WO2016184380A1

WO2016184380A1 - Processing method and device for network access

Info

Publication number: WO2016184380A1
Application number: PCT/CN2016/082354
Authority: WO
Inventors: 范贤友
Original assignee: 中兴通讯股份有限公司
Priority date: 2015-05-19
Filing date: 2016-05-17
Publication date: 2016-11-24
Also published as: CN106162549A

Abstract

A processing method and device for network access. The method comprises: transmitting position information of a terminal to an authentication server; receiving a judgment result returned by the authentication server according to the position information, wherein the judgment result is used for marking whether the terminal is positioned within a target range of a scheduled network or not; and determining, according to the judgment result, whether to allow the terminal to access the scheduled network or not. The solution solves the problem of low control efficiency of network access existing in the related art, thereby realizing an effect of improving the control efficiency of network access.

Description

Access network processing method and device

Technical field

The present application relates to, but is not limited to, the field of communications, and in particular, to a method and apparatus for processing an access network.

Background technique

With the rapid development of the mobile Internet, various smart terminals and Wi-Fi wireless networks have spread all over the place where people are active. However, the phenomenon of invading Wi-Fi wireless networks and stealing the bandwidth of other Internet-enabled terminals has not been effectively banned. It not only affects the network experience, but also slows down the network speed. The greater harm is to connect untrusted devices to the LAN. In the network, it brings greater cyber security risks. Wi-Fi wireless networks have multiple encryption schemes, such as Wired Equivalent Privacy (WEP), Wi-Fi Protected Access (WPA), and more advanced. WPA2 and so on, where WEP has been eliminated, WPA/WPA2 and other methods are safer when the password is complicated enough, but the password information of each Wi-Fi wireless network is collected due to a large number of software similar to the wifi master key. Share to other users, although the user may not be able to see the plaintext password, but the password is actually leaked; a more secure method is to set the media access control (MAC) address whitelist on the firewall. However, this method is cumbersome to configure and is only suitable for a small and fixed network user.

In commercial/public areas, the password of the Wi-Fi wireless network is usually written on the wall or provided by the clerk. This method has no security; the safer method is no password access, via SMS authentication code or WeChat attention. In the other way, the method needs to be configured on the router. The request initiated by the unauthenticated client will be redirected to the specified authentication page. After the authentication is passed, the Wi-Fi wireless network can be used. Now the general intelligence Routers can support such authentication methods, and the mainstream open source plug-in wifidog can achieve this function very well.

Through SMS/WeCell authentication, merchants can collect more accurate customer information and accurately push relevant information, but still can't control non-target groups to use Wi-Fi wireless network, such as the wireless network provided by a hotel, naturally only hope employees and Guests who stay can use it, invading the Wi-Fi wireless network and stealing the bandwidth of other Internet-enabled terminals not only increases the network security risk, but also affects the network experience of the guests and reduces the network speed. It can be seen that there is a network in the related art. The problem of low access control efficiency.

In view of the low efficiency of network access control existing in the related art, an effective solution has not been proposed yet.

Summary of the invention

The following is an overview of the topics detailed in this document. This Summary is not intended to limit the scope of the claims.

The present application provides a method and an apparatus for processing an access network, so as to at least solve the problem of low efficiency of network access control existing in the related art.

According to an aspect of the present application, a method for processing an access network is provided, including: transmitting location information of a terminal to an authentication server; and receiving a determination result returned by the authentication server according to the location information, where the determining result is used by And determining whether the terminal is within a target range of the predetermined network; determining, according to the determination result, whether the terminal is allowed to access the predetermined network.

Optionally, the location information includes at least one of the following: a media access control MAC address of a Wi-Fi signal transmitting end carried by the Wi-Fi signal detected by the terminal, and a Wi-Fi signal detected by the terminal. The signal strength, the address of the Bluetooth signal transmitting end carried by the Bluetooth signal detected by the terminal, and the signal strength of the Bluetooth signal detected by the terminal.

Optionally, when the determining result is that the terminal is in the target range, the step of determining, according to the determining result, whether to allow the terminal to access the predetermined network, includes: acquiring the determination result Carrying token information; accessing the predetermined network through a router according to the token information.

According to another aspect of the present application, a method for processing an access network is provided, including: receiving location information of a terminal; determining, according to the location information, whether the terminal is within a target range of a predetermined network; and controlling the location according to the determination result The terminal accesses the predetermined network.

