WO2018036415A1

WO2018036415A1 - Authentication proxy method, apparatus and device

Info

Publication number: WO2018036415A1
Application number: PCT/CN2017/097703
Authority: WO
Inventors: 郑占彬
Original assignee: 中兴通讯股份有限公司
Priority date: 2016-08-26
Filing date: 2017-08-16
Publication date: 2018-03-01
Also published as: CN107786502B; CN107786502A

Abstract

Disclosed in the present application are an authentication proxy method, apparatus and device. The method comprises: intercepting a redirection message sent by a first authentication device to a user terminal; modifying the redirection message and sending the modified redirection message to the user terminal, an address used for redirection in the redirection message being modified into an address of a proxy device; receiving authentication information sent by the user terminal according to the modified redirection message; and performing, according to the authentication information, authentication in a manner of acting as a proxy of the user terminal. In the present application, a redirection message is modified to be redirected to a proxy device, and the proxy device is used as a proxy of the user terminal and is responsible for authenticating the user terminal in a manner of acting as the proxy of the user terminal, and accordingly interactions between a first authentication device and a second authentication device are reduced, thereby effectively reducing authentication delay, shortening authentication time, improving the authentication efficiency, and improving user experience.

Description

Authentication agent method, device and device

Technical field

The present application relates to the field of authentication technology, for example, to an authentication agent method, apparatus and device.

Background technique

AAA authentication is used to provide security services. AAA authentication includes: Authentication, Authorization, and Accounting. Authentication is to verify the identity of the user and determine whether the user is a legitimate user. Authorization is the network service that the authorized user can use. The accounting is to record the resources of the user using the network service. This information will be used as the basis for charging.

At present, if the user is in a remote area, such as the user is in a remote area such as the sea, the desert, or the forest, the authentication interaction between the user terminal of the user and the remote authentication server may cause a large authentication delay, if the user is in the absence of the base station signal. In remote areas, the user terminal performs authentication interaction through the satellite communication system and the remote authentication server, and the authentication delay is even greater. If the user terminal needs to complete the AAA authentication through the satellite communication system before accessing the network, the satellite can be used as the relay station to forward the authentication interaction message, and the authentication interaction message between the user terminal and the AAA authentication server is transmitted through the satellite link, during the entire authentication process. The authentication interaction message is transparently transmitted through the satellite end station multiple times, but due to the inherent delay of the satellite link transmission, the authentication delay is large, the authentication time is long, and the user experience is poor.

Summary of the invention

The present disclosure provides an authentication proxy method, apparatus, and device for solving the problem of large authentication delay when performing related technologies for remote authentication.

The present disclosure provides an authentication proxy method, including: intercepting a redirect message sent by a first authentication device to a user terminal; modifying the redirect message and sending the message to the user terminal; wherein the redirect message is used The redirected address is modified to the address of the proxy device; the authentication information sent by the user terminal according to the modified redirect message is received; and the user terminal is authenticated according to the authentication information.

The intercepting the redirect message sent by the first authentication device to the user terminal further includes: Receiving a domain name sent by the user terminal; obtaining, in a preset domain name cache list, an Internet Protocol IP address corresponding to the domain name and returning to the user terminal; and receiving the received user terminal according to the IP address The initiated IP access request is forwarded to the first authentication device, where the first authentication device sends a redirect to the user terminal by using the proxy device when determining that the user terminal does not pass the authentication according to the IP access request. Message.

The receiving the authentication information that is sent by the user terminal according to the modified redirect message includes: receiving an authentication page acquisition request sent by the user terminal according to the modified redirect message; a page acquisition request, returning the pre-stored authentication page to the user terminal; and receiving the authentication information sent by the user terminal based on the authentication page.

Before the authenticating the user terminal according to the authentication information, the method further includes: establishing a communication connection between the proxy device and the second authentication device.

The performing the authentication by the user terminal according to the authentication information includes: sending the authentication information to the second authentication device, so that the second authentication device initiates authentication of the user terminal according to the authentication information; Receiving an authentication result returned by the second authentication device, and transmitting the authentication result to the user terminal.

The present disclosure also provides an authentication proxy device, including: an intercepting module configured to intercept a redirect message sent by the first authentication device to the user terminal; and a modifying module configured to modify the redirect message; The address for redirecting in the redirect message is modified to the address of the proxy device; the transceiver module is configured to send the modified redirect message to the user terminal, and receive the modified user terminal according to the modified The authentication information sent by the redirect message; the proxy module is configured to proxy the user terminal for authentication according to the authentication information.

The transceiver module is further configured to: receive a domain name sent by the user terminal; obtain, in a preset domain name cache list, an Internet Protocol IP address corresponding to the domain name, and return it to the user terminal; Receiving, by the user terminal, the IP access request initiated by the IP address to the first authentication device, where the first authentication device determines, when the user terminal fails to pass the authentication according to the IP access request, The proxy device sends a redirect message to the user terminal.

