mouth that does not allow to activate first network equipment identifies the radio frequency mouth of indicating, comprises to the transmission of first network equipment the response that the refusal of the second radio frequency mouth sign activates.

Preferably, described device also comprises: the 5th module, if be used for receiving from first network equipment the activation request of cancelling of the MAC Address that comprises first network equipment and the second radio frequency mouth sign, the marking matched virtual AP registration entries of deletion and the MAC Address of first network equipment and the second radio frequency mouth from described virtual AP registration status information, and send to first network equipment and comprise that cancelling of the second radio frequency mouth sign activate response.

According to a further aspect in the invention, a kind of device that on first network equipment, the user of wireless network is authenticated is provided, comprise: the first module, be used for comprising the MAC Address of user authentication information, AP and the first user authentication request of the first radio frequency mouth sign from WAP (wireless access point) (AP) reception, described the first radio frequency mouth sign is the sequence number of radio frequency mouth on described AP; The second module, be used for searching and the MAC Address of described AP and the marking matched AP registration entries of the first radio frequency mouth from the AP registration status information of its maintenance, described AP registration status information comprises a plurality of AP registration entries, and each AP registration entries comprises MAC Address, the first radio frequency mouth sign and the second radio frequency mouth sign of AP; The 3rd module is used for sending to second network equipment second user authentication request of the second radio frequency mouth sign of the AP registration entries of the MAC Address of the user authentication information that comprises reception, first network equipment and coupling; Four module is used for receiving from second network equipment the response of the second user authentication request, and the response of described the second user authentication request comprises user ID, the second radio frequency mouth sign and indicates whether information by authentication; The 5th module, determine by authentication according to the response of the second user authentication request that receives if be used for, insertion comprises the first user authentication state item of MAC Address and the first radio frequency mouth sign of user ID, AP in the first user authentication state information of safeguarding, and sends the response of indicating by the first user authentication request that authenticates to described AP.

Preferably, comprise the response of the information of the second user authentication request of the information by authentication of user ID, the second radio frequency mouth sign and indication if the 5th module is determined to receive from second network equipment, the 5th module sends to described AP and comprises the response of the first user authentication request of the information by authentication of described user ID and indication.

preferably, described device also comprises: the 6th module, be used for when receiving described first user authentication request from described AP, the first user authentication state item of the user ID coupling of searching in first user authentication state information and receiving, if find the MAC Address of the AP in the first user authentication state item of the first user authentication state item of coupling and coupling different from the MAC Address of the AP of reception, carry out following operation: search and the MAC Address of the AP that receives and the marking matched AP registration entries of the first radio frequency mouth from the AP registration status information, to comprise user ID, the user of the second radio frequency mouth sign in the AP registration entries of the MAC Address of first network equipment and coupling authenticates update request and sends to second network equipment, receive from second network equipment the response that the user who comprises user ID and the second radio frequency mouth sign authenticates update request, the MAC Address of AP in the first user authentication state item of coupling and the first radio frequency mouth sign are updated to respectively MAC Address and the first radio frequency mouth sign of the AP in the first user authentication request of reception, and will comprise that user ID and indication send to described AP by the response of the first user authentication request of authentication.

Preferably, described device also comprises: the 7th module, if be used for receiving from described AP the cancellation authentication request that comprises user ID, and the first user authentication state item that deletion and described user ID are mated from first user authentication state information.

According to a further aspect in the invention, a kind of device that on second network equipment, the user of wireless network is authenticated is provided, comprise: the first module is used for comprising the MAC Address of user authentication information, first network equipment and the user authentication request of radio frequency mouth sign from the reception of first network equipment; The second module for the user authentication information that uses the user authentication request that receives, is carried out authentication by certificate server to the user; The 3rd module, if for the authentication result that obtains from certificate server by authentication, insertion comprises the MAC Address of user ID, first network equipment and the user authentication status item that the radio frequency mouth identifies in the user authentication status information of safeguarding, and send the response of described user authentication request to first network equipment, the response of described user authentication request comprises that user ID, the second radio frequency mouth sign and indication are by the information of authentication.

Preferably, described device also comprises: four module, if for obtain the authentication result of not passing through authentication from certificate server, send to first network equipment the response that comprises that user ID, the second radio frequency mouth identify and indicate the user authentication request of the information of passing through authentication.

preferably, described device also comprises: the 6th module, be used for comprising user authentication information when receiving from first network equipment, during the user authentication request of the MAC Address of first network equipment and the second radio frequency mouth sign, the user authentication status item of the user ID coupling of searching in described user authentication status information and receiving, if find the user authentication status item of coupling, the MAC Address and the second radio frequency mouth that MAC Address and the 2nd Raido sign of the first network equipment in the user authentication status item of coupling are updated to respectively the first network equipment in the user authentication request of reception identify, and send to first network equipment and comprise user ID, the second radio frequency mouth sign and indication are by the response of the user authentication request of the information of authentication.

preferably, described device also comprises: the 7th module, comprise user ID if be used for receiving from first network equipment, the user of the MAC Address of first network equipment and the second radio frequency mouth sign authenticates update request, MAC Address and the second radio frequency mouth that the user that the MAC Address that will authenticate the first network equipment in the user authentication status item of the user ID coupling in update request with the user who receives and the 2nd Raido sign are updated to respectively reception authenticates the first network equipment in update request identify, and comprise that to the transmission of first network equipment the user of the second radio frequency mouth sign of user ID and reception authenticates the response of update request.

Preferably, described device also comprises: the 8th module, if be used for receiving from first network equipment the cancellation authentication request that comprises user ID, and the user authentication status item that deletion and described user ID are mated from user authentication status information.