Optionally, the step of controlling the terminal to access the predetermined network according to the determining result includes: sending the token information to the terminal when the determining result is that the terminal is located in the target range The token information is used by the terminal to access the predetermined network through a router; when the determination result is that the terminal is outside the target range, sending a rejection to the terminal The information that the terminal accesses the predetermined network.

Optionally, after the step of sending the token information to the terminal when the determining result is that the terminal is located in the target range, the processing method further includes: receiving, by the router, Determining token information, wherein the predetermined token information is sent by the router after receiving the predetermined token information sent by the terminal; verifying the predetermined token information and token information sent to the terminal Whether the agreement is consistent; if the verification result is consistent, the terminal allows access information of the predetermined network to be sent to the router.

The application further provides a computer readable storage medium storing computer executable instructions that are implemented when the computer executable instructions are executed.

According to another aspect of the present application, a processing apparatus for accessing a network includes: a sending module configured to send location information of a terminal to an authentication server; and a first receiving module configured to receive the authentication server according to the And a determination result returned by the location information, where the determination result is used to identify whether the terminal is within a target range of the predetermined network; and the processing module is configured to determine, according to the determination result, whether the terminal is allowed to access the predetermined network.

Optionally, the processing module includes: an acquiring unit, configured to acquire token information carried in the determining result when the determining result is that the terminal is in the target range; and the access unit is configured to Accessing the predetermined network through a router according to the token information.

According to another aspect of the present application, a processing apparatus for accessing a network is provided, including: a second receiving module configured to receive location information of the terminal; and a determining module configured to determine, according to the location information, whether the terminal is in Within the target range of the predetermined network; the control module is configured to control the terminal to access the predetermined network according to the judgment result.

Optionally, the control module includes: a first sending unit, configured to send token information to the terminal when the determining result is that the terminal is located in the target range, where the token information The second sending unit is configured to: when the determining result is that the terminal is outside the target range, send a rejection to the terminal; The information that the terminal accesses the predetermined network.

Optionally, the device further includes: a receiving unit, configured to receive predetermined token information sent by the router, where the predetermined token information is the predetermined token information that is sent by the router after receiving the terminal And a verification unit, configured to verify whether the predetermined token information is consistent with the token information sent to the terminal; and the third sending unit is configured to allow the verification if the verification result of the verification unit is consistent The permission information that the terminal accesses the predetermined network is sent to the router.

Through the solution of the present application, the location information of the terminal is sent to the authentication server, and the determination result returned by the authentication server according to the location information is received, where the determination result is used to identify whether the terminal is within the target range of the predetermined network. And determining, according to the determination result, whether the terminal is allowed to access the predetermined network, and solving the problem that the network access control efficiency in the related art is low, thereby achieving an effect of improving network access control efficiency.

Other aspects will be apparent upon reading and understanding the drawings and detailed description.

BRIEF abstract

The drawings described herein are intended to provide a further understanding of the present application, and are intended to be a part of this application. In the drawing:

1 is a flowchart of a processing method of a first access network according to an embodiment of the present invention;

2 is a flowchart of a method for processing a second access network according to an embodiment of the present invention;

3 is a structural block diagram of a processing apparatus of a first access network according to an embodiment of the present invention;

4 is a structural block diagram of an alternative embodiment of a processing apparatus for a first access network according to an embodiment of the present invention;

FIG. 5 is a structural block diagram of a processing apparatus of a second access network according to an embodiment of the present invention; FIG.

6 is a structural block diagram of an alternative embodiment of a processing apparatus for a second access network according to an embodiment of the present invention;

FIG. 7 is a structural block diagram of another alternative embodiment of a processing apparatus for a second access network according to an embodiment of the present invention; FIG.

8 is a flow chart of interaction between a router/AC controller and an authentication server according to Embodiment 1 of the present invention;

9 is a schematic diagram of a sample library and verified points located within and outside a region, respectively, according to an embodiment of the present invention;

FIG. 10 is a flow chart showing the interaction of a router/AC controller and an authentication server in the same device according to Embodiment 2 of the present invention.

Preferred embodiment of the invention

The present application will be described in detail below with reference to the drawings in conjunction with the embodiments. It should be noted that the embodiments in the present application and the features in the embodiments may be combined with each other without conflict.

It should be noted that the terms "first", "second" and the like in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or order.

With the gradual maturity of indoor positioning technology, using Wi-Fi/Bluetooth fingerprint positioning technology, inertial sensing technology and other technologies, the positioning accuracy has reached the meter level. Based on the above problems in the related art, in the embodiment of the present invention, the indoor positioning technology is combined with the wireless network authentication, and a scheme of using the location of the terminal as the authentication parameter of the Wi-Fi wireless network is proposed, and the location according to the terminal is implemented. Determine if the terminal can access the network.