The transceiver module may be configured to: receive an authentication page acquisition request sent by the user terminal according to the modified redirect message; and return, according to the authentication page acquisition request, the pre-stored authentication page to the a user terminal; receiving the user terminal to send based on the authentication page Certification information.

The device further includes a connection module, and the connection module is configured to establish a communication connection between the proxy device and the second authentication device before the authenticating the user terminal according to the authentication information .

The proxy module may be configured to: send the authentication information to the second authentication device, so that the second authentication device initiates authentication of the user terminal according to the authentication information; and receives the second authentication device to return The authentication result is sent to the user terminal.

The present disclosure also provides an authentication proxy device, characterized in that the above authentication proxy device is provided in the authentication proxy device.

Embodiments of the present disclosure also provide a computer readable storage medium storing computer executable instructions arranged to perform the above method.

An embodiment of the present disclosure further provides an electronic device, including:

At least one processor;

a memory communicatively coupled to the at least one processor; wherein

The memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to cause the at least one processor to perform the method described above.

The disclosure modifies the redirect message to be redirected to the proxy device, and the proxy device acts as a proxy for the user terminal, and is responsible for authenticating the proxy user terminal, reducing interaction between the user terminal and the first authentication device and the second authentication device, and effectively Reduced authentication delay, shortened certification time, improved authentication efficiency, and improved user experience.

BRIEF abstract

1 is a flow chart of an authentication proxy method in accordance with an embodiment of the present disclosure;

2 is a flow chart of a method for authenticating an agent based on a satellite communication system, in accordance with an embodiment of the present disclosure;

3 is a timing diagram of an authentication proxy method based on a satellite communication system, in accordance with an embodiment of the present disclosure;

4 is a structural diagram of an authentication proxy device according to an embodiment of the present disclosure;

FIG. 5 is a schematic structural diagram of an electronic device according to an embodiment of the present disclosure.

detailed description

In the disclosure, the redirect message sent by the first authentication device to the user terminal is intercepted; the redirect message is modified and sent to the user terminal; wherein the address used for redirection in the redirect message is modified into an agent. The address of the device; receiving the authentication information sent by the user terminal according to the modified redirect message; and authenticating the user terminal according to the authentication information. The present disclosure reduces the interaction between the user terminal and the first authentication device and the second authentication device by changing the message redirected to the second authentication device to the local end, thereby effectively shortening the authentication duration and improving the authentication efficiency. Improve the user experience.

And the intercepting the redirection message sent by the first authentication device to the user terminal, further comprising: receiving a domain name sent by the user terminal; acquiring, in a preset domain name cache list, an internet protocol IP address corresponding to the domain name Returning to the user terminal; forwarding the received IP access request initiated by the user terminal according to the IP address to the first authentication device; wherein the first authentication device determines, according to the IP access request, When the user terminal fails to pass the authentication, the proxy device sends a redirect message to the user terminal. The disclosure avoids the step of sending a domain name to the first authentication device for domain name resolution by setting a domain name cache list in advance, which reduces the authentication delay and improves the authentication efficiency.

Receiving the authentication information that is sent by the user terminal according to the modified redirect message, including: receiving an authentication page acquisition request sent by the user terminal according to the modified redirect message; and acquiring the request according to the authentication page, Returning the pre-stored authentication page to the user terminal; receiving the authentication information sent by the user terminal based on the authentication page. By pre-storing the authentication page, the user terminal is prevented from obtaining the authentication page from the second authentication device, thereby improving the authentication efficiency and shortening the authentication time.

Before the authenticating the user terminal according to the authentication information, the method further includes: establishing a communication connection between the proxy device and the second authentication device. By establishing a communication connection in advance, the delay in transmitting the authentication interactive information is shortened, and the authentication time is shortened.

And the authenticating the user terminal according to the authentication information, including: authenticating the authentication The information is sent to the second authentication device, so that the second authentication device initiates authentication of the user terminal according to the authentication information; receives an authentication result returned by the second authentication device, and sends the authentication result to the user terminal.

When the proxy device is responsible for authenticating the user terminal for authentication, the proxy device redirects the message to the second authentication device to the local end and adopts a pre-cached DNS and authentication page mode, thereby reducing the user terminal and the first authentication device. And the interaction between the second authentication device, the proxy device also adopts a method of establishing a communication link in advance, which effectively shortens the authentication delay. Therefore, the present embodiment can effectively shorten the authentication duration, improve the authentication efficiency, and improve the user experience.

The present disclosure will be described in detail below with reference to the accompanying drawings and embodiments. The embodiments described herein are merely illustrative of the disclosure and are not limiting of the disclosure.

Embodiment 1

This embodiment provides an authentication proxy method, as shown in FIG. 1, which is a flowchart of an authentication proxy method according to a first embodiment of the present disclosure. The execution subject of this embodiment is a proxy device.

Step S110, intercepting the redirect message sent by the first authentication device to the user terminal.

The redirect message is a response message to the IP access request after the first authentication device determines that the user terminal does not pass the authentication according to the IP access request of the user terminal. The redirect message is used to redirect the IP access request to the second authentication device, causing the second authentication device to initiate an authentication request to the user terminal.

