WO2015196687A1

WO2015196687A1 - Authentication management method and apparatus, wlan access device and communication system

Info

Publication number: WO2015196687A1
Application number: PCT/CN2014/090238
Authority: WO
Inventors: 徐永千
Original assignee: 中兴通讯股份有限公司
Priority date: 2014-06-25
Filing date: 2014-11-04
Publication date: 2015-12-30
Also published as: CN105208556A

Abstract

An authentication management method and apparatus, a computer program and a corresponding carrier. The method comprises: receiving an authentication request which is sent by a WLAN terminal and used for establishing a WLAN connection; and judging whether the authentication request is an invalid authentication request continuously sent by the WLAN terminal, and when the authentication request is the invalid authentication request continuously sent by the WLAN terminal, not feeding back a processing result of the authentication request to a WLAN management device. The technical solution solves the problem in the related WLAN communication system that blocking easily occurs between a WLAN access device and a WLAN management device due to the fact that the WLAN access device feeds back authentication results of all authentication requests to the WLAN management device.

Description

Authentication management method, device, WLAN access device, and communication system

Technical field

The present invention relates to the field of authentication management technologies, and in particular, to an authentication management method, apparatus, WLAN access device, and communication system.

Background technique

Wireless Local Area Networks (WLAN) refers to the application of wireless communication technology to interconnect computer devices to form a network system that can communicate with each other and share resources. With the increasing demand for high-speed wireless Internet access and the increasing popularity of WLAN terminals such as laptops and mobile phones for high-speed WLANs, WLAN technology is becoming more and more widely used, and is no longer limited to private occasions such as home wireless Internet access. In public areas such as airports, libraries, exhibition halls, cafes, conference halls, etc., WLAN channels can be searched and easily accessed for fast Internet access. In the past, the WLAN networking mode is generally a "fat" mode. The so-called fat mode, that is, the configuration of the WLAN access device itself generally adopts a default database manner, that is, the so-called "self-management itself", in the network structure, each The WLAN access devices are independent of each other. In this case, if the WLAN access device is configured or modified, it can only be performed through its WEB page or telnet. Due to the large-scale demand for WLAN access devices, A significant disadvantage of this mode is that all access devices in the entire network cannot be centrally controlled, and can only be controlled separately. Large-scale networking is difficult, network maintenance costs are high, and carrier-level network maintenance is also changed. almost impossible.

Therefore, another "skinny" mode was born. The so-called thin mode, that is, a single WLAN access device, is only responsible for data transmission, terminal access management, encryption, authentication, etc., and some of the remaining configuration management, For the WLAN management device to do, see Figure 1. That is to say, in the transition from fat mode to thin mode, the WLAN access device does less work, and the WLAN management device helps the WLAN access device to undertake part of the management work, so that the WLAN access device is more focused on The basic work of data transmission and reception also makes it possible for carrier-scale large-scale networking and maintenance. In addition, since the data between the current WLAN access device and the terminal network card is transmitted through the air interface through the 802.11 protocol, and the air interface is sent back to the air interface, considering the security problem, the data is added. Secret is necessary. At present, the commonly used encryption methods in WLAN wireless LAN generally include: SHARE-KEY, WPA-PSK, WPA2-PSK, WPA/WAP2-PSK, WPA-EAP, WPA2-EAP, WPA/WPA2-EAP, WAPI-PSK , WAPI-CERT, WEP-EAP, etc. In the above implementation of the encryption method, the WLAN access device needs to have an encryption authentication module to specifically implement the encryption process, and is responsible for notifying the WLAN access device of the encrypted authentication result, and the WLAN access device will perform the encrypted authentication result. After the processing, the terminal network card is notified, so that the terminal network card knows the encrypted authentication result in time. If the authentication is successful, the terminal network card further sends an association request to the WLAN access device. The following takes the typical WPA/WAP2-PSK encryption mode as an example. After the WLAN management device changes the negotiation key uniformly, the problems that appear on the actual live network are described as follows:

First, the currently widely used interaction between the WLAN terminal and the WLAN access device and the WLAN management device includes the following steps:

After the WLAN terminal (for example, a terminal such as a pad, a notebook, or a mobile phone) obtains the information of the nearby WLAN access device, the WLAN access device sends an association request to the WLAN access device.