In this embodiment, a processing method of an access network is provided. FIG. 1 is a flowchart of a processing method of a first access network according to an embodiment of the present invention. As shown in FIG. 1, the processing method includes the following steps. :

Step S102: Send location information of the terminal to the authentication server.

Step S104, receiving a determination result returned by the authentication server according to the location information, where the determination result is used to identify whether the terminal is within a target range of the predetermined network;

Step S106: Determine, according to the determination result, whether the terminal is allowed to access the predetermined network.

Through the above steps, when the terminal is controlled by the access network, it is determined whether the terminal is allowed to access the predetermined network by determining the location information of the terminal, so that the terminal within the target range of the predetermined network can access the predetermined network, thereby improving The safety factor of the network connection also ensures legality User's interest. The problem that the network access control efficiency in the related art is low is solved, and the effect of improving the network access control efficiency is achieved.

The foregoing location information may be determined in multiple manners. In an optional embodiment, the location information may include at least one of the following information: a Wi-Fi signal transmission carried by the Wi-Fi signal detected by the terminal. The media access control MAC address of the terminal and the signal strength of the Wi-Fi signal detected by the terminal, the address of the Bluetooth signal transmitting end carried by the Bluetooth signal detected by the terminal, and the signal strength of the Bluetooth signal detected by the terminal; The location function of the terminal determines the specific location of the terminal, and reports the determined location information to the authentication server; or determines the location information of the terminal by other means.

In an optional embodiment, when the determining result is that the terminal is in the target range, the step of determining, according to the determination result, whether the terminal is allowed to access the predetermined network, includes: acquiring token information carried in the determination result; The token information is accessed by the router to the predetermined network. The step of accessing the predetermined network by using the router according to the token information may include: after acquiring the token information, the terminal sends the token information to the router, and the router sends the received token information to the authentication server, and the authentication server The host is allowed to access the predetermined network by comparing the token information sent by the router with the token information sent to the terminal in advance. When the comparison result is consistent, it is determined that the terminal is in the target range, and the terminal is allowed to access the predetermined network, so that the terminal accesses the predetermined network through the router. If the comparison result is inconsistent, the terminal is not allowed to access the predetermined network. In addition, it intercepts illegal users to access the network and protects the interests of legitimate users. Improve the safety factor of the access network.

FIG. 2 is a flowchart of a method for processing a second access network according to an embodiment of the present invention. As shown in FIG. 2, the processing method includes the following steps:

Step S202, receiving location information of the terminal;

Step S204, determining, according to the location information, whether the terminal is within a target range of the predetermined network;

Step S206, controlling the terminal to access the predetermined network according to the determination result.

Through the above steps, when the control terminal accesses the network, it is determined whether the terminal is allowed to access the predetermined network by verifying the location information of the terminal, so that the terminal in the predetermined location range can access the predetermined network, thereby improving the security of the network connection. The coefficient also protects the interests of legitimate users. The invention solves the problem that the network access control efficiency in the related technology is low, thereby achieving the improvement of the network. The effect of access control efficiency.

In an optional embodiment, the step of controlling the terminal to access the predetermined network according to the foregoing judgment result comprises: sending the token information to the terminal when the determining result is that the terminal is located in the target range, wherein the token information is used for The terminal accesses the predetermined network through the router. When the result of the foregoing determination is that the terminal is outside the target range, the terminal sends information indicating that the terminal accesses the predetermined network. Thereby, the terminal is controlled to access the predetermined network according to the specific location of the terminal.

In an optional embodiment, after the step of sending the token information to the terminal, the processing method of the second access network further includes: receiving predetermined token information sent by the router, where the predetermined The token information is sent by the router after receiving the predetermined token information sent by the terminal; verifying whether the predetermined token information is consistent with the token information sent to the terminal; if the verification result is consistent, the terminal is allowed to access the predetermined network. The allowed information is sent to the router.

Through the description of the above embodiments, those skilled in the art can clearly understand that the method according to the above embodiment can be implemented by means of software plus a necessary general hardware platform, and of course, by hardware, but in many cases, the former is A better implementation. Based on such understanding, the technical solution of the present application, which is essential or contributes to the related art, may be embodied in the form of a software product stored in a storage medium (such as ROM/RAM, disk, CD-ROM). The instructions include a number of instructions for causing a terminal device (which may be a cell phone, computer, server, or network device, etc.) to perform the methods of various embodiments of the present application.