The first authentication device may provide services such as domain name resolution and broadband access. The first authentication device may be a broadband remote access server (Bras).

The second authentication device can provide a user authentication service. The second authentication device may be a portal Portal server. The first authentication device and the second authentication device may be two independent devices or may be combined into one device.

Receiving the domain name sent by the user terminal; obtaining an Internet Protocol Address (IP) corresponding to the domain name (Domain Name) and returning it to the user terminal; and receiving the received user terminal according to the domain name The IP address request initiated by the IP address is forwarded to the first authentication device. The first authentication device sends a redirect message to the user terminal through the proxy device when determining that the user terminal does not pass the authentication according to the IP access request.

The domain name cache list records the correspondence between the domain name and the IP address. Pre-store domains in the proxy device Name the cache list and update it in real time or periodically.

Pre-setting the domain name cache list can implement the domain name proxy on the proxy device side to prevent the user terminal from remotely accessing the first authentication device to perform domain name resolution on the first authentication device. This embodiment reduces the authentication delay and improves the authentication efficiency.

Step S120: Modify the redirect message and send it to the user terminal; wherein the address used for redirection in the redirect message is modified to the address of the proxy device.

Modify the address in the redirect message for redirection. In the received redirect message, the address used for the redirection is the address of the second authentication device, and the address of the second authentication device is modified to the address of the proxy device, thereby redirecting to the second authentication device. The message is modified to redirect to the proxy device.

Modifying the address of the second authentication device in the redirect message to the address of the proxy device, the proxy device may be the proxy of the user terminal, and the message sent by the user terminal to the first authentication device and the second authentication device is sent to the proxy device instead. Processing, the interaction between the user terminal and the first authentication device and the second authentication device can be reduced.

Step S130: Receive authentication information sent by the user terminal according to the modified redirect message.

The address of the second authentication device in the modified redirect message has been modified to the address of the proxy device, and the user terminal sends the authentication information that should be sent to the second authentication device to the proxy according to the modified redirect message. The device receives the authentication information sent by the user terminal by the proxy device.

Receiving an authentication page acquisition request sent by the user terminal according to the modified redirect message; returning the pre-stored authentication page to the user terminal according to the authentication page acquisition request; receiving the user terminal based on the The authentication information sent by the authentication page.

The authentication page acquisition request is used to obtain an authentication page to submit authentication information based on the authentication page. Since the address for redirection in the modified redirect message is the address of the proxy device, the user terminal sends the authentication page acquisition request to the proxy device.

The authentication information includes: a username, a password, and an IP address of the user terminal.

The user terminal can display an authentication page. In the authentication page, a user name and a password can be input. When the user name and password are sent to the proxy device, the IP address of the user terminal is carried, and the proxy device uses the user name, the password, and the IP address of the user terminal as the authentication information.

Pre-store the authentication page in the proxy device and update it in real time or periodically to avoid the user terminal from the second The authentication device obtains the authentication page, which improves the authentication efficiency and shortens the authentication time.

Step S140, performing authentication according to the authentication information proxy user terminal.

The AAA authentication is performed by the proxy user terminal according to the authentication information. Sending the authentication information to the second authentication device, so that the second authentication device initiates the authentication of the user terminal according to the authentication information; receives the authentication result returned by the second authentication device, and sends the authentication result to the user terminal.

In this embodiment, before the authentication is performed by the proxy user terminal according to the authentication information, a communication connection may be established between the proxy device and the second authentication device; based on the communication connection, the authentication information is sent to the second authentication device, so that The authentication device initiates the authentication of the user terminal according to the authentication information; receives the authentication result returned by the second authentication device, and sends the authentication result to the user terminal. By establishing a communication connection in advance, the delay of sending authentication interaction information is shortened, the authentication time is shortened, and the user experience is improved.

In this embodiment, the proxy device is responsible for authenticating the user terminal for authentication, and the proxy device redirects the message redirected to the second authentication device to the local end and adopts a pre-cached DNS and authentication page mode to reduce the user terminal and the first The interaction between an authentication device and the second authentication device, the proxy device also adopts a method of establishing a communication link in advance, which effectively shortens the authentication delay. Therefore, the present embodiment can effectively shorten the authentication duration, improve the authentication efficiency, and improve the user experience.

Embodiment 2

In a satellite communication system, a satellite end station acts as a ground station for a communication satellite and is configured to transparently pass authentication interaction messages between the user terminal and the Bras server and the Portal server. The user terminal accesses the network via the satellite end station, and the Bras server intercepts the Internet access request of the user terminal and determines whether the user terminal passes the AAA authentication. If yes, the user requests the Internet access, otherwise the user terminal sends a message redirected to the Portal server, so that the user The terminal obtains the authentication page from the portal server, and the user terminal sends the authentication information to the portal server based on the authentication page. The portal server, the Bras server, and the AAA authentication server cooperate to complete the AAA authentication of the user terminal, and the portal server returns the authentication result to the user terminal. .