Description of drawings

By the description of carrying out below in conjunction with accompanying drawing, above and other purpose of the present invention and characteristics will become apparent, wherein:

Fig. 1 is the schematic diagram that the framework of common wireless lan (wlan) is shown;

Fig. 2 is the schematic diagram that illustrates according to the framework of the WLAN of exemplary embodiment of the present invention;

Fig. 3 is the schematic diagram that illustrates according to the AP location registration process of exemplary embodiment of the present invention;

Fig. 4 is the schematic diagram that illustrates according to the user authentication process of exemplary embodiment of the present invention;

Fig. 5 and Fig. 6 are respectively the flow charts that illustrates according to the method for the AP of exemplary embodiment of the present invention registration;

Fig. 7 and Fig. 8 are respectively the flow charts that the method that the user according to exemplary embodiment of the present invention authenticates is shown;

Fig. 9 and Figure 10 are respectively the flow charts that the method that the user according to another exemplary embodiment of the present invention authenticates is shown;

Figure 11 is illustrated in the break down schematic diagram of situation of LAC in WLAN framework of the present invention.

Embodiment

Below, describe with reference to the accompanying drawings embodiments of the invention in detail.

Fig. 2 illustrates the framework according to the WLAN of exemplary embodiment of the present invention.

With reference to Fig. 2, the WLAN framework that the present invention proposes has added the network equipment that is used for relay portion AC function between AP and AC.In this application, the equipment of this interpolation is called LAC, and its central AC by the bearer network executive communication is called HAC.From the angle of AP, described LAC is equivalent to common AC, and described LAC is mapped to each the radio frequency mouth on each AP on the virtual radio frequency mouth of self; And from the angle of HAC, described LAC is equivalent to a virtual AP, and HAC is mapped to each the radio frequency mouth on each LAC on the radio frequency mouth of self again.The AP of each LAC management can use common logon mode to carry out registration to it, and client computer after scanning AP, can use common user authen method to carry out authentication by AP to the LAC of access and then to HAC.

After authentication success, client computer can forward or concentrate the communication of forward mode executing data according to this locality.In the network architecture shown in Figure 2, local forward mode and common local forwarding are basic identical; And the LAC that concentrates forward mode can be divided into by registration forwards and forwards dual mode by HAC, does not specifically describe at this.

On each LAC, pre-configured/storage AP configuration information is for the configuration information of all AP that record its management.The configuration information of each AP is stored in the AP configuration item, and the AP configuration item comprises the MAC Address of AP and the number of the upper radio frequency mouth of described AP.AP configuration information on each LAC comprises the AP configuration item of each AP of its management.According to a preferred embodiment of the invention, the AP configuration item also can comprise the type information of AP, according to described type information, different AP types is carried out personal management.

Each LAC also safeguards the AP registration status information be used to the AP that records current registration, it comprises the AP registration entries of the AP of each current registration, each registration entries comprises that the radio frequency mouth of the MAC Address of AP, the radio frequency mouth sign of AP (being the sequence number of the radio frequency mouth on AP, referred to here as the first radio frequency mouth sign) and described AP is identified at the virtual radio frequency mouth sign (referred to here as the second radio frequency mouth sign) of the upper mapping of LAC.

In addition, each LAC also safeguards be used to the user's who records current access user authentication information (referred to here as the first user authentication information), and it comprises the user's of each current access user authentication status item (referred to here as first user authentication state item).Each first user authentication state item comprises MAC Address and the first radio frequency mouth sign of the AP of user ID, access.

On the other hand, on each HAC, pre-configured/storing virtual AP configuration information is for the configuration information of all virtual AP (being LAC) that record its management.The configuration information of each virtual AP is stored in the virtual AP configuration item, and the virtual AP configuration item comprises the MAC Address of LAC and the number of the upper radio frequency mouth of described LAC.Virtual AP configuration information on HAC comprises the virtual AP configuration item of each virtual AP (being LAC) of its management.

HAC also safeguards the virtual AP registration status information be used to the virtual AP that records current registration (being LAC), it comprises the virtual AP registration entries of the LAC of each current registration, and each virtual AP registration entries comprises MAC Address, the virtual radio frequency mouth sign on LAC (i.e. the second radio frequency mouth sign) of LAC.

In addition, HAC also safeguards be used to the user's who records current access user authentication information (referred to here as the second user authentication information), and it comprises the user's of each current access user authentication status item (referred to here as the second user authentication status item).Each second user authentication status item comprises MAC Address and the second radio frequency mouth sign of the LAC of user ID, access.

Fig. 3 is the schematic diagram that illustrates according to the AP location registration process of exemplary embodiment of the present invention.

With reference to Fig. 3, AP1 passes through the CAPWAP protocol registration to LAC.Particularly, AP1 sends the registration request that comprises its MAC Address and the first radio frequency mouth sign to LAC, and described the first radio frequency mouth sign is the sequence number of radio frequency mouth on described AP.

LAC determines whether to allow described AP registration according to the registration request that receives and pre-stored AP configuration information after receiving described registration request.Particularly, if the first radio frequency mouth in the registration request that receives is identified in scope into the number of the radio frequency mouth in the AP configuration item of described AP configuration, determine to allow described AP registration.

If LAC determines to allow described AP registration, LAC identifies the second radio frequency mouth that described the first radio frequency mouth sign is mapped on LAC, and sends activation request to HAC, and described activation request comprises MAC Address and the second radio frequency mouth sign of LAC.

When HAC received described activation request, HAC determined whether that according to described activation request and pre-stored virtual AP configuration information the second radio frequency mouth that allows to activate LAC identifies the virtual radio frequency mouth of indicating.Particularly, if the second radio frequency mouth in the activation request that receives is identified in scope into the number of the radio frequency mouth in the virtual AP configuration item of described LAC configuration, determine to allow to activate the virtual radio frequency mouth of the second radio frequency mouth sign indication of LAC.

If determine that the second radio frequency mouth that allows to activate LAC identifies the virtual radio frequency mouth of indicating, insertion comprises the MAC Address of LAC and the virtual AP registration entries of the second radio frequency mouth sign in the virtual AP registration status information that HAC safeguards, and sends the activation response that comprises the second radio frequency mouth sign to described LAC.

LAC is after receiving described activation response, insert in the AP of its maintenance registration status information and comprise described AP(AP1) the AP registration entries of MAC Address, the first radio frequency mouth sign and the second radio frequency mouth sign, and send to AP1 the response that indication allows the registration request of its registration.