Embodiments of the present invention further provide a computer readable storage medium storing computer executable instructions that are implemented when the computer executable instructions are executed.

In the embodiment, a processing device for accessing the network is further provided, and the device is used to implement the foregoing embodiments and optional implementations, and details are not described herein. As used below, the term "module" may implement a combination of software and/or hardware of a predetermined function. Although the apparatus described in the following embodiments is preferably implemented in software, hardware, or a combination of software and hardware, is also possible and contemplated.

3 is a structural block diagram of a processing apparatus of a first access network according to an embodiment of the present invention. As shown in FIG. 3, the apparatus includes a transmitting module 32, a first receiving module 34, and a processing module 36. Be explained:

The sending module 32 is configured to send location information of the terminal to the authentication server; the first receiving module 34, connected to the foregoing sending module 32, configured to receive a determination result returned by the authentication server according to the location information, wherein the determination result is used to identify whether the terminal is within a target range of the predetermined network; and the processing module 36 is connected to the first receiving module 34. Set to determine, according to the determination result, whether the terminal is allowed to access the predetermined network.

In an optional embodiment, the foregoing location information includes at least one of the following: a media access control MAC address of the Wi-Fi signal transmitting end carried by the Wi-Fi signal detected by the terminal, and a Wi-Fi detected by the terminal. The signal strength of the signal, the address of the Bluetooth signal transmitter carried by the Bluetooth signal detected by the terminal, and the signal strength of the Bluetooth signal detected by the terminal.

FIG. 4 is a structural block diagram of an optional embodiment of a processing apparatus for a first access network according to an embodiment of the present invention. As shown in FIG. 4, the processing module 36 includes an obtaining unit 42 and an access unit 44. The processing module 36 will be described.

The obtaining unit 42 is configured to acquire the token information carried in the determination result when the terminal is in the target range, and the access unit 44 is connected to the acquiring unit 42 and configured to be connected through the router according to the token information. Enter the scheduled network.

FIG. 5 is a structural block diagram of a processing apparatus for a second access network according to an embodiment of the present invention. As shown in FIG. 5, the apparatus includes a second receiving module 52, a determining module 54, and a control module 56. Be explained.

The second receiving module 52 is configured to receive the location information of the terminal; the determining module 54 is connected to the second receiving module 52, and is configured to determine whether the terminal is within the target range of the predetermined network according to the location information; and the control module 56 is connected to the determining The unit 54 is configured to control the terminal to access the predetermined network according to the determination result.

FIG. 6 is a structural block diagram of an optional embodiment of a processing apparatus for a second access network according to an embodiment of the present invention. As shown in FIG. 6, the control module 56 includes a first sending unit 62 and/or a second. The transmitting unit 64 will be described below with respect to the control module 56.

The first sending unit 62 is configured to send token information to the terminal when the determining result is that the terminal is located in the target range, wherein the token information is used by the terminal to access the predetermined network through the router; and the second sending unit 64 sets When the result of the above judgment is that the terminal is outside the target range, the terminal is sent information rejecting the terminal accessing the predetermined network.

FIG. 7 is a structural block diagram of another alternative embodiment of a processing apparatus for a second access network according to an embodiment of the present invention. As shown in FIG. 7, the apparatus includes all the units shown in FIG. The receiving unit 72, the verifying unit 74 and the third transmitting unit 76 are also included, and the control module 56 will be described below.

The receiving unit 72 is connected to the first sending unit 62, and is configured to receive predetermined token information sent by the router, where the predetermined token information is sent by the router after receiving the predetermined token information sent by the terminal; the verifying unit 74, Connected to the receiving unit 72, configured to verify whether the predetermined token information is consistent with the token information sent to the terminal; the third sending unit 76 is connected to the verification unit 74, and is configured to: if the verification result of the verification unit is consistent, The permission information for allowing the terminal to access the predetermined network is sent to the router.

The overall process is described below. The overall process involves three types of devices: a terminal device, a wireless router and/or a wireless AC controller (hereinafter referred to as a wireless router/wireless AC controller, or simply a router/AC controller), and an authentication server.

The terminal device takes the most popular Android mobile phone as an example. The Android system provides an off-the-shelf interface for obtaining the Wi-Fi signal, the Bluetooth signal, and the base station signal of the terminal at the location. The location information that can be used to describe the terminal is very large. To simplify the description, the location information of the terminal provided by the Wi-Fi signal is taken as an example in this embodiment, and the actual implementation is not limited thereto.