Second, the WLAN access device receives the association request and establishes an association with the terminal;

3. The WLAN terminal sends an encrypted authentication request to the WLAN access device.

The WIFI encryption authentication management module of the WLAN access device sends the authentication result of the WLAN terminal to the WLAN access device after the authentication process is performed by using the authentication mechanism such as the key agreement and the four-way handshake.

5. The WLAN access device further informs the WLAN terminal in the form of a message, so that the WLAN terminal reselects the access mode as needed;

6. If the cryptographic authentication management module successfully authenticates the WLAN terminal, the WLAN terminal successfully establishes a connection with the terminal after receiving the authentication success message sent by the WLAN access device.

After the WLAN terminal successfully establishes a connection with the WLAN access device, the WLAN access device sends a message that the terminal is successfully associated to the WLAN management device through a private protocol between the WLAN access device and the WLAN management device.

8. If the encryption authentication management module fails the authentication of the WLAN terminal, the WLAN access device will send an association failure message to the WLAN management device and send a message to notify. The WLAN terminal has failed authentication and clears the relevant information of the terminal, waiting for the next authentication request of the WLAN terminal.

In the above process, when the network is deployed on a large scale, the WLAN management device continuously receives the association success/failure message of the terminal. At this time, if the key of the WLAN access device is uniformly modified by the WLAN management device, at this time, the WLAN terminal is forced to drop due to a key error, and the authentication of the terminal is failed, because the general WLAN is The mechanism adopted by the terminal NIC is to remember the last key by default, and after the key authentication fails, the key that is reserved last time will be sent to the WLAN access device to send an authentication message. Therefore, if the WLAN management device manages a large number of WLAN access devices at the same time, and each WLAN access device accesses a large number of WLAN terminal network cards at the same time, the WLAN management will eventually lead to WLAN management due to the repeated re-authentication mechanism of the WLAN terminal network card. The device receives a large number of terminal authentication failure messages at the same time, which easily leads to congestion of the communication link between the WLAN access device and the WLAN management device, resulting in a crash of the device message mechanism or between the WLAN management device and the WLAN access device. The communication cannot be performed normally, and eventually the management capability of the WLAN management device is lost.

Summary of the invention

The main technical problem to be solved by the present invention is to provide an authentication management method, device, WLAN access device, and communication system. In the related WLAN communication system, the WLAN access device feeds back the authentication result of each authentication request to the WLAN. Managing devices is prone to congestion between the WLAN access device and the WLAN management device.

In order to solve the above technical problems, the following technical solutions are adopted:

A method of authentication management, including:

Receiving an authentication request sent by the WLAN terminal for establishing a WLAN connection;

Determining whether the authentication request is an invalid authentication request continuously sent by the WLAN terminal. When the authentication request is an invalid authentication request continuously sent by the WLAN terminal, the processing result of the authentication request is not fed back to the WLAN management device.

Optionally, the step of determining whether the authentication request is an invalid authentication request continuously sent by the WLAN terminal comprises:

Performing an authentication process according to the authentication request, for example, if the authentication fails, further determining whether the last authentication of the WLAN terminal also fails, and if yes, determining that the authentication request is an invalid authentication request continuously sent by the WLAN terminal;

or

The authentication request is matched with the invalid authentication request in the authentication failure list. If the matching is successful, the authentication request is determined to be an invalid authentication request continuously sent by the WLAN terminal, where the WLAN terminal is stored in the authentication failure list. The most recent authentication is an authentication request sent when the authentication failed.

Optionally, the method further includes:

Counting the number of times the WLAN terminal continuously sends an invalid authentication request;

And when the WLAN terminal continuously sends the invalid authentication request for more than the set number of times, and/or the WLAN terminal continuously sends the invalid authentication request to be greater than the set frequency threshold, to the WLAN terminal A management instruction for notifying the WLAN terminal to stop transmitting the authentication request is sent.

Optionally, before the step of receiving the authentication request sent by the WLAN terminal, the method further includes: establishing an association with the WLAN terminal;

After continuously transmitting the management command N times to the WLAN terminal, if the invalid authentication request sent by the WLAN terminal is still received, the association with the WLAN terminal is disconnected;

Wherein, the N is greater than or equal to 1.