In this process, the Internet request, redirect message, authentication page acquisition and return, authentication information and authentication result are transparently transmitted by the satellite end station. Due to the inherent delay of the satellite link transmission, the authentication delay is large, and the authentication is delayed. Long time, if the satellite end station is set as a proxy device, it will effectively reduce the authentication delay, shorten the authentication time, improve the authentication efficiency, and enhance the user experience.

This embodiment provides an authentication proxy method based on a satellite communication system.

In this embodiment, the proxy device is a satellite end station, so the execution entity of this embodiment is a satellite end station. The first authentication device is a Bras server, and the second authentication device is a Portal server.

The satellite link includes a communication satellite, a first ground station and a second ground station. The satellite end station in this embodiment is the first ground station closest to the user terminal, and the communication satellite and the second ground station play forwarding/transparent transmission. The role of the information, the interaction information between the satellite end station and the Bras server and the Portal server, through the forwarding/transmission of the communication satellite and the second ground station, in order to make the description of the present disclosure clearer, in this embodiment, The communication satellite and the second ground station that play the role of forwarding/transmission are not embodied.

2 is a flow chart of a satellite communication based authentication proxy method in accordance with an embodiment of the present disclosure.

Step S210, intercepting the redirect message sent by the Bras server to the user terminal.

After forwarding the IP access request sent by the user terminal to the Bras server, the redirect message sent by the Bras server to the user terminal is intercepted.

The redirect message is a response message of the Bras server to the IP access request after determining that the user terminal has not passed the authentication according to the IP access request.

The redirect message is used to redirect the IP access request to the Portal server, so that the Portal server initiates an authentication request to the user terminal. The redirect message sent by the Bras server to the user terminal can be forwarded to the user terminal after the satellite end station, so the satellite end station can intercept the redirect message.

Receiving a domain name sent by the user terminal; obtaining, in a preset domain name cache list, an IP address corresponding to the domain name (mapped) and returning to the user terminal; receiving an IP access request initiated by the user terminal according to the IP address; The user terminal forwards the IP access request initiated by the IP address to the Bras server. The Brass server sends a redirect message to the user terminal through the satellite end station, and the redirect message is used to redirect to the Portal server, when determining that the user terminal fails to pass the authentication according to the IP access request.

The domain name cache list records the correspondence between the domain name and the IP address. The list of domain name caches is pre-stored in the satellite end station and updated in real time or periodically.

Pre-setting the domain name cache list in the satellite end station can avoid the step of sending the domain name to the Bras server through the satellite link for domain name resolution, which reduces the authentication delay and improves the authentication efficiency. The user terminal can directly perform IP access, and the satellite end station can directly receive the IP access sent by the user terminal. request.

Step S220: Modify the redirect message and send it to the user terminal; wherein the redirect message is modified to be redirected to the satellite end station.

In the received redirect message, the address used for redirection is the address of the Portal server, and the address of the Portal server is modified to the address of the satellite end station, and the redirect message redirected to the Portal server is modified to be redirected. Go to the satellite terminal.

Modifying the redirect message can make the satellite end station become the proxy of the user terminal, and the message sent by the user terminal to the Bras server and the Portal server is sent to the satellite end station for processing, which can reduce the interaction between the user terminal and the Bras server and the Portal server. .

Step S230: Receive authentication information sent by the user terminal according to the modified redirect message.

Since the redirect message is modified, the user terminal sends the authentication information that should be sent to the Portal server to the satellite end station, and the satellite end station receives the authentication information sent by the user terminal.

Receiving an authentication page acquisition request sent by the user terminal according to the modified redirect message; returning the pre-stored authentication page to the user terminal according to the authentication page acquisition request; and receiving the authentication information sent by the user terminal based on the authentication page. The authentication page is, for example, a Portal login page. The user input username and password can be collected in the Portal login page.

The authentication page is pre-stored in the satellite end station and updated in real time or periodically to prevent the user terminal from obtaining the authentication page from the Portal server through the satellite link, thereby improving the authentication efficiency and shortening the authentication time.

Step S240, performing authentication according to the authentication information proxy user terminal.

After the satellite terminal has the authentication information of the user terminal, the authentication information can be used to proxy the user terminal for AAA authentication. The satellite end station can proxy the user terminal to send authentication information to the Portal server, and the proxy user terminal receives the authentication result returned by the portal.

In this embodiment, before authenticating the user terminal according to the authentication information, the method further includes: establishing a communication connection between the satellite end station and the Portal server to form a communication link for authentication; and receiving based on the communication connection The obtained authentication information is sent to the Portal server, so that the Portal server initiates authentication of the user terminal according to the authentication information.

After modifying the redirect message, the satellite end station establishes a communication connection with the Portal server before receiving the authentication information. Can receive the request from the authentication page or return to the user terminal At the same time as the authentication page is returned, the satellite end station establishes a communication connection with the Portal server. By establishing a communication connection in advance, the delay of sending interactive information is shortened, the authentication time is shortened, and the user experience is improved.

When the satellite end station establishes a communication connection with the Portal server, the satellite end station (first ground station) requests to establish a connection with the Portal server, among the formed physical communication links, the first ground station, the communication satellite, the second ground station, and The portal server is connected in sequence.