Fig. 4 is the schematic diagram that illustrates according to the user authentication process of exemplary embodiment of the present invention.

With reference to Fig. 4, when AP receives from client computer STA the access request that comprises user authentication information, comprise the MAC Address of user authentication information, AP and the first user authentication request of the first radio frequency mouth sign by the CAPWAP protocol forward, described the first radio frequency mouth sign is the sequence number of radio frequency mouth on described AP.Described user authentication information includes but not limited to, user ID and password etc.

When LAC receives described first user authentication request from AP, LAC searches from the AP registration status information of its maintenance and the MAC Address of described AP and the marking matched AP registration entries of the first radio frequency mouth, and sends the second user authentication request of the second radio frequency mouth sign in the AP registration entries of the MAC Address of the user authentication information that comprises reception, LAC and coupling to HAC.

HAC uses the user authentication information in the second user authentication request that receives receive described the second user authentication request from LAC after, by the certificate server of its connection, the user is carried out authentication.If from certificate server obtain by the authentication authentication result, HAC inserts the second user authentication status item of the MAC Address that comprises user ID, LAC and radio frequency mouth sign in the second user authentication status information of its maintenance, and send the response of described the second user authentication request to LAC, the response of described the second user authentication request comprises that user ID, the second radio frequency mouth sign and indication are by the information of authentication.

LAC is after receiving the response of the second user authentication request from HAC, insertion comprises the first user authentication state item of MAC Address and the first radio frequency mouth sign of user ID, AP in the first user authentication state information of its maintenance, and sends the response of indicating by the first user authentication request that authenticates to described AP.

AP sends the message that allows access to STA after receiving the response of described indication by the first user authentication request of authentication.

Describe method according to the AP registration of exemplary embodiment of the present invention in detail hereinafter with reference to Fig. 5 and Fig. 6.

Fig. 5 illustrates exemplary embodiment according to the present invention to register the flow chart of the method for AP on LAC.

With reference to Fig. 5, at step S510, LAC receives the registration request that comprises its MAC Address and the first radio frequency mouth sign from AP, and described the first radio frequency mouth sign is the sequence number of radio frequency mouth on described AP.

At step S520, determine whether to allow described AP registration according to the registration request that receives and pre-stored AP configuration information, described AP configuration information comprises a plurality of AP configuration items, each AP configuration item comprises the MAC Address of AP and the number of the upper radio frequency mouth of described AP.Particularly, if the first radio frequency mouth in the registration request that receives is identified in scope into the number of the radio frequency mouth in the AP configuration item of described AP configuration, determine to allow described AP registration.

If determine to allow described AP registration at step S520, LAC can send the response of refusal registration to AP, finishes the processing of described AP registration.

On the other hand, if determine to allow described AP registration, LAC execution in step S530 at step S520.At step S530, LAC identifies the second radio frequency mouth that described the first radio frequency mouth sign is mapped on LAC.

Then, at step S540, LAC search in the AP of its maintenance registration status information with the registration request that receives in MAC Address and the marking matched AP registration entries of the first radio frequency mouth.If at step S540, LAC does not find the AP registration entries of coupling, and at step S550, LAC sends activation request to HAC, and described activation request comprises MAC Address and the second radio frequency mouth sign of LAC.

At step S560, LAC receives the activation response that comprises the second radio frequency mouth sign from HAC.Then, at step S570, LAC inserts the AP registration entries of the MAC Address, the first radio frequency mouth sign and the second radio frequency mouth sign that comprise AP in the AP of its maintenance registration status information, and at step S580, LAC sends to described AP the response that indication allows the registration request of AP registration.

On the other hand, if at step S540, LAC finds the AP registration entries of coupling, shows that the virtual radio frequency mouth of described mapping before was activated at the HAC end, LAC execution in step S570 and S580.

In the method shown in Fig. 5, execution in step S540 not, but send described activation request to HAC at every turn.

In the method shown in Fig. 5, by CAPWAP management tunnel sending and receiving registration request and a response thereof, pass through the 2nd CAPWAP management tunnel sending and receiving activation request and response thereof between LAC and HAC between LAC and AP.

According to another exemplary embodiment of the present invention, if at step S560, LAC receives the response of the refusal activation that comprises the second radio frequency mouth sign from HAC, and LAC sends the response of the registration request of indication refusal AP registration to described AP.

According to another exemplary embodiment of the present invention, the method of registration of the present invention AP also comprises: if receive the MAC Address that comprises AP and the un-register request of the first radio frequency mouth sign from AP, send to HAC and cancel activation request, MAC Address and the second radio frequency mouth sign that request comprises LAC cancelled in described activation, reception comprises that the activation of cancelling of the second radio frequency mouth sign responds, comprise the AP configuration item of MAC Address and the first radio frequency mouth sign of AP from described AP registration status information deletion, and send the response of un-register request to described AP.

Fig. 6 illustrates exemplary embodiment according to the present invention to register the flow chart of the method for AP on HAC.

With reference to Fig. 6, at step S610, HAC comprises the MAC Address of LAC and the activation request of the second radio frequency mouth sign from the LAC reception.

At step S620, HAC determines whether that according to described activation request and pre-stored virtual AP configuration information the second radio frequency mouth that allows to activate LAC identifies the radio frequency mouth of indicating, described virtual AP configuration information comprises a plurality of virtual AP configuration items, the MAC Address that each virtual AP configuration item comprises LAC with and the number of the radio frequency mouth supported.Particularly, if the second radio frequency mouth that receives is identified in scope into the number of the radio frequency mouth in the virtual AP configuration item of described LAC configuration, HAC determines to allow to activate the radio frequency mouth of the second radio frequency mouth sign indication of LAC.

If at step S620, HAC determines that the second radio frequency mouth that does not allow to activate LAC identifies the radio frequency mouth of indicating, and at step S640, HAC responds to the activation that LAC sends the activation of indication refusal.