An authentication management device includes an information receiving module, a determining module, and a processing module, wherein

The information receiving module is configured to: receive an authentication request sent by the WLAN terminal to establish a WLAN connection;

The determining module is configured to: determine whether the authentication request is an invalid authentication request continuously sent by the WLAN terminal, and if yes, send the determination result to the processing module;

The processing module is configured to: after receiving the determination result, not returning the processing result of the authentication request to the WLAN management device.

Optionally, the determining module includes an authentication submodule and an analysis submodule, where

The authentication sub-module is configured to: perform authentication on the authentication request, such as authentication failure, and notify the analysis sub-module;

The analysis sub-module is configured to: determine whether the last authentication of the WLAN terminal also fails, and if yes, determine that the authentication request is an invalid authentication request continuously sent by the WLAN terminal;

or

The determining module includes a matching sub-module, and the matching sub-module is configured to: match the authentication request with an invalid authentication request in the authentication failure list, and if the matching is successful, determine that the authentication request is continuously sent by the WLAN terminal. An invalid authentication request, wherein the authentication failure list stores an authentication request sent when the WLAN terminal is most recently authenticated as an authentication failure.

Optionally, the device further includes a statistics module and a message management module, where

The statistic module is configured to: count the number of times the WLAN terminal continuously sends an invalid authentication request;

The message management module is configured to: when it is determined that the WLAN terminal continuously sends the invalid authentication request for more than the set number of times, and/or when the frequency of continuously transmitting the invalid authentication request is greater than the set frequency threshold And transmitting, to the WLAN terminal, a management instruction for notifying the WLAN terminal to stop sending the authentication request.

Optionally, the device further includes a communication module and a connection management module, wherein

The communication module is configured to: establish an association with the WLAN terminal before the information receiving module receives the authentication request;

The connection management module is configured to notify the communication module to be disconnected when the message management module continuously sends the management command to the WLAN terminal N times, and still receives the invalid authentication request sent by the WLAN terminal. Opening an association with the WLAN terminal, wherein the N is greater than or equal to 1.

A WLAN access device includes a memory and a processor;

The memory is configured to: store at least one program instruction;

The processor is configured to: invoke the program instruction to execute the above-described authentication management method.

A communication system includes a WLAN management device, a WLAN terminal, and the WLAN access device described above; the WLAN terminal, the WLAN access device, and the WLAN management device are sequentially connected in communication.

A computer program comprising program instructions that, when executed by an authentication management device, cause the authentication management device to perform the above-described authentication management method.

A carrier carrying the above computer program.

The beneficial effects of the technical solution of the present invention are:

An authentication management method, device, WLAN access device, and communication system provided by the technical solution of the present invention, after receiving an authentication request for establishing a WLAN connection sent by a WLAN terminal, determining whether the authentication request is continuously sent by the WLAN terminal The invalid authentication request, if yes, does not feed back the processing result of the authentication request to the WLAN management device; that is, in the embodiment of the present invention, the WLAN access device may no longer provide the WLAN terminal with an invalid authentication request that is continuously and repeatedly sent by the WLAN terminal. The WLAN management device feeds back the message that the authentication fails, and only feeds back to the WLAN management device the WLAN terminal authentication success and the message notification when the first authentication fails. Therefore, the amount of message interaction between the WLAN access device and the WLAN management device can be greatly reduced, and various abnormalities caused by message blocking between the two can be avoided, and the key suitable for the WLAN access device is uniformly modified by the WLAN management device. Under the scene.

BRIEF abstract

FIG. 1 is a schematic diagram of networking of a WLAN communication system in which a management mode is “thin mode”;

2 is a schematic diagram of an authentication management method provided in another embodiment of the present invention;

3 is a schematic diagram of an authentication management device provided in another embodiment 2 of the present invention;

4 is a schematic structural diagram of a WLAN access device according to another embodiment 3 of the present invention;

FIG. 5 is a schematic diagram of an authentication management method provided in another embodiment 3 of the present invention.

Preferred embodiment of the invention

The present invention will be further described in detail below with reference to the accompanying drawings.