After the portal server initiates the authentication request to the user terminal, the Portal server, the Bras server, and the AAA server perform AAA authentication on the user terminal, and the Portal server is responsible for feeding back the authentication result to the satellite end station. The satellite end station receives the authentication result returned by the Portal server, and sends the authentication result to the user terminal.

In this embodiment, the satellite end station is responsible for the AAA authentication of the proxy user terminal, and the satellite end station redirects the message redirected to the Portal server to the local end and uses the pre-cached DNS and authentication page mode to reduce the user terminal and The interaction between the Bras server and the Portal server, the satellite end station also uses the way to establish a communication link in advance, which effectively shortens the authentication delay. Therefore, the present embodiment can effectively shorten the authentication duration, improve the authentication efficiency, and improve the user experience.

Embodiment 3

In order to make the disclosure clearer, the present disclosure will be described below based on FIG. Since the ground station (the second ground station) and the communication satellite which are far from the user terminal function to forward information in the satellite link, they are not shown in FIG.

3 is a timing diagram of a satellite communication based authentication proxy method in accordance with an embodiment of the present disclosure.

In step 1, the satellite end station receives the domain name access request sent by the user terminal.

A satellite end station is the ground station in the satellite link that is closest to the user terminal.

The domain name access request carries the domain name requested by the user terminal. Users can use the browser of the user terminal to access a website, such as entering www.sina.com in a browser to initiate access to the domain name www.sina.com.

In step 2, the satellite end station returns the IP address corresponding to the domain name to the user terminal.

The satellite end station returns the IP address corresponding to the domain name requested by the user terminal to the user terminal.

The domain name access request sent by the user terminal must first be sent to the satellite end station and sent to Bras via the satellite link. server. In this embodiment, the satellite end station intercepts the domain name access request, and filters the domain name requested by the user terminal. If the satellite end station has previously stored the IP address corresponding to the domain name, the IP address is directly returned to the user terminal; If the satellite end station does not pre-store the IP address corresponding to the domain name, the domain name access request is forwarded to the Bras server and the IP address returned by the Bras server is forwarded to the user terminal. Proceed as follows:

In step A, the satellite station queries the domain name in the domain name access request in the preset domain name cache list.

The corresponding (mapping) relationship between the domain name and the IP address is recorded in the domain name cache list.

The domain name cache list can be preset and updated regularly, or it can be recorded and updated in real time during the process of the user terminal accessing the network. For example, the mapping between the domain name and the IP address of the common website may be stored in the domain name cache list, and the domain name cache list may be updated in real time according to the user's access status.

Step B: The satellite end station determines whether the IP address corresponding to the domain name exists in the domain name cache list; if the domain name exists, step C is performed, and if the domain name does not exist, step D is performed.

In step C, the satellite end station returns the IP address corresponding to the domain name to the user terminal.

Step D: The satellite end station forwards the domain name access request to the Bras server, and the Brass server performs domain name resolution and determines the IP address corresponding to the domain name; after that, the satellite end station returns the IP address corresponding to the domain name returned by the Bras server to The user terminal updates the correspondence between the domain name and the IP address to the domain name cache list for next use.

In this process, if there is a mapping between the domain name and the IP address in the domain name cache list, the process of the user terminal interacting with the Bras server through the air interface can be omitted, and the Bras server does not need to parse the domain name, thereby shortening the authentication. delay.

Step 3: The user terminal sends an IP access request according to the IP address, and the satellite end station forwards the IP access request to the Bras server.

Step 4: If the Bras server determines that the user terminal fails the authentication according to the IP access request, intercepts the IP access request, and returns a redirect message to the user terminal through the satellite end station.

The Bras server records the IP address of the user terminal that passes the authentication in advance; after receiving the IP access request forwarded by the satellite end station, the Bras server extracts the source IP address in the IP access request, that is, the IP address of the user terminal, and determines the Whether the source IP address has passed the authentication. If the user terminal has passed the authentication, it is determined that the user terminal has passed the authentication, and the IP access request can be released to implement the user terminal to the network. The access, obtain the network resources required by the user terminal, and if not authenticated, determine that the user terminal fails the authentication, intercept the IP access request, and return a redirect message to the user terminal through the satellite end station.

The redirect message is a response message to the IP access request sent by the user terminal, and the redirect message is used to redirect the destination address in the IP access request to another address. In this embodiment, the redirect message sent by the Bras server to the user terminal is used to redirect to the Portal server.

Step 5: The satellite end station intercepts the redirect message sent by the Bras server to the user terminal, and if the satellite end station stores the authentication page, the redirect message is modified to be redirected to the satellite end station, and the modified weight is The directed message is returned to the user terminal.

The satellite end station can pre-cache the authentication page and update it regularly. The authentication page can be a portal login page. This eliminates the step of the user terminal obtaining the authentication page from the Portal server.