On the other hand, at step S620, HAC determines that the second radio frequency mouth that allows to activate LAC identifies the radio frequency mouth of indicating, at step S630, HAC insertion in the virtual AP registration status information that HAC safeguards comprises the MAC Address of LAC and the virtual AP registration entries of the second radio frequency mouth sign, and at step S640, HAC sends the activation response that comprises the second radio frequency mouth sign to described LAC.

According to another exemplary embodiment of the present invention, when at step S610, when HAC received the activation request of the MAC Address that comprises LAC and the second radio frequency mouth sign from LAC, whether HAC determined to have existed in the virtual AP registration status information and the MAC Address of LAC and the marking matched virtual AP registration entries (not shown) of the second radio frequency mouth.If existed and the MAC Address of LAC and the marking matched virtual AP registration entries of the second radio frequency mouth, execution in step S640, HAC sends the activation response of the second radio frequency mouth sign in the virtual AP registration entries that comprises coupling to described LAC.

According to another exemplary embodiment of the present invention, if receive the activation request of cancelling of the MAC Address that comprises LAC and the second radio frequency mouth sign from LAC, HAC deletes from the virtual AP registration status information of its maintenance and the MAC Address of LAC and the marking matched virtual AP registration entries of the second radio frequency mouth, and sends to LAC and comprise that cancelling of the second radio frequency mouth sign activate response.

Pass through the 2nd CAPWAP management tunnel sending and receiving activation request and response thereof between LAC and HAC.

Hereinafter with reference to Fig. 7 and the thin user authen method of describing according to exemplary embodiment of the present invention of Fig. 8.

Fig. 7 illustrates exemplary embodiment according to the present invention and carries out the flow chart of the method that the user authenticates at LAC.

With reference to Fig. 7, at step S710, LAC comprises the MAC Address of user authentication information, AP and the first user authentication request of the first radio frequency mouth sign from the AP reception, and described the first radio frequency mouth sign is the sequence number of radio frequency mouth on described AP.User authentication information includes but not limited to, user ID and password.

At step S720, LAC searches from the AP registration status information of its maintenance and the MAC Address of described AP and the marking matched AP registration entries of the first radio frequency mouth, described AP registration status information comprises a plurality of AP registration entries, and each AP registration entries comprises MAC Address, the first radio frequency mouth sign and the second radio frequency mouth sign of AP; And LAC sends the second user authentication request of the second radio frequency mouth sign in the AP registration entries of the MAC Address of the user authentication information comprise reception, LAC and coupling to HAC.

At step S730, LAC receives the response of the second user authentication request from HAC, and the response of described the second user authentication request comprises user ID, the second radio frequency mouth sign and indicates whether information by authentication.

If the response of the second user authentication request that receives indication is by authentication, at step S740, LAC insertion in the first user authentication state information of safeguarding comprises the first user authentication state item of MAC Address and the first radio frequency mouth sign of user ID, AP, and at step S750, LAC sends indication by the response of the first user authentication request of authentication to described AP.

On the other hand, if the response of the second user authentication request of reception is indicated by authentication, at step S750, LAC sends to described AP and comprises described user ID and indicate the response of passing through the first user authentication request of authentication.

By CAPWAP management tunnel sending and receiving first user authentication request and a response thereof, pass through the 2nd CAPWAP management tunnel sending and receiving the second user authentication request and response thereof between LAC and HAC between LAC and AP.

According to another exemplary embodiment of the present invention, if LAC receives the cancellation authentication request that comprises user ID from AP, the first user authentication state item that deletion and described user ID are mated from first user authentication state information.

Fig. 8 illustrates exemplary embodiment according to the present invention and carries out the flow chart of the method that the user authenticates at HAC.

With reference to Fig. 8, at step S810, HAC comprises the MAC Address of user authentication information, LAC and the second user authentication request of radio frequency mouth sign from the LAC reception.

At step S820, HAC uses the user authentication information in the second user authentication request that receives, and by certificate server, the user is carried out authentication.

At step S830, if from certificate server obtain by the authentication authentication result, at step S840, HAC inserts the second user authentication status item of the MAC Address that comprises user ID, LAC and radio frequency mouth sign in the second user authentication status information of its maintenance, and at step S850, send the response of described the second user authentication request to LAC, the response of described the second user authentication request comprises that user ID, the second radio frequency mouth sign and indication are by the information of authentication.

On the other hand, if at step S830, HAC obtains by there is no the authentication result of authentication from certificate server, and at step S850, HAC sends to LAC and comprises user ID, the second radio frequency mouth sign and the response of indicating the second user authentication request of the information of passing through authentication.

According to another exemplary embodiment of the present invention, when at step S810, when HAC received the second user authentication request of the MAC Address comprise user authentication information, LAC and the second radio frequency mouth sign from LAC, HAC searched the second user authentication status item with the user ID coupling that receives in user authentication status information.If find the second user authentication status item of coupling, show the certified mistake of this user, the MAC Address of the LAC in the HAC second user authentication status item that will mate and the 2nd Raido sign are updated to respectively MAC Address and the second radio frequency mouth sign of the LAC in the second user authentication request of reception, and at step S850, HAC sends to LAC and comprises that user ID, the second radio frequency mouth sign and indication are by the response of the second user authentication request of the information of authentication.

According to above-mentioned AP register method and the user authen method of carrying out by trunking, WLAN framework of the present invention is carried out the split blade type management to the AP in WLAN, can manage dissimilar AP under different LAC.For example, the different branches of an enterprise may successively purchase dissimilar AP, if these AP are managed under different LAC respectively, in same large WLAN, can support the AP of variform.

Simultaneously, manage by the AP in WLAN is divided under a plurality of LAC, when arbitrary LAC broke down (as shown in figure 11), the AP of other LAC management was unaffected; And can not continue communication when HAC breaks down, and data retransmission is set to local forward or during by the LAC forward mode, the user who has accessed under each LAC management can continue the executing data communication of surfing the Net.

The user often occurs in WLAN move to the situation in the zone of other AP coverings from the AP of an access.Relate in the present invention situation about switching between user's the AP of client computer under same LAC manages and situation about switching between the AP under Different L AC management.Aforesaid user authen method can be tackled both of these case.Wherein, for front kind of situation, also can be optimized processing.