Wireless Access Point Controller: For home users, the AC controller is a wireless router. It is usually a common Linux system with a kernel version of 2.4 or higher. Its own iptables program can quickly implement this application. Program.

Authentication Server: Stores a location sample library and provides an interface to verify that the location satisfies the condition. In the case of strong AC controller performance, the AC controller can be integrated with the authentication server.

The process includes the following steps:

a terminal accesses the network through Wi-Fi and issues a request to access any address;

The router determines whether the terminal is authenticated according to the source MAC address of the packet received by the terminal (ie, the MAC address of the terminal). If not, the router redirects the request to the authentication server, and is redirected. The identifier of the router is attached to the address, and is used to receive information such as the interface address of the token token.

The authentication server returns an authentication page to the terminal, where the authentication page is used by the terminal to send the location fingerprint information to the authentication server.

The terminal sends the collected location fingerprint information to the authentication server: the location fingerprint information may include the MAC address of the Wi-Fi signal transmitting end carried by the multiple Wi-Fi signals and the signal strength of the multiple Wi-Fi signals, or may also include The address of the Bluetooth signal transmitting end carried by the Bluetooth signal and the signal strength of the Bluetooth signal. Of course, the location fingerprint information may also be a combination of other information or information.

The e-authentication server determines whether the terminal is within the target range defined by the network provider according to the location fingerprint information sent by the terminal, and if the terminal is within the limited target range, sends a token token to the terminal, and redirects the request of the terminal to the router. .

The f router sends the received token token and the identifier of the router to the authentication server for verification. If the verification succeeds, the MAC address of the terminal is added to the list of allowed access networks, and the terminal is allowed to access the network through the router;

The g client (ie, the terminal) periodically feeds back to the authentication server the information such as the location fingerprint information, the token token, and the MAC address of the terminal, and the authentication server determines whether the terminal can continue to access the network according to the information, and the router periodically Ask the authentication server if the MAC is available. If not, reset the MAC to redirect to the authentication page once the network is accessed.

Embodiment 1:

This embodiment will describe the case where the AC controller is separated from the authentication server, that is, in the case of different devices.

This embodiment assumes that there is an existing indoor map and its location fingerprint sample library in the implemented environment.

Initial configuration of the AC controller: save a list of MAC addresses, the MAC address list is set to allow the terminal to access the network if the source MAC address of the message is received from the terminal, and the source of the message is received from the terminal. The MAC address is not in the MAC address list, and the packet is redirected to the authentication server. The implementation method can first use the iptables rule to perform the destination network address translation (DNAT) to the local processing process. , the local processing process redirects the request to the authentication server, and The redirected link carries information about the Access Controller (AC). Set the validity period for the MAC address in the MAC address list. For the convenience of management, the MAC address of the network administrator or the terminal of the common customer can be set to be indefinitely permanent access, that is, not participating in location-based authentication; for ordinary MAC addresses, Set the life cycle to a relatively short time, such as 5 minutes.

FIG. 8 is a flowchart of interaction between a router/AC controller and an authentication server according to the first embodiment of the present invention. As shown in FIG. 8, the process includes the following steps:

Step S802, the terminal sends an arbitrary HTTP request after connecting to the Wi-Fi network.

Step S804, the AC controller determines whether the source MAC address of the packet is in the MAC address list of the network that is allowed to access, and if the MAC address is not in the MAC address list of the network that is allowed to access, that is, if the MAC address is not authenticated, the address including the redirected address is returned to the terminal. The response of the address including the redirected address may be: Hypertext Transfer Protocol (HTTP) status code, and related information of the AC controller: including the identifier of the AC controller (this embodiment) The AC controller receives the MAC address of the AC controller as the identifier. The AC controller receives the address of the token (the IP address and port of the port) and the MAC address information of the terminal. For example, the destination address that the terminal will access is: http:/ /auth-server/index&&gwid=00:d0:d0:00:00:01&&gwip=192.168.1.1&&gwport=8080&&client=00:d0:d0:00:00:0A.

Step S806, the terminal sends a request to the authentication server.

Step S808, after receiving the request of the terminal, the authentication server extracts the parameter transmitted by the terminal in step S804 and stores the correspondence between the terminal MAC and the AC controller information, and returns a page containing an implicit form form to the terminal, the form form The destination address is, for example, http://auth-server/auth, which is used by the terminal to send the location fingerprint information carried by the current Wi-Fi signal to the authentication server, similar to the form form that is input with the SMS verification code when the short message is authenticated based on the short message. The solution is based on location authentication, and the user does not need to manually input data, and the terminal collects data by itself.