The satellite end station intercepts the response message redirected to the Portal server. When the authentication page is stored, the response message redirected to the Portal server is modified to be a response message redirected to the satellite end station, so that the user terminal according to the redirect The address sends the message.

The redirect message sent by the Bras server to the user terminal is used to redirect to the Portal server. After the satellite station intercepts the redirect message, it checks whether the authentication page is cached. If the authentication page is cached, the redirect message is modified. The redirected message is redirected to the satellite end station; if the authentication page is not cached, the intercepted redirect message is directly forwarded to the user terminal, and the user terminal passes the satellite end station according to the redirect message. Directed to the Portal server, the authentication page is obtained from the Portal server, and the satellite end station forwards the authentication page returned by the Portal server to the user terminal, and stores the authentication page for the next use.

The satellite end station can determine whether the redirect message is redirected to the Portal server according to whether the Uniform Resource Locator (URL) for redirecting in the redirect message points to the Portal server, if the URL points to the Portal server. , you can determine that the redirect message is used to redirect to the Portal. In the redirect message sent by the Bras server to the user terminal, the URL is the URL of the Portal server, and the URL of the Portal server is replaced with the URL of the satellite end station to complete the modification of the redirect message.

Step 6: The satellite end station receives an authentication page acquisition request sent by the user terminal according to the modified redirect message.

The modified redirect message is used to redirect to the satellite end station.

The user terminal sends a request for obtaining an authentication page to the URL according to the URL used for redirection in the modified redirect message, and the URL has been modified to the URL of the satellite end station, so the authentication page acquisition request is sent to Satellite terminal station.

In step 7, the satellite end station establishes a connection with the Portal server.

The connection established between the satellite end station and the Portal server is a HyperText Transfer Protocol (HTTP) connection. The connection can be maintained for a predetermined length of time. For example: the connection can be kept for 60s. If the satellite end station does not receive the authentication request within the predetermined length of time, the satellite end station re-establishes an HTTP connection with the Portal server. To save air interface bandwidth, a link can be established for each user terminal.

Establishing a link between the satellite end station and the Portal server in advance can provide a channel for subsequent authentication in advance, shortening the authentication delay time.

In step 8, the satellite end station returns an authentication page to the user terminal according to the authentication request.

When the satellite end station receives the authentication page acquisition request, the cached authentication page is returned to the user terminal. In the authentication page, you can enter a username and password.

The satellite end station pre-stores the authentication page, which saves the time for the user terminal to obtain the authentication page from the Portal server through the air interface.

In step 9, the user terminal sends the authentication information to the satellite end station.

The user terminal displays the authentication page, and the user inputs a user name and password in the authentication page. The user terminal collects the user name and password input by the user, and sends the collected authentication page to the satellite terminal.

Step 10: The satellite end station sends the authentication information sent by the user terminal to the Portal server.

After receiving the authentication information (user name, password, and IP address of the user terminal) sent by the user terminal, the satellite terminal can proxy the user terminal for authentication.

In step 11, the Portal server sends the authentication information to the Bras server.

The portal server sends the authentication information to the Bras server to notify the Bras server that the user terminal corresponding to the authentication information needs to access the network, and the user terminal needs to be authenticated.

After receiving the authentication information, the portal server records the source IP address of the authentication information. In order to return the authentication result to the source IP address after obtaining the authentication result. Since the satellite end station transmits the authentication information to the Portal server as a proxy for the user terminal, the source IP address is the IP address of the satellite end station.

Step 12: The Bras server initiates an authentication request to the AAA server based on the authentication information.

The authentication information of the user terminal is carried in the authentication request.

Step 13: The AAA server authenticates the user terminal according to the authentication request, and returns the authentication result to the Bras server.

The AAA server pre-records the authentication information (user name and password) of the legitimate user. The AAA server receives the authentication information sent by the Brass server to determine whether the authentication information is legal. If the authentication is valid, the user terminal passes the authentication. If not, the user terminal fails to pass the authentication. The authentication result may include an IP address of the user terminal and a result of whether the user terminal authentication is passed.

In step 14, the Bras server notifies the Portal server of the authentication result.

If the authentication result is that the user terminal is authenticated, the Bras server stores the IP address of the user terminal and the authentication result correspondingly, so that the next time the IP access request is received, the user terminal can determine whether the user terminal has passed the authentication according to the IP address; and, the Bras server The IP access request intercepted before the release is performed, the user terminal accesses the network, and the network resources required by the user terminal are obtained.

If the authentication result is that the user terminal authentication fails, the Bras server can discard the previously intercepted IP access request.

In step 15, the Portal server sends the authentication result to the satellite end station.

Because the destination address in the above redirection request is modified to be a satellite end station, the Portal server sends the authentication result to the satellite end station, and the satellite end station disconnects the connection with the Portal server after forwarding the authentication result to the user terminal.

In step 16, the satellite end station is responsible for forwarding the authentication result to the user terminal.

If the authentication result is that the user terminal authentication fails, the satellite end station may re-send the pre-stored authentication page to the user terminal to acquire the authentication information of the user terminal again, and re-proxy the user terminal for authentication.