Fig. 9 and Figure 10 are respectively the flow charts that the method that the user according to another exemplary embodiment of the present invention authenticates is shown.

Fig. 9 illustrates another exemplary embodiment according to the present invention to carry out the flow chart of the method that the user authenticates at LAC.

With reference to Fig. 9, at step S910(with the step S710 in Fig. 7), LAC comprises the MAC Address of user authentication information, AP and the first user authentication request of the first radio frequency mouth sign from the AP reception, and described the first radio frequency mouth sign is the sequence number of radio frequency mouth on described AP.User authentication information includes but not limited to, user ID and password.

Can carry out the step S920 of current embodiment before the S720 of execution graph 7.

At step S920, LAC searches the first user authentication state item with the user ID coupling that receives in first user authentication state information, to determine that whether described user is by the certified mistake of another AP.

If at step S920, LAC finds the MAC Address of the AP in the first user authentication state item of the first user authentication state item of coupling and coupling different from the MAC Address of the AP of reception, at step S930, LAC searches from the AP registration status information of its maintenance and the MAC Address of the AP that receives and the marking matched AP registration entries of the first radio frequency mouth, and the user that will comprise the second radio frequency mouth sign in the AP registration entries of the MAC Address of user ID, LAC and coupling authenticates update request and sends to HAC.At step S940, LAC receives from HAC the response that the user who comprises user ID and the second radio frequency mouth sign authenticates update request.At step S950, LAC is updated to the MAC Address of AP in the first user authentication state item of coupling and the first radio frequency mouth sign respectively MAC Address and the first radio frequency mouth sign of the AP in the first user authentication request of reception.At step S960, LAC will comprise that user ID and indication send to described AP by the response of first user authentication request of authentication.

On the contrary, if at step S920, LAC determines that described user not by the certified mistake of another AP, carries out the step S720 in earlier figures 7.

That is to say, the embodiment shown in Fig. 9 can be embodied as the part of the user authen method shown in Fig. 7.

Figure 10 illustrates another exemplary embodiment according to the present invention to carry out the flow chart of the method that the user authenticates at HAC.

With reference to Figure 10, at step S1010, HAC authenticates update request from the user that LAC receives the MAC Address that comprises user ID, LAC and the second radio frequency mouth sign.At step S1010, MAC Address and the second radio frequency mouth that the user that the MAC Address that HAC will authenticate the LAC in the user authentication status item of the user ID coupling in update request with the user who receives and the 2nd Raido sign are updated to respectively reception authenticates the LAC in update request identify.Then, at step S1030, HAC comprises that to the LAC transmission user of the second radio frequency mouth sign of user ID and reception authenticates the response of update request.

Similarly, the embodiment shown in Figure 10 can implement the part of the user authen method shown in Fig. 8.

Adopt the user authen method shown in Fig. 9 and Figure 10, when carrying out switching between the AP of user under same LAC, can only upgrade authentication state information to the HAC request, and not need HAC again to carry out authentication to certificate server.

The present invention also provides a kind of device that is respectively used at LAC and the above-mentioned correlation method of HAC execution.

Can find out the description of exemplary embodiment of the present invention according to the reference accompanying drawing, the present invention is used for the network equipment of relaying AC by interpolation, the AP in WLAN is carried out the split blade type management, thereby can support the AP of variform under different LAC.

Simultaneously, manage by the AP in WLAN is divided under a plurality of LAC, when arbitrary LAC broke down, the AP of other LAC management was unaffected; And can not continue communication when HAC breaks down, and data retransmission is set to local forward or during by the LAC forward mode, the user who has accessed under each LAC management can continue the executing data communication of surfing the Net.

The method that the present invention proposes can be passed through any in conjunction with realizing of software, firmware or hardware module or three, and realizing under the prerequisite of inventive concept of the present invention, the step that limits in described method is removable is divided into more step, also two or more steps wherein can be merged into a step, also the part operation in arbitrary steps can be merged in other steps or form separately a step.In addition, can adjust as required the order of certain operations.

Although represent with reference to preferred embodiment and described the present invention, it should be appreciated by those skilled in the art that and to carry out various modifications and conversion to these embodiment in the situation that do not break away from the spirit and scope of the present invention that are defined by the claims.

Claims

1. the method for a registration WAP (wireless access point) (AP) is included in first network equipment and carries out following steps:

A) receive from AP the registration request that comprises its MAC Address and the first radio frequency mouth sign, described the first radio frequency mouth sign is the sequence number of radio frequency mouth on described AP;

B) determine whether to allow described AP registration according to the registration request that receives and pre-stored AP configuration information, described AP configuration information comprises a plurality of AP configuration items, and each AP configuration item comprises the MAC Address of AP and the number of the upper radio frequency mouth of described AP;

C) if determine to allow described AP registration, carry out following operation:

The second radio frequency mouth that described the first radio frequency mouth sign is mapped on first network equipment identifies;

Send activation request to second network equipment, described activation request comprises MAC Address and the second radio frequency mouth sign of first network equipment;

When receiving the activation response that comprises the second radio frequency mouth sign from second network equipment, insert the AP registration entries of the MAC Address, the first radio frequency mouth sign and the second radio frequency mouth sign that comprise AP in the AP registration status information of safeguarding, and send to described AP the response that indication allows the registration request of AP registration.

2. the method for claim 1, it is characterized in that, by CAPWAP management tunnel sending and receiving registration request and a response thereof, pass through the 2nd CAPWAP management tunnel sending and receiving activation request and response thereof between first network equipment and second network equipment between first network equipment and AP.

3. the method for claim 1, it is characterized in that, step C) also comprise: when receiving the registration request that comprises its MAC Address and the first radio frequency mouth sign from AP, search in the AP of its maintenance registration status information with the registration request that receives in MAC Address and the marking matched AP registration entries of the first radio frequency mouth, and if find the AP registration entries of coupling, send to described AP the response that indication allows the registration request of AP registration.

4. the method for claim 1, is characterized in that, the AP configuration item also comprises the information about the AP type.