Embodiment 1:

Referring to FIG. 2, the authentication management management method provided in this embodiment is applicable to a WLAN communication system in which the management mode is a thin mode; the method includes the following steps:

Step 201: The authentication management device is associated with the WLAN terminal (including a terminal supporting a WLAN connection, a PAD, a smart phone, etc.); the authentication management device in this embodiment may be the WLAN access device shown in FIG. It can be implemented independently of other third-party devices of the WLAN access device; when it is a WLAN access device, it can directly associate with the WLAN terminal; otherwise, it can be associated with the WLAN terminal indirectly through the WLAN access device, that is, authentication The management device is associated with the WLAN access device, and the WLAN access device is associated with the WLAN terminal; in addition, based on the current communication, the WLAN terminal generally initiates a management request;

Step 202: The authentication management apparatus receives an authentication request that is sent by the WLAN terminal and is used to establish a WLAN connection. The authentication request includes an authentication key, and may further include identification information of the WLAN terminal.

Step 203: The authentication management apparatus determines whether the authentication request is an invalid authentication request continuously sent by the WLAN terminal, and if yes, go to step 204; otherwise, go to step 205; where the continuously sent invalid authentication request refers to the authentication request The authentication request that the authentication fails to pass and the WLAN terminal sends last time is also an authentication request that cannot pass the authentication;

Step 204: The authentication management device does not feed back the processing result of the authentication request to the WLAN management device; that is, when the authentication management device in this embodiment is implemented by the WLAN access device, it does not feed back the authentication request to the WLAN management device. If the authentication management device is implemented by other third-party devices that are independent of the WLAN access device, send a notification that the processing result is not fed back to the WLAN management device to control the WLAN access device not to the WLAN access device. The WLAN management device feeds back the processing result;

Step 205: The authentication management device normally feeds back the processing of the authentication request to the WLAN management device. As a result; for example, when the authentication succeeds or fails, when the authentication management device is implemented by the WLAN access device, it normally feeds back the processing result of the authentication success or failure to the WLAN management device; if the authentication management device is independent of the WLAN When the other third-party device of the access device implements, the WLAN access device sends a notification that the processing result is normally fed back to the WLAN management device, and the WLAN access device normally reports the processing result of the successful or failed authentication to the WLAN management device according to the notification.

It can be seen that, in this embodiment, for the WLAN terminal to continuously and repeatedly send invalid authentication request, the WLAN access device no longer feeds back the notification of the authentication failure to the WLAN management device, and only feeds back the WLAN terminal authentication success to the WLAN management device for the first time. Message notification when authentication fails. Therefore, the amount of message interaction between the WLAN access device and the WLAN management device can be greatly reduced, and various abnormalities caused by message blocking between the two can be avoided, including the loss of management capability of the WLAN management device due to message congestion.

It should be understood that, in the foregoing step 203, the manner of determining whether the authentication request is an invalid authentication request continuously sent by the WLAN terminal may be selected according to a specific application scenario. In order to better understand the present invention, the following is exemplified in two specific manners. But it should be understood that it is not limited to the following two ways:

Manner 1: The authentication process is performed according to the received authentication request. If the authentication fails, it is determined whether the last authentication of the WLAN terminal also fails. If yes, the authentication request is determined to be an invalid authentication request continuously sent by the WLAN terminal.

Manner 2: Maintaining an authentication failure list. The authentication failure list stores an authentication request sent by the WLAN terminal when the authentication is the last time the authentication fails. The authentication request received is matched with the invalid authentication request in the authentication failure list. If the matching is successful, determining that the authentication request is an invalid authentication request continuously sent by the WLAN terminal;

For example, for a WLAN terminal, when the authentication request is sent for the first time, if the authentication is successful, the authentication request is not recorded in the authentication failure list. If the authentication fails, the authentication request is recorded in the authentication failure list; When the second authentication request sent by the WLAN terminal is sent, it is determined whether the second-time authentication request is stored in the authentication failure list (generally, the WLAN terminal information included in the authentication request and the authentication key are the same) If yes, it indicates that the authentication request sent the second time is the same as the authentication request that failed the last authentication. The invalid authentication request sent by the WLAN terminal continuously; if not, the normal authentication process is performed on the authentication request. If the authentication is successful, the related information about the WLAN terminal is cleared in the authentication failure list (for example, the second authentication request is sent). The request for the authentication key may be modified. In this case, the first authentication request sent in the authentication list needs to be cleared; that is, the authentication failure list in this embodiment is dynamically updated, and the WLAN terminal is saved last time. Authentication is an authentication request sent when authentication fails).