In this embodiment, the message redirected to the Portal server is redirected to the satellite end station, and the message is adopted. The method of pre-caching the DNS and the authentication page and establishing the communication link in advance can effectively shorten the authentication delay and the authentication time, and improve the authentication efficiency and improve the user experience.

Embodiment 4

The embodiment of the present disclosure also provides an authentication proxy device. The device is arranged on the proxy device side, for example a satellite end station. As shown in FIG. 4, it is a structural diagram of an authentication proxy device according to an embodiment of the present disclosure.

The device includes:

The intercepting module 410 is configured to intercept the redirect message sent by the first authentication device to the user terminal.

The modification module 420 is configured to modify the redirect message; wherein the address for the redirect in the redirect message is modified to the address of the satellite end station.

The transceiver module 430 is configured to send the modified redirect message to the user terminal, and receive the authentication information sent by the user terminal according to the modified redirect message.

The proxy module 440 is configured to proxy the user terminal for authentication according to the authentication information. Among them, the certification is AAA certification.

In an embodiment, the transceiver module 430 is further configured to: receive a domain name sent by the user terminal; obtain, in a preset domain name cache list, an Internet Protocol IP address corresponding to the domain name and return to the user terminal Forwarding, by the user terminal, the IP access request initiated by the user terminal to the first authentication device, where the first authentication device determines that the user terminal fails to pass the authentication according to the IP access request. Transmitting, by the satellite end station, a redirect message to the user terminal.

In another embodiment, the transceiver module 430 may be configured to: receive an authentication page acquisition request sent by the user terminal according to the modified redirect message; and according to the authentication page acquisition request, the pre-stored authentication page Returning to the user terminal; receiving authentication information sent by the user terminal based on the authentication page.

In still another embodiment, the apparatus further includes a connection module (not shown); the connection module configured to: before the authenticating the user terminal according to the authentication information, in the A communication connection is established between the satellite end station and the second authentication device.

In still another embodiment, the proxy module 440 can be configured to: send the authentication information to the second authentication device, so that the second authentication device initiates authentication of the user terminal according to the authentication information; Determining an authentication result returned by the second authentication device, and transmitting the authentication result to the user terminal.

The functions of the device in this embodiment have been described in the method embodiments shown in FIG. 1 to FIG. 3. Therefore, in the description of the present embodiment, reference may be made to the related description in the foregoing embodiment. This will not be repeated.

Embodiment 5

The present disclosure also provides an authentication proxy device provided with the authentication proxy device of any of the above embodiments to proxy the service of the user terminal. The authentication proxy device can be a satellite end station or other physical entity.

Through the description of the above embodiments, those skilled in the art can clearly understand that the method according to the above embodiments can be implemented by means of software plus a general hardware platform, and of course, can also be implemented by hardware. Based on such understanding, the technical solution of the present disclosure, which is essential or contributes to the related art, may be embodied in the form of a software product stored in a storage medium (such as ROM/RAM, disk, CD-ROM). The instructions include a number of instructions for causing a terminal device (which may be a cell phone, a computer, a server, or a network device, etc.) to perform the methods described in various embodiments of the present disclosure.

Embodiments of the present disclosure also provide a storage medium. Optionally, in the embodiment, the foregoing storage medium may be configured to store program code for performing the following steps:

S11, intercepting a redirect message sent by the first authentication device to the user terminal;

S12. The redirect message is modified and sent to the user terminal. The address used for redirection in the redirect message is modified to an address of the proxy device.

S13. Receive authentication information sent by the user terminal according to the modified redirect message.

S14. The user terminal is authenticated according to the authentication information.

Optionally, in this embodiment, the storage medium may be a transitory computer readable storage medium or a non-transitory computer readable storage medium. The above storage medium may include: a U disk, a read-only memory (ROM), a random access memory (RAM, Random Access). Memory, removable hard disk, disk or optical disk, etc., which can store program code.

Optionally, in this embodiment, the processor executes the method steps described in the foregoing embodiments according to the stored program code in the storage medium.

The embodiment of the present disclosure further provides a schematic structural diagram of an electronic device applied to the processor. Referring to FIG. 5, the electronic device includes:

At least one processor 50, which is exemplified by a processor 50 in FIG. 5; and a memory 51, may further include a communication interface 52 and a bus 53. The processor 50, the communication interface 52, and the memory 51 can complete communication with each other through the bus 53. Communication interface 52 can be used for information transmission. Processor 50 can invoke logic instructions in memory 51 to perform the methods of the above-described embodiments.

Furthermore, the logic instructions in the memory 51 described above may be implemented in the form of software functional units and sold or used as separate products, and may be stored in a computer readable storage medium.

The memory 51 is used as a computer readable storage medium for storing software programs, computer executable programs, and program instructions/modules corresponding to the methods in the embodiments of the present disclosure. The processor 50 executes the function application and the data processing by executing software programs, instructions, and modules stored in the memory 51, that is, implementing the authentication agent method in the above method embodiments.