5. the method for claim 1, is characterized in that, at step B) in, if the first radio frequency mouth that receives is identified in scope into the number of the radio frequency mouth in the AP configuration item of described AP configuration, determine to allow described AP registration.

6. the method for claim 1, also comprise: if D) receive the response of the refusal activation that comprises the second radio frequency mouth sign from second network equipment, send the response of the registration request of indication refusal AP registration to described AP.

7. the method for claim 1, also comprise: if receive the un-register request of the MAC Address that comprises AP and the first radio frequency mouth sign from AP, send to second network equipment and cancel activation request, MAC Address and the second radio frequency mouth sign that request comprises first network equipment cancelled in described activation, reception comprises that the activation of cancelling of the second radio frequency mouth sign responds, comprise the AP configuration item of MAC Address and the first radio frequency mouth sign of AP from described AP registration status information deletion, and send the response of un-register request to described AP.

8. the method for a registration WAP (wireless access point) (AP) is included in second network equipment and carries out following steps:

Comprise the MAC Address of first network equipment and the activation request of the second radio frequency mouth sign from the reception of first network equipment;

Determine whether that according to described activation request and pre-stored virtual AP configuration information the second radio frequency mouth that allows to activate first network equipment identifies the radio frequency mouth of indicating, described virtual AP configuration information comprises a plurality of virtual AP configuration items, the MAC Address that each virtual AP configuration item comprises first network equipment with and the number of the radio frequency mouth supported;

If determine that the second radio frequency mouth that allows to activate first network equipment identifies the radio frequency mouth of indicating, insertion comprises the MAC Address of first network equipment and the virtual AP registration entries of the second radio frequency mouth sign in the virtual AP registration status information of second network plant maintenance, and sends the activation response that comprises the second radio frequency mouth sign to described first network equipment.

9. method as claimed in claim 8, is characterized in that, passes through the 2nd CAPWAP management tunnel sending and receiving activation request and response thereof between first network equipment and second network equipment.

10. method as claimed in claim 8, it is characterized in that, when receiving the activation request of the MAC Address that comprises first network equipment and the second radio frequency mouth sign from first network equipment, determine whether to have existed in described virtual AP registration status information and the MAC Address of first network equipment and the marking matched virtual AP registration entries of the second radio frequency mouth, if existed and the MAC Address of first network equipment and the marking matched virtual AP registration entries of the second radio frequency mouth, send the activation response of the second radio frequency mouth sign in the virtual AP registration entries that comprises coupling to described first network equipment.

11. method as claimed in claim 8, it is characterized in that, in the step of the radio frequency mouth of the second radio frequency mouth sign indication that determines whether to allow to activate first network equipment according to described activation request and pre-stored virtual AP configuration information, if the second radio frequency mouth that receives is identified in scope into the number of the radio frequency mouth in the virtual AP configuration item of described first network equipment configuration, determine to allow to activate the radio frequency mouth of the second radio frequency mouth sign indication of first network equipment.

12. method as claimed in claim 11 also comprises: if determine that the second radio frequency mouth that does not allow to activate first network equipment identifies the radio frequency mouth of indicating, and comprises to the transmission of first network equipment the response that the refusal of the second radio frequency mouth sign activates.

13. method as claimed in claim 8, also comprise: if receive the activation request of cancelling of the MAC Address that comprises first network equipment and the second radio frequency mouth sign from first network equipment, the marking matched virtual AP registration entries of deletion and the MAC Address of first network equipment and the second radio frequency mouth from described virtual AP registration status information, and send to first network equipment and comprise that cancelling of the second radio frequency mouth sign activate response.

14. the method that the user of wireless network is authenticated is included in and carries out following steps on first network equipment:

Comprise the MAC Address of user authentication information, AP and the first user authentication request of the first radio frequency mouth sign from WAP (wireless access point) (AP) reception, described the first radio frequency mouth sign is the sequence number of radio frequency mouth on described AP;

Search from the AP registration status information of its maintenance and the MAC Address of described AP and the marking matched AP registration entries of the first radio frequency mouth, described AP registration status information comprises a plurality of AP registration entries, and each AP registration entries comprises MAC Address, the first radio frequency mouth sign and the second radio frequency mouth sign of AP;

Send the second user authentication request of the second radio frequency mouth sign in the AP registration entries of the MAC Address of the user authentication information comprise reception, first network equipment and coupling to second network equipment;

Receive the response of the second user authentication request from second network equipment, the response of described the second user authentication request comprises user ID, the second radio frequency mouth sign and indicates whether information by authentication;

If determine by authentication according to the response of the second user authentication request that receives, insertion comprises the first user authentication state item of MAC Address and the first radio frequency mouth sign of user ID, AP in the first user authentication state information of safeguarding, and sends the response of indicating by the first user authentication request that authenticates to described AP.

15. method as claimed in claim 14, it is characterized in that, by CAPWAP management tunnel sending and receiving first user authentication request and a response thereof, pass through the 2nd CAPWAP management tunnel sending and receiving the second user authentication request and response thereof between first network equipment and second network equipment between first network equipment and AP.

16. method as claimed in claim 14, it is characterized in that, comprise the response of the information of the second user authentication request of the information by authentication of user ID, the second radio frequency mouth sign and indication if receive from second network equipment, send to described AP and comprise the response of the first user authentication request of the information by authentication of described user ID and indication.

17. method as claimed in claim 14 also comprises: when receiving described first user authentication request from described AP,

The first user authentication state item of the user ID coupling of searching in first user authentication state information and receiving;

If find the MAC Address of the AP in the first user authentication state item of the first user authentication state item of coupling and coupling different from the MAC Address of the AP of reception, carry out following operation:

Search from the AP registration status information and the MAC Address of the AP that receives and the marking matched AP registration entries of the first radio frequency mouth,

The user that will comprise the second radio frequency mouth sign in the AP registration entries of the MAC Address of user ID, first network equipment and coupling authenticates update request and sends to second network equipment,

Receive from second network equipment the response that the user who comprises user ID and the second radio frequency mouth sign authenticates update request,

The MAC Address of AP in the first user authentication state item of coupling and the first radio frequency mouth sign are updated to respectively MAC Address and the first radio frequency mouth sign of the AP in the first user authentication request of reception, and

To comprise that user ID and indication send to described AP by the response of the first user authentication request of authentication.

