WO2018045798A1

WO2018045798A1 - Network authentication method and related device

Info

Publication number: WO2018045798A1
Application number: PCT/CN2017/090606
Authority: WO
Inventors: 袁静
Original assignee: 华为技术有限公司
Priority date: 2016-09-12
Filing date: 2017-06-28
Publication date: 2018-03-15
Also published as: CN107819728B; CN107819728A

Abstract

In embodiments of the present invention, an authentication server receives an authentication request message sent by a Portal server, authenticates a terminal according to authentication information carried in the authentication request message, and after the authentication is successful, sends the authentication result to an access controller, so that the access controller allows the terminal to access a network according to the authentication result. Compared to the prior art, an authentication server directly receives authentication information sent by a Portal server, that is, authentication information is not required to be transferred by an access controller, thereby avoiding Portal protocol adaptation problems caused during the process when authentication information is required to be sent to the access controller by the Portal server, so that there is no need to add an adaptation step to the Portal server with regard to the access controller, the network authentication efficiency is improved, and development and maintenance costs of the Portal server are reduced.

Description

Network authentication method, related device

The present application claims priority to Chinese Patent Application No. Serial No. No. No. No. No. No. No. No. No. No. No. No. No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No

Technical field

The present invention relates to the field of communications technologies, and in particular, to a network authentication method, related apparatus, and system.

Background technique

With the popularization of smart terminals, users can access the wireless local area network (WLAN) provided by the network operator through the intelligent terminal with wireless fidelity (WIFI) function.

During the process of the terminal accessing the network, the network side device needs to authenticate the terminal. After the authentication is passed, the terminal accesses the network. In the existing network authentication method, the terminal is usually authenticated based on the username and password.

The user accesses the portal page provided by the operator through the terminal, enters the terminal user name and password, and submits the terminal user name and password of the portal web page to the access controller (AC) for access. The controller does not authenticate the terminal username and password, but sends it to the authentication server, such as the Authentication, Authorization and Accounting (AAA) server, for authentication. After the authentication server passes the authentication, the AC passes the AC to the portal. The server returns the result of successful authentication. The Portal server displays the result to the user on the portal page, prompting the user to successfully authenticate.

However, the network authentication method provided by the prior art requires the Portal server to send the terminal user name and password to the AC through the Portal protocol, and the AC sends the authentication result of the authentication server to the Portal server through the Portal protocol. However, because the Portal protocol is a private protocol and there are a large number of ACs provided by different vendors in the carrier network, the Portal server needs to be adapted to the ACs of different vendors. The network authentication efficiency is low, and the development and maintenance costs of the Portal server are high.

Summary of the invention

Embodiments of the present invention provide a network authentication method, related apparatus and system that do not require a portal server to adapt an access controller AC of different vendors.

In an aspect, an embodiment of the present invention provides a network authentication method, which is applied to an authentication server, and includes the following steps:

Receiving an authentication request message sent by the portal server, where the authentication request message carries the identifier of the terminal, the authentication information, and the address information of the access controller;

The authentication server authenticates the terminal according to the authentication information;

When the authentication is passed, the authentication server sends an authentication result to the access controller corresponding to the address information, where the authentication result carries the identifier of the terminal that is authenticated.

In the embodiment of the present invention, the authentication server receives the authentication request message sent by the portal server, and authenticates the terminal according to the authentication information carried in the authentication request message, and sends the authentication result to the access controller after the authentication is passed. The access controller accesses the terminal to the network according to the authentication result. Compared with the prior art, the authentication server directly receives the authentication information sent by the portal server, that is, the authentication information does not need to be transferred from the access controller, and the authentication information needs to be avoided. The adaptation problem of the Portal protocol sent by the portal server to the access controller does not require the portal server to adapt to the access controller, which improves the efficiency of network authentication and reduces the development and maintenance cost of the portal server.

In a possible solution, the authentication server further includes: before receiving the authentication request message sent by the portal server:

Receiving an access request message sent by the access controller, where the access request message carries default authentication information of the terminal;

Obtaining a control policy and a redirecting address corresponding to the default authentication information, and sending an access response message to the access controller, where the access response message carries the control policy and a redirect address, thereby access control The device controls the terminal according to the control policy, and redirects the access request of the terminal according to the redirected address.