The memory 51 may include a storage program area and an storage data area, wherein the storage program area may store an operating system, an application required for at least one function; the storage data area may store data created according to use of the terminal device, and the like. Further, the memory 51 may include a high speed random access memory, and may also include a nonvolatile memory.

The technical solution of the embodiments of the present disclosure may be embodied in the form of a software product stored in a storage medium, including one or more instructions for causing a computer device (which may be a personal computer, a server, or a network) The device or the like) performs all or part of the steps of the method described in the embodiments of the present disclosure. The foregoing storage medium may be a non-transitory storage medium, including: a USB flash drive, and a mobile device. A medium that can store program code, such as a hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, or a transient storage medium.

For example, the examples in this embodiment may refer to the examples described in the foregoing embodiments and the optional embodiments, and details are not described herein again.

The various modules or steps of the present disclosure described above may be implemented by a general-purpose computing device, which may be centralized on a single computing device or distributed over a network of multiple computing devices. Alternatively, they may be calculated The program code executable by the apparatus is implemented such that they may be stored in a storage device by the computing device, and in some cases, the steps shown or described may be performed in an order different than that herein, or They are fabricated separately into individual integrated circuit modules, or a plurality of modules or steps thereof are fabricated into a single integrated circuit module. As such, the disclosure is not limited to any specific combination of hardware and software.

While the embodiments of the present disclosure have been disclosed, those skilled in the art will appreciate that various modifications, additions and substitutions are possible, and the scope of the present disclosure should not be limited to the embodiments described above.

Industrial applicability

The authentication agent method, device and device disclosed in the present application reduce the interaction between the user terminal and the first authentication device and the second authentication device, effectively reduce the authentication delay, shorten the authentication time, improve the authentication efficiency, and improve the user. Experience.

Claims

An authentication agent method, including:

Intercepting a redirect message sent by the first authentication device to the user terminal;

Modifying the redirect message and sending the message to the user terminal; wherein, the address used for redirection in the redirect message is modified to an address of the proxy device;

Receiving the authentication information sent by the user terminal according to the modified redirect message;

The user terminal is authenticated according to the authentication information.
The method of claim 1 further comprising:

Receiving a domain name sent by the user terminal;

Obtaining, in a preset domain name cache list, an internet protocol IP address corresponding to the domain name, and returning to the user terminal;

Forwarding, by the user terminal, the IP access request initiated by the user terminal to the first authentication device, where the first authentication device determines that the user terminal fails to pass the authentication according to the IP access request, A redirect message is sent to the user terminal by the proxy device.
The method of claim 1, wherein the receiving the authentication information sent by the user terminal according to the modified redirect message comprises:

Receiving an authentication page acquisition request sent by the user terminal according to the modified redirect message;

Returning the pre-stored authentication page to the user terminal according to the authentication page obtaining request;

Receiving the authentication information sent by the user terminal based on the authentication page.
The method of claim 1, wherein before the authenticating the user terminal according to the authentication information, the method further comprises:

A communication connection is established between the proxy device and the second authentication device.
The method according to any one of claims 1 to 4, wherein the authenticating the user terminal according to the authentication information comprises:

Sending the authentication information to the second authentication device, so that the second authentication device initiates authentication of the user terminal according to the authentication information;

Receiving an authentication result returned by the second authentication device, and transmitting the authentication result to the user terminal.
An authentication agent device comprising:

An intercepting module configured to intercept a redirect message sent by the first authentication device to the user terminal;

a modification module, configured to modify the redirect message; wherein, the address used for redirection in the redirect message is modified to an address of a proxy device;

The transceiver module is configured to send the modified redirect message to the user terminal, and receive the authentication information sent by the user terminal according to the modified redirect message.

The proxy module is configured to proxy the user terminal for authentication according to the authentication information.
The apparatus of claim 6 wherein said transceiver module is further configured to:

Receiving a domain name sent by the user terminal;

Obtaining, in a preset domain name cache list, an internet protocol IP address corresponding to the domain name, and returning to the user terminal;

Forwarding, by the user terminal, the IP access request initiated by the user terminal to the first authentication device, where the first authentication device determines that the user terminal fails to pass the authentication according to the IP access request, A redirect message is sent to the user terminal by the proxy device.
The apparatus of claim 6 wherein said transceiver module is configured to:

Receiving an authentication page acquisition request sent by the user terminal according to the modified redirect message;

Returning the pre-stored authentication page to the user terminal according to the authentication page obtaining request;

Receiving the authentication information sent by the user terminal based on the authentication page.
The apparatus of claim 6 further comprising a connection module;

The connection module is configured to establish a communication connection between the proxy device and the second authentication device before the authenticating the user terminal according to the authentication information.
The apparatus of any of claims 6-9, wherein the proxy module is configured to:

Sending the authentication information to the second authentication device, so that the second authentication device initiates authentication of the user terminal according to the authentication information;

Receiving an authentication result returned by the second authentication device, and transmitting the authentication result to the user terminal.
An authentication agent device provided with the device of any of claims 6-10.
A computer readable storage medium storing computer executable instructions arranged to perform the method of any of claims 1-5.