18. method as claimed in claim 14 also comprises: if receive the cancellation authentication request that comprises user ID from described AP, the first user authentication state item that deletion and described user ID are mated from first user authentication state information.

19. the method that the user of wireless network is authenticated is included in and carries out following steps on second network equipment:

20. method as claimed in claim 19 is characterized in that, passes through the 2nd CAPWAP management tunnel sending and receiving user authentication request and response thereof between first network equipment and second network equipment.

21. method as claimed in claim 19, also comprise: if obtain the authentication result of not passing through authentication from certificate server, send to first network equipment the response that comprises that user ID, the second radio frequency mouth identify and indicate the user authentication request of the information of passing through authentication.

22. method as claimed in claim 19 also comprises: when receiving the user authentication request of the MAC Address that comprises user authentication information, first network equipment and the second radio frequency mouth sign from first network equipment,

The user authentication status item of the user ID coupling of searching in described user authentication status information and receiving;

If find the user authentication status item of coupling, MAC Address and the 2nd Raido sign of the first network equipment in the user authentication status item of coupling is updated to respectively MAC Address and the second radio frequency mouth sign of the first network equipment in the user authentication request of reception, and sends to first network equipment and comprise that user ID, the second radio frequency mouth sign and indication are by the response of the user authentication request of the information that authenticates.

23. method as claimed in claim 19, also comprise: comprise user ID if receive from first network equipment, the user of the MAC Address of first network equipment and the second radio frequency mouth sign authenticates update request, MAC Address and the second radio frequency mouth that the user that the MAC Address that will authenticate the first network equipment in the user authentication status item of the user ID coupling in update request with the user who receives and the 2nd Raido sign are updated to respectively reception authenticates the first network equipment in update request identify, and comprise that to the transmission of first network equipment the user of the second radio frequency mouth sign of user ID and reception authenticates the response of update request.

24. method as claimed in claim 19 also comprises: if receive the cancellation authentication request that comprises user ID from first network equipment, the user authentication status item that deletion and described user ID are mated from user authentication status information.

25. a device of registering WAP (wireless access point) (AP) on first network equipment comprises:

The first module is used for receiving from AP the registration request that comprises its MAC Address and the first radio frequency mouth sign, and described the first radio frequency mouth sign is the sequence number of radio frequency mouth on described AP;

The second module, be used for determining whether to allow described AP registration according to the registration request that receives and pre-stored AP configuration information, described AP configuration information comprises a plurality of AP configuration items, and each AP configuration item comprises the MAC Address of AP and the number of the upper radio frequency mouth of described AP;

the 3rd module, if be used for determining to allow described AP registration, described the first radio frequency mouth sign is mapped to the second radio frequency mouth sign on first network equipment, send activation request to second network equipment, described activation request comprises MAC Address and the second radio frequency mouth sign of first network equipment, when receiving the activation response that comprises the second radio frequency mouth sign from second network equipment, insert the MAC Address that comprises AP in the AP registration status information of safeguarding, the AP registration entries of the first radio frequency mouth sign and the second radio frequency mouth sign, and send to described AP the response that indication allows the registration request of AP registration.

26. device as claimed in claim 25, it is characterized in that, by CAPWAP management tunnel sending and receiving registration request and a response thereof, pass through the 2nd CAPWAP management tunnel sending and receiving activation request and response thereof between first network equipment and second network equipment between first network equipment and AP.

27. device as claimed in claim 25, it is characterized in that, the 3rd module is when receiving the registration request that comprises its MAC Address and the first radio frequency mouth sign from AP, search in the AP of its maintenance registration status information with the registration request that receives in MAC Address and the marking matched AP registration entries of the first radio frequency mouth, and if find the AP registration entries of coupling, send to described AP the response that indication allows the registration request of AP registration.

28. device as claimed in claim 25 is characterized in that, the AP configuration item also comprises the information about the AP type.

29. device as claimed in claim 25 is characterized in that, if the first radio frequency mouth that the second module determine to receive is identified in scope into the number of the radio frequency mouth in the AP configuration item of described AP configuration, the second module determines to allow described AP registration.

30. device as claimed in claim 25 also comprises: four module if be used for receiving from second network equipment the response of the refusal activation that comprises the second radio frequency mouth sign, sends the response of the registration request of indication refusal AP registration to described AP.

31. device as claimed in claim 25 also comprises:

The 5th module, receive the MAC Address that comprises AP and the un-register request of the first radio frequency mouth sign if be used for from AP, send to second network equipment and cancel activation request, MAC Address and the second radio frequency mouth sign that request comprises first network equipment cancelled in described activation, reception comprises that the activation of cancelling of the second radio frequency mouth sign responds, comprise the AP configuration item of MAC Address and the first radio frequency mouth sign of AP from described AP registration status information deletion, and send the response of un-register request to described AP.

32. the device in second network facility registration WAP (wireless access point) (AP) comprises:

The first module is used for comprising the MAC Address of first network equipment and the activation request of the second radio frequency mouth sign from the reception of first network equipment;

The second module, be used for determining whether that according to described activation request and pre-stored virtual AP configuration information the second radio frequency mouth that allows to activate first network equipment identifies the radio frequency mouth of indicating, described virtual AP configuration information comprises a plurality of virtual AP configuration items, the MAC Address that each virtual AP configuration item comprises first network equipment with and the number of the radio frequency mouth supported;

The 3rd module, if be used for determining that permission activates the radio frequency mouth of the second radio frequency mouth sign indication of first network equipment, insertion comprises the MAC Address of first network equipment and the virtual AP registration entries of the second radio frequency mouth sign in the virtual AP registration status information of second network plant maintenance, and sends the activation response that comprises the second radio frequency mouth sign to described first network equipment.