In a possible solution, the authentication result sent by the authentication server carries the updated control policy and the terminal identifier, and the access controller controls the terminal to access the internet according to the updated control policy.

In a possible solution, the authentication information of the terminal includes a terminal user name and a password, and the authentication server authenticating the terminal according to the authentication information includes the following steps:

The authentication server verifies whether the terminal user name and password in the authentication information are consistent with the locally saved user name and password;

If the terminal user name and password in the authentication information are consistent with the locally saved user name and password, the authentication of the terminal is passed. If the terminal user name or password is inconsistent with the locally saved user name and password, the authentication is not performed. Pass, that is, the terminal is not allowed to access the network.

In a second aspect, the embodiment of the present invention further provides a network authentication method, which is applied to an access controller, and includes the following steps:

Receiving a webpage access request sent by the terminal, and returning address information of the access controller to the terminal;

The access controller receives the authentication result sent by the authentication server according to the address information of the access controller, where the authentication result carries the identifier of the terminal that passes the authentication;

The access controller accesses the terminal to the network according to the authentication result.

In the network authentication method provided by the embodiment of the present invention, after receiving the webpage access request of the terminal, the access controller returns the address information of the access controller to the terminal, and then the subsequent authentication server authenticates the user according to the authentication information. The authentication result is sent to the access controller corresponding to the address information, and the access controller accesses the terminal according to the authentication result. Compared with the prior art, the access controller directly receives the authentication result sent by the authentication server, does not need to receive the authentication information sent by the portal server, and thus does not need to be adapted with the portal server, thereby avoiding the access controller and the portal server pair. The adaptation problem of the portal protocol does not require the access controller to adapt to the Portal protocol, which improves the efficiency of network authentication and reduces the development and maintenance costs of the portal server and the access controller.

In a possible solution, before the access controller receives the webpage access request sent by the receiving terminal, the method further includes:

Sending an access request message to the authentication server, where the access request message carries the default authentication information of the terminal, and then the access controller receives an access response message sent by the authentication server, where the access response message is sent. It carries the default control policy, which is based on the default control terminal. The default control policy is the default control policy corresponding to the authentication information.

In a possible solution, after receiving the access response message sent by the authentication server, the access controller may also establish a charging session with the authentication server, where the user name of the session is a default user, and the charging is performed. The session can pass billing data between the authentication server and the access controller.

In a possible solution, the authentication result received by the access controller further carries the terminal user name, and after the access controller receives the authentication result, the user name of the charging session is modified to be the terminal. User name, thus using the terminal The username is used to charge the user for accessing the internet.

In a possible solution, the access response message received by the access controller carries a redirect address, and the access controller, after receiving the webpage access request sent by the terminal, according to the redirected address The webpage access request is redirected, and the terminal accesses the webpage to the portal server corresponding to the redirected address.

In a third aspect, an embodiment of the present invention provides an authentication server, which specifically includes the following functional modules:

The authentication receiving module is configured to receive an authentication request message sent by the portal server, where the authentication request message carries the identifier of the terminal, the authentication information, and the address information of the access controller.

An authentication module, configured to authenticate the terminal according to the authentication information;

The authentication notification module is configured to send an authentication result to the access controller corresponding to the address information when the authentication is passed, where the authentication result carries the identifier of the terminal that is authenticated. The authentication result may also carry updated control policies, identifiers of the terminals, and the like.

In a possible solution, the authentication server further includes:

The authentication receiving module is further configured to: before receiving the authentication request message sent by the portal server, receive an access request message sent by the access controller, where the access request message carries the default authentication information of the terminal;

An access processing module, configured to obtain a control policy and a redirect address corresponding to the default authentication information, and send an access response message to the access controller, where the access response message carries the control policy and Targeted address.

In a possible solution, after the authentication server sends the access response message, the authentication server establishes a charging session with the access controller, and the charging data is transmitted between the charging session and the access controller.

The authentication server provided by the third aspect is corresponding to the network authentication method provided by the first aspect. For the process and the beneficial effect of the network authentication method, refer to the network authentication method provided by the foregoing first aspect.