In this embodiment, in order to facilitate the management of the WLAN terminal, the authentication management apparatus may also perform statistics on the number of consecutive transmissions of the invalid authentication request by the WLAN terminal, and directly implement the intervention management of the WLAN terminal authentication based on the statistical result, thereby avoiding the WLAN terminal. Continuously sending invalid authentication requests repeatedly; the specific process includes:

Counting the number of times the WLAN terminal continuously sends invalid authentication requests;

Determining whether the frequency of the WLAN terminal continuously transmitting the invalid authentication request is greater than a set frequency threshold (for example, 10 times per second), and if so, sending a management command for notifying the WLAN terminal to stop sending the authentication request to the WLAN terminal; After the management command, it is known that the authentication has failed, and is notified not to repeatedly send the same authentication request.

Certainly, in this embodiment, it is also directly determined whether the number of times the WLAN terminal continuously sends the invalid authentication request is greater than the set number of times threshold N1, and if so, sends a management command to the WLAN interrupt. For example, it is determined whether the WLAN terminal continuously sends 10 invalid authentication requests. At this time, there is no time limit, that is, how many times the unit time (for example, 1 second) is reached, as long as the number of consecutive transmissions is greater than the set threshold. The value is OK, and the difference from the above-mentioned way of managing the frequency is only the conversion of the number of statistics and the frequency.

In this embodiment, the specific value of the frequency threshold and/or the threshold value may be specifically selected according to the processing capability of the specific WLAN terminal.

In practical applications, it may happen that although the N (N takes an integer greater than or equal to 1) transmission management command has been continuously sent to the WLAN terminal, the WLAN terminal ignores the continuous transmission of the invalid authentication request. The association with the WLAN terminal is directly disconnected to completely prevent the WLAN terminal from repeatedly transmitting invalid authentication request messages.

Embodiment 2:

This embodiment provides an authentication management apparatus, which may be a WLAN access device in the system shown in FIG. 1, or an additional third party independent of the WLAN access device in the system shown in FIG. The device can be implemented as long as it can implement the following management process. Specifically, as shown in FIG. 3, the authentication management apparatus includes: a communication module 301, an information receiving module 302, a determining module 303, and a processing module 304;

The communication module 301 is configured to: establish an association with the WLAN terminal;

The information receiving module 302 is configured to: receive an authentication request sent by the WLAN terminal for establishing a WLAN connection; the authentication request includes an authentication key, and may further include identification information of the WLAN terminal;

The determining module 303 is configured to: determine whether the authentication request received by the information receiving module is an invalid authentication request continuously sent by the WLAN terminal, and send the determination result to the processing module;

The processing module 304 is configured to: when the determination result is yes, not to feed back the processing result of the authentication request to the WLAN management device; when the determination result is no, the processing result of the authentication request is normally fed back to the WLAN management device; for example When the authentication management device in this embodiment is implemented by the WLAN access device, the processing module 304 notifies the information sending module of the internal device that the internal information sending module does not feed back the processing result of the authentication request to the WLAN management device; if the authentication management device passes the independent When the third-party device of the WLAN access device is implemented, the processing module 304 may send a notification to the WLAN access device that the processing result is not fed back to the WLAN management device, so as to control the WLAN access device not to feed back the processing result to the WLAN management device.

It can be seen that, by using the management device provided in this embodiment, an invalid authentication request for continuous and repeated transmission of the WLAN terminal can be implemented, and the notification of the authentication failure is not returned to the WLAN management device, and only the WLAN terminal device is successfully fed back to the WLAN management device. The message notification when the first authentication fails, can greatly reduce the amount of message interaction between the WLAN access device and the WLAN management device.