33. device as claimed in claim 32 is characterized in that, passes through the 2nd CAPWAP management tunnel sending and receiving activation request and response thereof between first network equipment and second network equipment.

34. device as claimed in claim 32, it is characterized in that, the first module is when receiving the activation request of the MAC Address that comprises first network equipment and the second radio frequency mouth sign from first network equipment, determine whether to have existed in described virtual AP registration status information and the MAC Address of first network equipment and the marking matched virtual AP registration entries of the second radio frequency mouth, if existed and the MAC Address of first network equipment and the marking matched virtual AP registration entries of the second radio frequency mouth, send the activation response of the second radio frequency mouth sign in the virtual AP registration entries that comprises coupling to described first network equipment.

35. device as claimed in claim 32, it is characterized in that, the second module is when the radio frequency mouth of the second radio frequency mouth sign indication that determines whether to allow to activate first network equipment according to described activation request and pre-stored virtual AP configuration information, if the second radio frequency mouth that determine to receive is identified in scope into the number of the radio frequency mouth in the virtual AP configuration item of described first network equipment configuration, the second module determines to allow to activate the radio frequency mouth of the second radio frequency mouth sign indication of first network equipment.

36. device as claimed in claim 35, also comprise: four module, if be used for determining that the second radio frequency mouth that does not allow to activate first network equipment identifies the radio frequency mouth of indicating, comprise to the transmission of first network equipment the response that the refusal of the second radio frequency mouth sign activates.

37. device as claimed in claim 32 also comprises:

The 5th module, if be used for receiving from first network equipment the activation request of cancelling of the MAC Address that comprises first network equipment and the second radio frequency mouth sign, the marking matched virtual AP registration entries of deletion and the MAC Address of first network equipment and the second radio frequency mouth from described virtual AP registration status information, and send to first network equipment and comprise that cancelling of the second radio frequency mouth sign activate response.

38. a device that on first network equipment, the user of wireless network is authenticated comprises:

The first module is used for comprising the MAC Address of user authentication information, AP and the first user authentication request of the first radio frequency mouth sign from WAP (wireless access point) (AP) reception that described the first radio frequency mouth sign is the sequence number of radio frequency mouth on described AP;

The second module, be used for searching and the MAC Address of described AP and the marking matched AP registration entries of the first radio frequency mouth from the AP registration status information of its maintenance, described AP registration status information comprises a plurality of AP registration entries, and each AP registration entries comprises MAC Address, the first radio frequency mouth sign and the second radio frequency mouth sign of AP;

The 3rd module is used for sending to second network equipment second user authentication request of the second radio frequency mouth sign of the AP registration entries of the MAC Address of the user authentication information that comprises reception, first network equipment and coupling;

Four module is used for receiving from second network equipment the response of the second user authentication request, and the response of described the second user authentication request comprises user ID, the second radio frequency mouth sign and indicates whether information by authentication;

The 5th module, determine by authentication according to the response of the second user authentication request that receives if be used for, insertion comprises the first user authentication state item of MAC Address and the first radio frequency mouth sign of user ID, AP in the first user authentication state information of safeguarding, and sends the response of indicating by the first user authentication request that authenticates to described AP.

39. device as claimed in claim 38, it is characterized in that, by CAPWAP management tunnel sending and receiving first user authentication request and a response thereof, pass through the 2nd CAPWAP management tunnel sending and receiving the second user authentication request and response thereof between first network equipment and second network equipment between first network equipment and AP.

40. device as claimed in claim 38, it is characterized in that, comprise the response of the information of the second user authentication request of the information by authentication of user ID, the second radio frequency mouth sign and indication if the 5th module is determined to receive from second network equipment, the 5th module sends to described AP and comprises the response of the first user authentication request of the information by authentication of described user ID and indication.

41. device as claimed in claim 38 also comprises: the 6th module, be used for when receiving described first user authentication request from described AP,

42. device as claimed in claim 38 also comprises:

The 7th module, if be used for receiving from described AP the cancellation authentication request that comprises user ID, the first user authentication state item that deletion and described user ID are mated from first user authentication state information.

43. a device that on second network equipment, the user of wireless network is authenticated comprises:

The first module is used for comprising the MAC Address of user authentication information, first network equipment and the user authentication request of radio frequency mouth sign from the reception of first network equipment;

The second module for the user authentication information that uses the user authentication request that receives, is carried out authentication by certificate server to the user;

The 3rd module, if for the authentication result that obtains from certificate server by authentication, insertion comprises the MAC Address of user ID, first network equipment and the user authentication status item that the radio frequency mouth identifies in the user authentication status information of safeguarding, and send the response of described user authentication request to first network equipment, the response of described user authentication request comprises that user ID, the second radio frequency mouth sign and indication are by the information of authentication.

44. device as claimed in claim 43 is characterized in that, passes through the 2nd CAPWAP management tunnel sending and receiving user authentication request and response thereof between first network equipment and second network equipment.

45. device as claimed in claim 43, also comprise: four module, if for obtain the authentication result of not passing through authentication from certificate server, send to first network equipment the response that comprises that user ID, the second radio frequency mouth identify and indicate the user authentication request of the information of passing through authentication.

46. device as claimed in claim 43 also comprises: the 6th module, be used for when receiving the user authentication request that the MAC Address that comprises user authentication information, first network equipment and the second radio frequency mouth identify from first network equipment,

47. device as claimed in claim 43 also comprises:

the 7th module, comprise user ID if be used for receiving from first network equipment, the user of the MAC Address of first network equipment and the second radio frequency mouth sign authenticates update request, MAC Address and the second radio frequency mouth that the user that the MAC Address that will authenticate the first network equipment in the user authentication status item of the user ID coupling in update request with the user who receives and the 2nd Raido sign are updated to respectively reception authenticates the first network equipment in update request identify, and comprise that to the transmission of first network equipment the user of the second radio frequency mouth sign of user ID and reception authenticates the response of update request.

48. device as claimed in claim 43 also comprises:

The 8th module, if be used for receiving from first network equipment the cancellation authentication request that comprises user ID, the user authentication status item that deletion and described user ID are mated from user authentication status information.