Step S810, after the client (ie, the terminal) loads the web page returned by the authentication server, the location fingerprint information carried by the collected Wi-Fi signal is sent to the response including the redirected address returned to the terminal in step S804. The address in http://auth-server/auth: is described in JSON format (JavaScript Object Notation, a lightweight data exchange format) as follows:

Where rssi is the signal strength of the Wi-Fi signal, generally expressed as a negative value, the unit is dbm. The smaller the value, the greater the signal strength. For the sake of brevity, the positive number is used here, and the unit is omitted.

Step S812: The authentication server determines the location fingerprint information carried by the received Wi-Fi signal. If the preset constraint condition is met, the gateway information of the terminal is used to query the corresponding gateway information, and a redirect address is generated and sent to the client. The redirected address contains a token token and a life cycle for indicating successful authentication, such as http://192.168.1.1:8080&&token=ezak102s&&lifetime=300, where 300 is the lifetime of the token token, and the AC controller should After 300 seconds, ask the server if it is still valid. A method for determining whether a location represented by a location fingerprint information carried by a signal such as Wi-Fi is in an area: first, finding a location that matches the location according to the location fingerprint information carried by the Wi-Fi signal, and then determining whether it is preset by a ray method Polygon (the line formed by the edge of the area forms a polygon): emits a ray from the point being judged to the x-axis. If the ray intersects the edge of the polygon an even number of times, then the point is not in the polygon; if the odd number intersects, then the point is Inside the polygon.

Step S814, the terminal sends the received token token to the AC controller.

Step S816: After receiving the redirection request from the terminal, the AC controller sends the MAC address, the AC controller identifier, and the token token of the terminal to the authentication server for verification, and is described in the JSON format as follows:

Step S818, the authentication server checks whether the MAC address of the terminal matches the token token, the AC controller identifier, and the like. The authentication server returns the authentication result to the AC controller: 0 is a match and -1 is a match failure.

Step S820, if the verification matches, the AC controller adds the MAC address of the terminal to the list of allowed access networks, and redirects the redirected request of step S816 to the heartbeat page of the authentication server, for example, http://auth-server/alive .

In step S822, the terminal keeps the heartbeat page open during the use of the network, and periodically feeds back to the authentication server the location fingerprint information carried by the current Wi-Fi signal and the token token.

Heartbeat page processing: if the location of the location fingerprint information carried by the Wi-Fi signal is not in the area, the authentication server sets the record corresponding to the MAC address to an illegal state; if the location fingerprint information carried by the Wi-Fi signal is represented by the location Within the region, its life cycle is updated. Since the terminal is likely to be in a mobile state, when it is found that it is outside the area, it does not stop immediately, but waits for the AC controller to query whether a MAC address can continue to use the network.

Step S824, the AC controller periodically queries the authentication server whether the MAC in the MAC list expires, and if it expires, deletes it from the MAC list.

Step S826, the authentication server returns a query result to the AC controller.

In the entire authentication process, the terminal is always the role of the client, and there is no need to provide an external service interface;

The AC controller needs to provide an interface for receiving a token token verification request sent by the terminal;

The authentication server needs to provide three interfaces:

Interface 1: used to receive the authentication home page http://auth-server/index that is redirected after the unauthenticated terminal goes online.

Interface 2: Receive the authentication request initiated by the terminal: http://auth-server/auth;

Interface 3: The heartbeat interface is used to receive a request from the AC controller to query whether the MAC address of the terminal has expired: http://auth-server/alive.

Embodiment 2:

This embodiment describes a scheme in which an AC controller and an authentication server are in the same device, that is, implemented on a wireless router with strong processing performance and certain storage capability, and the operating system can be a Linux system or based on openwrt (a Linux system). To modify, the interaction between the AC controller and the authentication server in this scheme is simpler, and the following description is collectively referred to as a router.

In this embodiment, it is assumed that there is no existing indoor positioning system, that is, there is no indoor map, and there is no existing location fingerprint database, and a simplified location sample library needs to be re-established: by carrying, the network can be accessed through Wi-Fi or the like. The mobile terminal travels inside and outside the set area, and collects identification and information of Wi-Fi signals/Bluetooth signals, etc. at each position during the process of traveling, and each position will be marked as inside or outside the area, in order to ensure positioning. The effect is to mark and information such as Wi-Fi signals/Bluetooth signals intensively at the edge of the area, and mark and information such as Wi-Fi signals/Bluetooth signals at a slightly larger distance in and outside the area. To ensure a matching effect. 9 is a schematic diagram of a sample library and verified points located within and outside a region, respectively, in accordance with an embodiment of the present invention.