In this embodiment, the determining module 303 determines whether the authentication request received by the information receiving module 302 is an invalid authentication request continuously sent by the WLAN terminal, and may select and confirm according to the specific application scenario. In order to better understand the present invention, the following is exemplified in two specific manners. But it should be understood that it is not limited to the following two ways:

Manner 1: The determining module 303 includes an authentication submodule and an analysis submodule;

The authentication submodule authenticates the authentication request, such as the authentication failure, and notifies the analysis submodule;

Manner 2: The determining module 303 includes a matching sub-module, and is configured to: match the authentication request with the invalid authentication request in the authentication failure list, and if the matching is successful, determine that the authentication request is an invalid authentication request continuously sent by the WLAN terminal; The authentication failure list here stores the authentication request sent by the WLAN terminal when the authentication is the last time the authentication fails. For example, for a WLAN terminal, when the authentication request is sent for the first time, if the authentication is successful, the authentication request is not recorded in the authentication failure list. If the authentication fails, the authentication request is recorded in the authentication failure list; When the second authentication request sent by the WLAN terminal is sent, it is determined whether the second-time authentication request is stored in the authentication failure list (generally, the WLAN terminal information included in the authentication request and the authentication key are the same) If yes, it indicates that the authentication request sent in the second time is the same as the authentication request that failed to be sent last time, and determines that the WLAN terminal continuously sends an invalid authentication request; if not, performs normal authentication processing on the authentication request. If the authentication succeeds, the related information about the WLAN terminal is cleared in the authentication failure list. For example, the second authentication request may be a request to modify the authentication key. In this case, the first saved in the authentication list needs to be cleared. The authentication request sent in the second time; that is, the authentication failure list in this embodiment is dynamically updated, and the WL is mainly saved. The AN terminal was last authenticated as an authentication request sent when the authentication failed.

In this embodiment, in order to facilitate the management of the WLAN terminal, the number of times that the WLAN terminal continuously sends invalid authentication requests may be counted, and the intervention management of the WLAN terminal authentication is directly implemented based on the statistical result, so as to avoid the WLAN terminal repeating all the time. Invalid authentication request is sent continuously. Therefore, the authentication management apparatus in this embodiment may further include a statistics module and a message management module;

The statistics module is configured to: count the number of times the WLAN terminal continuously sends invalid authentication requests;

The message management module is configured to: when it is determined that the frequency at which the WLAN terminal continuously sends the invalid authentication request is greater than the set frequency threshold, send a message to the WLAN terminal to notify the WLAN terminal to stop sending A management instruction to send an authentication request. After receiving the management command, the WLAN terminal knows that the authentication has failed, and is notified not to repeatedly send the same authentication request.

Certainly, in this embodiment, the message management module may directly determine whether the number of times the WLAN terminal continuously sends the invalid authentication request is greater than the set number of times threshold N1, and if so, sends a management command to the WLAN interrupt. For example, it is determined whether the WLAN terminal continuously sends 10 invalid authentication requests. In this case, the time is not limited, and the number of times that the WLAN terminal must be sent in a unit time (for example, 1 second) is not limited, as long as the number of consecutive transmissions is greater than the set. The threshold value is sufficient. The only difference between it and the above-mentioned way of managing the frequency is the conversion of the number of statistics and the frequency.

In practical applications, there may be a message management module that has continuously sent N (N takes an integer greater than or equal to 1) transmission management command to the WLAN terminal, but the WLAN terminal ignores it and repeats the continuous transmission of the invalid authentication request. At this time, the association with the WLAN terminal can be directly disconnected to completely prevent the WLAN terminal from repeatedly transmitting invalid authentication request messages. Therefore, the authentication management apparatus in this embodiment may further include a connection management module, configured to: after the message management module continuously sends N management commands to the WLAN terminal, and still receives the invalid authentication request continuously sent by the WLAN terminal, The communication module is notified to disconnect from the WLAN terminal.

Embodiment 3:

The present embodiment provides a communication system, including a WLAN management device, a WLAN access device, and a WLAN terminal, which are sequentially connected in communication; wherein, as shown in FIG. 4, the WLAN access device includes a memory 401 and a processor 402; It is configured to: store at least one program instruction, and the processor 402 is configured to: invoke the program instruction to execute the authentication management process in the first embodiment. Specifically, at least the following steps are included:

Establishing an association with a WLAN terminal;

It is determined whether the authentication request is an invalid authentication request continuously sent by the WLAN terminal, and if yes, the processing result of the authentication request is not fed back to the WLAN management device.