In a fourth aspect, an embodiment of the present invention provides an access controller, including:

The response receiving module is configured to receive a webpage access request sent by the terminal, and return the address information of the access controller to the terminal;

The response receiving module is further configured to receive an authentication result that is sent by the authentication server according to the address information of the access controller, where the authentication result carries an identifier of the terminal that is authenticated;

The terminal access module is configured to access the terminal to the network according to the authentication result.

In a possible solution, the access controller further includes:

a request sending module, configured to send an access request message to the authentication server before the webpage access request sent by the receiving terminal, where the access request message carries the default authentication information of the terminal;

The response receiving module is further configured to receive an access response message sent by the authentication server, where the access response message carries a default control policy.

In a possible solution, the access controller further includes:

The session maintenance module is configured to establish a charging session with the authentication server after receiving the access response message sent by the authentication server, where the user name of the session is a default user.

In a possible solution, the authentication result further carries a terminal user name, and the session maintenance module in the access controller is further configured to modify a user name of the charging session as the terminal user name.

In a possible solution, the access response message further includes a redirecting address, where the access controller further includes a redirection module, configured to: after receiving the webpage access request sent by the terminal, according to the The redirect address redirects the web access request.

The access controller provided by the fourth aspect is corresponding to the network authentication method provided by the second aspect, and the specific implementation For the process and beneficial effects of the network authentication method, reference may be made to the network authentication method provided by the second aspect above.

In a fifth aspect, an embodiment of the present invention provides a network access system, which includes the authentication server according to the third aspect, and the access controller according to the fourth aspect.

In the embodiments mentioned in all the above aspects, the authentication result may be specifically sent to the access controller by using a Change-Of-Authorization (COA) message. In addition, the authentication server may specifically be an AAA server. The network accessed by the terminal may specifically be a wireless local area network.

DRAWINGS

In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings used in the description of the embodiments will be briefly described below. It is obvious that the drawings in the following description are only some embodiments of the present invention. Other drawings may also be obtained from those of ordinary skill in the art in light of the inventive work. among them:

1 is a schematic diagram of networking of a network authentication system according to Embodiment 1 of the present invention;

2 is a flowchart of a network authentication method according to Embodiment 2 of the present invention;

3 is a flowchart of a network authentication method according to Embodiment 3 of the present invention;

4 is a flowchart of a network authentication method according to Embodiment 4 of the present invention;

5 is a flowchart of a network authentication method according to Embodiment 5 of the present invention;

6 is a hardware structural diagram of an authentication server and an access controller according to Embodiment 6 of the present invention;

7 is a schematic structural diagram of an authentication server according to Embodiment 7 of the present invention;

FIG. 8 is a schematic structural diagram of an access controller according to Embodiment 8 of the present invention.

detailed description

The technical solutions in the embodiments of the present invention are clearly and completely described in the following with reference to the accompanying drawings in the embodiments of the present invention. It is obvious that the described embodiments are only a part of the embodiments of the present invention, but not all embodiments. All other embodiments obtained by a person of ordinary skill in the art based on the embodiments of the present invention without departing from the inventive scope are the scope of the present invention.

The present invention provides a network authentication method, a related device, and a system. Referring to FIG. 1, FIG. 1 is a schematic diagram of networking of a network authentication system according to Embodiment 1 of the present invention.

As shown in FIG. 1, the network authentication system according to the present invention includes an authentication server, an access controller AC, a portal server, and an access point (AP). The above devices belong to devices in the carrier network.

The AP is a physical access point of the WLAN and is used to provide a WIFI network signal. The AC is a device that controls the terminal to access the network. The authentication server is specifically an AAA server, which is mainly used for authentication, authentication, and accounting of users. The user equipment (User Equipment, UE) in this embodiment includes a mobile phone, a personal computer (PC), a tablet computer, and the like. User equipment can also be referred to as a terminal.

The terminal accesses the network through the WIFI network signal provided by the AP. During the access process, the terminal accesses the portal webpage provided by the portal server and enters the authentication information of the terminal. The user submits the authentication information to the portal server through the portal webpage. The portal server sends an authentication request message to the authentication server, where the authentication request message carries the identifier of the terminal, the authentication information, and the address information of the access controller.

As shown in FIG. 2, the network authentication method provided in Embodiment 2 of the present invention specifically includes the following steps:

Step 101: The authentication server receives an authentication request message sent by the portal server, where the authentication request message carries The identification with the terminal, the authentication information, and the address information of the access controller.