10 is a flow chart of interaction between a router/AC controller and an authentication server in the same device according to Embodiment 2 of the present invention. As shown in FIG. 10, the process includes the following steps:

Initially set the access rule on the router through the iptables program: save a list of MAC addresses. If the source MAC address of the packet received from the terminal is in the MAC address list, the network can be accessed normally, and if the source is received from the terminal. The MAC address is not in the MAC address list, and the packet is redirected to the authentication server to run the authentication process. In this embodiment, because the authentication server and the AC controller are the same device, the address of the authentication server can be used as the local loopback address: 127.0 .0.1:8080. As in the first embodiment, for the convenience of management, the life cycle is set for the MAC address in the MAC address list, allowing the special address to access the network without authentication.

In step S1002, the terminal sends an arbitrary HTTP request after connecting to the network, for example, accessing a webpage with a website address of www.xxx.com.

In step S1004, the router determines whether it has been authenticated according to the terminal MAC address. If it is determined that the terminal is not authenticated, the packet is redirected to the local process 127.0.0.1:8080 for processing, and the terminal returns a hidden in the process. The page containing the form form, the destination address of the form is http://127.0.0.1:8080/auth, which is used by the terminal to send its current location to the authentication server, the page will remain active, and the authentication will be automatically performed periodically. The server sends location information.

In step S1006, the client sends the fingerprint information carried by the collected Wi-Fi signal to the destination address in step S1004, which is described in the JSON format as follows:

The router compares the received MAC address and signal strength with the sample library to make judgments. There are various methods for judging, such as the Euclidean distance method, the maximum likelihood probability method, the support vector machine algorithm, etc., if the sample is in the sample. If the most matching entry found in the library belongs to the zone, then the The location meets the preset constraint condition, and the MAC address is added to the foregoing MAC address list to update its life cycle; if the preset constraint is not met, the MAC address is removed from the MAC address list.

In step S1008, the router periodically scans the MAC address list, and deletes the MAC address whose lifetime has been completed, so that when the next time the network is accessed, the router continues to be redirected to the authentication page.

In the above embodiment, since both the AC controller and the authentication server are implemented in the router, two interfaces are required between the terminal and the router: one is a redirected address that is redirected to when the unauthenticated terminal accesses; The second is to verify the interface. In the specific implementation process, the same address can be used, the entry uses the get instruction action, and the verification uses the post instruction action to distinguish.

It should be noted that each of the above modules may be implemented by software or hardware. For the latter, the foregoing may be implemented by, but not limited to, the foregoing modules are all located in the same processor; or, the modules are located in multiple In the processor.

Embodiments of the present invention also provide a storage medium. Optionally, in the embodiment, the foregoing storage medium may be configured to store program code for performing the following steps:

S1. Send location information of the terminal to the authentication server.

S2, receiving a determination result returned by the authentication server according to the location information, where the determination result is used to identify whether the terminal is within a target range of the predetermined network;

S3. Determine, according to the determination result, whether the terminal is allowed to access the predetermined network.

Optionally, the storage medium is further arranged to store program code for performing the following steps:

S1. Receive location information of the terminal.

S2, determining, according to the location information, whether the terminal is within a target range of the predetermined network;

S3. Control the terminal to access the predetermined network according to the judgment result.

Optionally, in the embodiment, the foregoing storage medium may include, but is not limited to, a USB flash drive, a Read-Only Memory (ROM), and a Random Access Memory (RAM). A variety of media that can store program code, such as a hard disk, a disk, or an optical disk.

Optionally, specific examples in this embodiment may refer to the foregoing embodiment and the optional implementation manner. The described examples are not described herein again.

Obviously, those skilled in the art should understand that the above modules or steps of the present application can be implemented by a general computing device, which can be concentrated on a single computing device or distributed in a network composed of multiple computing devices. Alternatively, they may be implemented by program code executable by the computing device such that they may be stored in the storage device by the computing device and, in some cases, may be different from the order herein. The steps shown or described are performed, or they are separately fabricated into individual integrated circuit modules, or a plurality of modules or steps thereof are fabricated as a single integrated circuit module. Thus, the application is not limited to any particular combination of hardware and software.

The above description is only an optional embodiment of the present application, and is not intended to limit the present application, and various changes and modifications may be made to the present application. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of this application are intended to be included within the scope of the present application.