That is, the embodiment is described by taking the authentication management device as a WLAN access device as an example. In addition, the specific implementation manners of the foregoing steps have been explicitly described in the first embodiment, and are not further described herein. Said. In this embodiment, a complete and specific application scenario is taken as an example, and one of the two determination modes provided in the foregoing embodiment is taken as an example for description. Here:

First, the interaction mode between the WLAN management device and the WLAN access device is: mainly adopts the current common interaction mode, the CAPWAP protocol mode, which is also a protocol mode generally adopted by the carrier-level WLAN centralized control device, and the protocol thereof The standardization work is also basically unified under the impetus of major operators, and realizes the interconnection and interconnection between devices of various manufacturers;

Second, the interaction between the WLAN access device and its internal authentication sub-module is as follows: the authentication sub-module can adopt a separate process, and the ioctl command line is used to issue the authentication/encryption result of the terminal with the WLAN access device, and the WLAN is connected. The ingress device sends the authentication request of the WLAN terminal to the authentication submodule by sending a netlink message;

Third, the WLAN access device and the WLAN terminal's network card fully comply with the 802.11 protocol for normal communication.

Referring to Figure 5, the management process includes:

Step 501: After obtaining the information of the nearby WLAN access device, the WLAN terminal interacts with the WLAN access device to complete the association.

Step 502: After the WLAN terminal establishes an association with the WLAN access device, the WLAN access device receives the authentication request sent by the WLAN terminal.

Step 503: The WLAN access device receives the authentication request.

Step 504: The authentication sub-module of the WLAN access device authenticates the authentication request by using a mechanism such as a key agreement and a four-way handshake, and sends the authentication result to the WLAN access device.

Step 505: The WLAN access device further reports the authentication result to the WLAN terminal in a message form.

Step 506: The WLAN access device determines whether the authentication result is successful, if yes, go to step 507; otherwise, go to step 508; it should be understood that there is no strict timing limit between step 505 and step 506. At the same time, it can also be carried out one after the other;

Step 507: The WLAN access device successfully establishes a connection with the WLAN terminal; the WLAN access device also sends a message that the terminal is successfully associated to the WLAN management device by using a private protocol between the WLAN access device and the WLAN management device;

Step 508: determining whether the last authentication of the WLAN terminal is also a failure, that is, determining whether the authentication request is an invalid authentication request repeatedly sent by the WLAN terminal; if yes, go to step 509; otherwise, go to step 510;

Step 509: It is forbidden to repeatedly feed back the message that the authentication request authentication fails to the WLAN management device.

Step 510: The processing result of the authentication request is normally fed back to the WLAN management device.

It can be seen that the solution provided by the embodiment of the present invention can identify the repeated and invalid authentication request continuously sent by the WLAN terminal, and prevent the processing result of the authentication request message from being continuously sent to the upper layer for processing, and the WLAN access device is mitigated. The packet exchange pressure between the WLAN access device and the WLAN management device is prevented from colliding with the WLAN management device.

The above is a further detailed description of the present invention in connection with the specific embodiments, and the specific embodiments of the present invention are not limited to the description. It will be apparent to those skilled in the art that the present invention may be made without departing from the spirit and scope of the invention.

Industrial applicability

An authentication management method, device, WLAN access device, and communication system provided by the technical solution of the present invention, after receiving an authentication request for establishing a WLAN connection sent by a WLAN terminal, determining whether the authentication request is continuously sent by the WLAN terminal The invalid authentication request, if yes, does not feed back the processing result of the authentication request to the WLAN management device; that is, in the embodiment of the present invention, the WLAN access device may no longer provide the WLAN terminal with an invalid authentication request that is continuously and repeatedly sent by the WLAN terminal. The WLAN management device feeds back the message that the authentication fails, and only feeds back to the WLAN management device the WLAN terminal authentication success and the message notification when the first authentication fails. Therefore, the amount of message interaction between the WLAN access device and the WLAN management device can be greatly reduced, and various abnormalities caused by message blocking between the two can be avoided, and the key suitable for the WLAN access device is uniformly modified by the WLAN management device. Under the scene. Therefore, the present invention has strong industrial applicability.