In this embodiment, the AC assigns an IP address to the terminal, and the identifier of the terminal may be an IP address or a physical address of the terminal. The authentication information may be an end user name, that is, a user name of a user who uses the terminal. To enhance security, passwords can also be included in the authentication information.

The authentication server receives the authentication request message sent by the portal server, and the request message can be transmitted through a Simple Object Access Protocol (SOAP) between the Portal server and the authentication server.

Step 102: The authentication server authenticates the terminal according to the authentication information.

Specifically, the authentication server can verify whether the terminal user name and password in the authentication information match the previously saved user name and password. If yes, the authentication passes, otherwise the authentication fails. The password input by the user may be from a short message sent by the operator network or a password reserved by the user in the operator network. If the password input by the user is from a short message sent by the carrier network, the authentication server can also verify the validity period of the password, that is, whether the length of time between the time when the password is issued and the time when the user inputs the password exceeds the validity period, for example, 5 minutes. If the timeout expires, the authentication fails. If the timeout is not exceeded, it is further verified whether the username and password in the authentication information match the previously saved username and password.

In addition, the authentication server can also simply verify the terminal user name, that is, the user name in the authentication information is the same as the locally saved user name, that is, the authentication is passed, otherwise the authentication fails.

Step 103: The authentication server sends an authentication result to the access controller corresponding to the address information, where the authentication result carries the identifier of the terminal that is authenticated.

Specifically, the authentication server may send the authentication result to the corresponding AC through a radius (RADIUS) protocol. In this embodiment, the authentication result is that the authentication is passed, and the AC accesses the terminal according to the authentication result, and the user can use the terminal to access the Internet.

In the embodiment of the present invention, the authentication server receives the authentication request message sent by the portal server, and authenticates the terminal according to the authentication information carried in the authentication request message, and sends the authentication result to the access controller after the authentication is passed. The access controller accesses the terminal to the network according to the authentication result. Compared with the prior art, the authentication server directly receives the authentication information sent by the portal server, that is, the authentication information does not need to be transferred from the access controller, and the authentication information needs to be sent by the portal server to the portal caused by the access controller. The protocol adaptation problem does not require the Portal server to adapt to the access controller, which improves the efficiency of network authentication and reduces the development and maintenance costs of the Portal server.

Referring to FIG. 3, FIG. 3 is a flowchart of a network authentication method according to Embodiment 3 of the present invention.

In this embodiment, after detecting the wireless network provided by the operator, the terminal starts to access the wireless network, and after receiving the network attach request of the terminal, the access controller sends an access request message to the authentication server, where the access controller sends the access request message to the authentication server. The access request message carries the default authentication information of the terminal. The network authentication method provided by the embodiment of the present invention includes the following steps:

Step 201: The authentication server receives an access request message sent by the access controller, where the access request message carries the default authentication information of the terminal.

The access request message may further carry an identifier of the terminal, such as a physical address of the terminal. The default authentication information of the terminal can be the default username, for example, 000. The default username can be used by multiple different terminals. The default password can also include the default password.

Step 202: The authentication server obtains a redirection address and a control policy corresponding to the default authentication information, and sends an access response message to the access controller, where the access response message carries the control policy and a redirect address.

After receiving the default authentication information of the terminal sent by the access controller, the authentication server identifies that the terminal uses the default user name for authentication according to the authentication information, and obtains a control policy corresponding to the default user name, and sends the control policy to the terminal. Returning an access response message, the access response message carries the control policy and a redirect address, where the redirect address is an address of the Portal website.

The access controller receives the access response message sent by the authentication server, where the access response message carries a default control policy and a redirect address, so as to facilitate access to the webpage according to the redirected address after subsequently receiving the webpage access request of the terminal. Request to redirect, that is, redirect to the Portal server.

Step 203: A charging session is established between the authentication server and the access controller, and the user name of the session is a default user.

The authentication server may also establish a charging session with the access controller locally and exchange billing related data after interacting with the access controller. The current user name of the charging session is the default user because the terminal does not report the terminal user name.

After receiving the access response message, the AC may also establish a charging session with the authentication server locally, and transmit the charging related data. The current user name of the charging session is the default user because the terminal does not report the terminal user name (the real user name) at this time.