One of ordinary skill in the art will appreciate that all or a portion of the above steps may be performed by a program to instruct related hardware, such as a processor, which may be stored in a computer readable storage medium, such as a read only memory, disk or optical disk. Wait. Alternatively, all or part of the steps of the above embodiments may also be implemented using one or more integrated circuits. Correspondingly, each module/unit in the above embodiment may be implemented in the form of hardware, for example, by implementing an integrated circuit to implement its corresponding function, or may be implemented in the form of a software function module, for example, executing a program stored in the memory by a processor. / instruction to achieve its corresponding function. Embodiments of the invention are not limited to any specific form of combination of hardware and software.

Industrial applicability

Claims

A method for processing an access network, comprising:

Sending location information of the terminal to the authentication server;

Receiving a determination result returned by the authentication server according to the location information, where the determination result is used to identify whether the terminal is within a target range of a predetermined network;

Determining whether the terminal is allowed to access the predetermined network according to the judgment result.
The method of claim 1, wherein the location information comprises at least one of the following information:

The media access control MAC address of the Wi-Fi signal transmitting end carried by the Wi-Fi signal detected by the terminal, the signal strength of the Wi-Fi signal detected by the terminal, and the Bluetooth carried by the terminal detecting the Bluetooth signal The address of the signal transmitting end and the signal strength of the Bluetooth signal detected by the terminal.
The method according to claim 1, wherein when the determination result is that the terminal is in the target range, the step of determining whether to allow the terminal to access the predetermined network according to the determination result comprises: :

Obtaining token information carried in the judgment result;

Accessing the predetermined network through a router according to the token information.
A method for processing an access network, comprising:

Receiving location information of the terminal;

Determining, according to the location information, whether the terminal is within a target range of a predetermined network;

Controlling, by the determination result, the terminal accessing the predetermined network.
The method according to claim 4, wherein the step of controlling the terminal to access the predetermined network according to the determination result comprises:

When the result of the determination is that the terminal is located in the target range, sending token information to the terminal, where the token information is used by the terminal to access the predetermined network through a router;

And when the determining result is that the terminal is located outside the target range, sending, to the terminal, information that denies the terminal accessing the predetermined network.
The method according to claim 5, after the step of transmitting the token information to the terminal when the determining result is that the terminal is located in the target range, the processing method further includes:

Receiving predetermined token information sent by the router, where the predetermined token information is sent by the router after receiving the predetermined token information sent by the terminal;

Verifying whether the predetermined token information is consistent with the token information sent to the terminal;

If the verification result is consistent, the terminal allows access information of the predetermined network to be sent to the router.
A processing device for accessing a network, comprising:

a sending module, configured to send location information of the terminal to the authentication server;

a first receiving module, configured to receive a determination result returned by the authentication server according to the location information, where the determining result is used to identify whether the terminal is within a target range of a predetermined network;

And a processing module, configured to determine, according to the determination result, whether the terminal is allowed to access the predetermined network.
The apparatus of claim 7, wherein the location information comprises at least one of the following information:

The media access control MAC address of the Wi-Fi signal transmitting end carried by the Wi-Fi signal detected by the terminal, the signal strength of the Wi-Fi signal detected by the terminal, and the Bluetooth carried by the terminal detecting the Bluetooth signal The address of the signal transmitting end and the signal strength of the Bluetooth signal detected by the terminal.
The apparatus of claim 7 wherein said processing module comprises:

An acquiring unit, configured to acquire token information carried in the determination result when the determining result is that the terminal is in the target range;

The access unit is configured to access the predetermined network through the router according to the token information.
A processing device for accessing a network, comprising:

a second receiving module, configured to receive location information of the terminal;

a determining module, configured to determine, according to the location information, whether the terminal is within a target range of a predetermined network;

And a control module, configured to control the terminal to access the predetermined network according to the determination result.
The apparatus of claim 10 wherein said control module comprises:

a first sending unit, configured to send token information to the terminal when the determining result is that the terminal is located in the target range, where the token information is used by the terminal to access through a router Predetermined network;

And a second sending unit, configured to send, to the terminal, information that denies the terminal accessing the predetermined network when the determining result is that the terminal is located outside the target range.
The apparatus of claim 11 further comprising:

a receiving unit, configured to receive predetermined token information sent by the router, where the predetermined token information is sent by the router after receiving the predetermined token information sent by the terminal;

a verification unit, configured to verify whether the predetermined token information is consistent with token information sent to the terminal;

And a third sending unit, configured to: if the verification result of the verification unit is consistent, allow permission information that the terminal accesses the predetermined network to be sent to the router.