Claims

A method of authentication management, including:

Receiving an authentication request sent by the WLAN terminal for establishing a WLAN connection;

Determining whether the authentication request is an invalid authentication request continuously sent by the WLAN terminal. When the authentication request is an invalid authentication request continuously sent by the WLAN terminal, the processing result of the authentication request is not fed back to the WLAN management device.
The authentication management method according to claim 1, wherein the step of determining whether the authentication request is an invalid authentication request continuously transmitted by the WLAN terminal comprises:

Performing an authentication process according to the authentication request, for example, if the authentication fails, further determining whether the last authentication of the WLAN terminal also fails, and if yes, determining that the authentication request is an invalid authentication request continuously sent by the WLAN terminal;

or

The authentication request is matched with the invalid authentication request in the authentication failure list. If the matching is successful, the authentication request is determined to be an invalid authentication request continuously sent by the WLAN terminal, where the WLAN terminal is stored in the authentication failure list. The most recent authentication is an authentication request sent when the authentication failed.
The authentication management method according to claim 1 or 2, further comprising:

Counting the number of times the WLAN terminal continuously sends an invalid authentication request;

And when the WLAN terminal continuously sends the invalid authentication request for more than the set number of times, and/or the WLAN terminal continuously sends the invalid authentication request to be greater than the set frequency threshold, to the WLAN terminal A management instruction for notifying the WLAN terminal to stop transmitting the authentication request is sent.
The authentication management method according to claim 3, wherein:

Before the step of receiving the authentication request sent by the WLAN terminal, the method further includes: establishing an association with the WLAN terminal;

After continuously transmitting the management command N times to the WLAN terminal, if the invalid authentication request sent by the WLAN terminal is still received, the association with the WLAN terminal is disconnected;

Wherein, the N is greater than or equal to 1.
An authentication management device includes an information receiving module, a determining module, and a processing module, wherein

The information receiving module is configured to: receive an authentication request sent by the WLAN terminal to establish a WLAN connection;

The determining module is configured to: determine whether the authentication request is an invalid authentication request continuously sent by the WLAN terminal, and if yes, send the determination result to the processing module;

The processing module is configured to: after receiving the determination result, not returning the processing result of the authentication request to the WLAN management device.
The authentication management device according to claim 5, wherein:

The determining module includes an authentication submodule and an analysis submodule, wherein

The authentication sub-module is configured to: perform authentication on the authentication request, such as authentication failure, and notify the analysis sub-module;

The analysis sub-module is configured to: determine whether the last authentication of the WLAN terminal also fails, and if yes, determine that the authentication request is an invalid authentication request continuously sent by the WLAN terminal;

or

The determining module includes a matching sub-module, and the matching sub-module is configured to: match the authentication request with an invalid authentication request in the authentication failure list, and if the matching is successful, determine that the authentication request is continuously sent by the WLAN terminal. An invalid authentication request, wherein the authentication failure list stores an authentication request sent when the WLAN terminal is most recently authenticated as an authentication failure.
The authentication management device according to claim 5 or 6, further comprising a statistics module and a message management module, wherein

The statistic module is configured to: count the number of times the WLAN terminal continuously sends an invalid authentication request;

The message management module is configured to: when it is determined that the WLAN terminal continuously sends the invalid authentication request for more than the set number of times, and/or when the frequency of continuously transmitting the invalid authentication request is greater than the set frequency threshold Sending to the WLAN terminal, for notifying the WLAN terminal to stop sending Management instructions for authentication requests.
The authentication management apparatus according to claim 7, further comprising a communication module and a connection management module, wherein

The communication module is configured to: establish an association with the WLAN terminal before the information receiving module receives the authentication request;

The connection management module is configured to notify the communication module to be disconnected when the message management module continuously sends the management command to the WLAN terminal N times, and still receives the invalid authentication request sent by the WLAN terminal. Opening an association with the WLAN terminal, wherein the N is greater than or equal to 1.
A WLAN access device includes a memory and a processor;

The memory is configured to: store at least one program instruction;

The processor is configured to invoke the program instruction to perform the authentication management method of any one of claims 1-4.
A communication system, comprising: a WLAN management device, a WLAN terminal, and the WLAN access device according to claim 9; the WLAN terminal, the WLAN access device, and the WLAN management device are in communication connection in sequence.
A computer program comprising program instructions that, when executed by an authentication management device, cause the authentication management device to perform the authentication management method of any one of claims 1-4.
A carrier carrying the computer program of claim 11.