The terminal initiates a webpage access request to the access controller, and the webpage access request is redirected to the portal server by the access controller, and the portal server returns a login page to the terminal, the user inputs the terminal username and password on the page, and the portal server receives the terminal user. The authentication information such as the name and password, the Portal server then sends the authentication information to the authentication server through the authentication request message.

Step 204: The authentication server receives an authentication request message sent by the portal server, where the authentication request message carries the identifier of the terminal, the authentication information, and the address information of the access controller.

Step 205: The authentication server authenticates the terminal according to the authentication information.

Step 206: The authentication server sends an authentication result to the access controller corresponding to the address information, where the authentication result carries the identifier of the terminal that is authenticated.

The implementation process of the steps 204-206 is the same as the steps 101-103 in the second embodiment. For details, refer to the description of the foregoing embodiment.

In the embodiment of the present invention, the authentication result sent by the authentication server may further include an updated control policy. After receiving the authentication result, the access controller also updates the default control policy according to the updated control policy. Bandwidth control information may be included in the updated control policy.

Further, the authentication result may further carry the terminal user name in the authentication information, and the access controller further modifies the default user name of the charging session as the terminal user name, so as to facilitate subsequent charging for the user.

For a more detailed understanding of the embodiments of the present invention, the following describes the method flow of the access controller in implementing the network authentication process. As shown in the figure, FIG. 4 is a flowchart of a network authentication method according to Embodiment 4 of the present invention.

In this embodiment, after detecting the wireless network provided by the operator, the terminal starts to access the wireless network, and the access controller allocates an IP address to the terminal, and after receiving the allocated IP address, the terminal initiates a webpage. Access request. The network authentication method provided by the embodiment of the present invention includes the following steps:

Step 301: The access controller receives a webpage access request sent by the terminal, and returns address information of the access controller to the terminal.

In this embodiment, the address of the Portal server may be pre-configured in the access controller, and then the terminal is received. After the web page access request, the access request is redirected to the portal server. The access controller also returns its own address information to the terminal, so that the subsequent terminal carries the address information of the access controller when initiating a login request to the Portal server.

In addition, the authentication server may also feed back the authentication result of the terminal to the access controller according to the address information of the access controller.

Step 302: The access controller receives an authentication result sent by the authentication server according to the address information of the access controller, where the authentication result carries the identifier of the terminal that is authenticated.

In this embodiment, the authentication server authenticates the terminal according to the authentication information of the terminal, and after the authentication is passed, the authentication result is sent to the access controller through the RADIUS protocol. The authentication result carries the identifier of the terminal that is authenticated. Optionally, the authentication result also carries the control policy of the terminal, such as bandwidth, maximum online duration, and the like.

Step 303: The access controller accesses the terminal to the network according to the authentication result.

The access controller accesses the terminal to the network according to the authentication result, for example, allowing the terminal to access the Internet, and performing policy control on the terminal accessing the Internet.

In the network authentication method provided by the embodiment of the present invention, after receiving the webpage access request of the terminal, the access controller returns the address information of the access controller to the terminal, and then the subsequent authentication server authenticates the user according to the authentication information. The authentication result is sent to the access controller corresponding to the address information, and the access controller accesses the terminal according to the authentication result. Compared with the prior art, the access controller directly receives the authentication result sent by the authentication server, and does not need to receive the authentication information sent by the Portal server, and thus does not need to be adapted with the Portal server, thereby avoiding the access controller and the Portal server. The adaptation of the Portal protocol does not require the access controller to adapt to the Portal protocol, which improves the efficiency of network authentication and reduces the development and maintenance costs of the Portal server and access controller.

Optionally, in the network authentication method provided by the embodiment of the present invention, before receiving the webpage access request sent by the terminal, the access controller may further send an access request message to the authentication server when receiving the network attach request of the terminal, The access request message carries the default authentication information of the terminal. The reason for sending the default authentication information here is that the terminal has not yet authenticated through the network, thus providing default authentication information. After the authentication server authenticates the terminal according to the default authentication information, the access controller receives an access response message sent by the authentication server, where the access response message carries a default control policy and a redirect address, so as to facilitate access. The controller controls the terminal according to the default control policy.

In addition, after receiving the webpage access request sent by the terminal, the access controller redirects the webpage access request according to the redirected address, and redirects the access request to the portal server.

After receiving the access response message sent by the authentication server, the access controller may also establish a charging session with the authentication server, where the user name of the session is a default user. The access controller may associate the identifier of the terminal, such as an IP address, with the session, so that the session is subsequently found according to the identifier of the terminal. When the access controller carries the terminal user name in the subsequent authentication result, the user name of the charging session is further modified to be the terminal user name, so that the terminal user name is used to perform charging control on the online process of the terminal. .

Referring to FIG. 5, FIG. 5 is a flowchart of a network authentication method according to Embodiment 5 of the present invention.

In this embodiment, the user accesses the WLAN provided by the operator through the terminal (for example, the smart device), and the smart device initiates the WLAN connection after detecting the network signal of the WLAN, and the network authentication method provided by the embodiment of the present invention includes the following process. :

Step 401: The terminal initiates a DHCP discovery request to the AC.

The terminal sends a Dynamic Host Configuration Protocol (DHCP). The request is now used to request an IP address from the access controller. The physical address of the terminal can be carried in the request.

Step 402: The AC sends an access request message to the AAA server, where the terminal carries the default authentication information of the terminal.

Specifically, the AC needs to request the AAA server for authentication of the terminal, and therefore needs to send an access request message to the AAA server. The default authentication information carried in it includes a default username and a default password. The access request message can be sent based on the RADIUS protocol.

Step 403: The AAA server returns an access response message to the AC, where the default control policy and the address of the Portal server are carried.

The AAA server can also obtain the default control policy (the control policy corresponding to the default user name) and the address of the Portal server, and send the response to the AC through the access response message. Specifically, the address of the Portal server may be a Uniform Resource Locator (URL) of the Portal server.

Step 404: The AC allocates an IP address to the terminal.

After the AC allocates the IP address userip to the terminal, the AC sends the IP address to the terminal through a DHCP response.

Step 405: Establish a charging session between the AC and the AAA server.

The established charging session is used to transfer charging related data between the AC and the AAA server. The user name of the accounting session is the default user name, and the AAA server and the AC associate the session with the IP address of the terminal, so that the associated session can be found according to the IP address of the terminal.

Step 406: The terminal initiates a webpage access request to the AC.

The user opens a browser on the terminal, enters any web page, and initiates a Hyper Text Transfer Protocol (HTTP) request to the AC.

Step 407: The AC redirects the access request and sends its own address information to the terminal.

The AC redirects the http request of the terminal to the URL of the Portal server, and adds the AC's own IP address nasipaddr information after the URL.

Steps 408-409: The terminal accesses the Portal server according to the redirected address and submits the terminal username and password.

The user accesses the home page URL of the Portal server. The page has a user name and password input box. The user enters the terminal user name and password information on the portal, and clicks the login button to submit the terminal user name and password.

Step 410: The Portal server initiates an authentication request message to the AAA server.

The authentication request message sent by the Portal server to the AAA server carries the terminal user name and password, the terminal IP address userip, and the IP address of the access controller nasipaddr.

Step 411: The AAA server authenticates the terminal according to the terminal user name and password.

The AAA server performs authentication according to the terminal user name and password information sent by the Portal server and the information in the database. If the terminal user name and password information sent by the Portal server are the same as the user name and password stored in the database, the authentication is passed, otherwise the authentication fails. In this embodiment, the user enters the correct terminal username and password, and the authentication passes.

Step 412: The AAA server sends an authentication response message to the Portal server.

In this embodiment, the authentication succeeds by sending an authentication response message to the Portal server, and the Portal server sends a notification message of the authentication pass to the terminal to notify the user that the authentication is passed.

Step 413: The AAA server sends an authentication result to the access controller.

In this embodiment, the authentication result may be sent to the AC corresponding to the nasipaddr address information by using a Change-Of-Authorization (COA) message.

The COA message may further include a terminal IP address userip and a terminal user name, and an updated control policy, such as bandwidth, maximum online duration, maximum available traffic, and the like.

Specifically, the parameters included in the COA message are as follows:

The Acct-Session-ID is used to identify the session corresponding to the COA message. The User-Name is used to identify the user name. If the user name in the User-Name is different from the user name corresponding to the session, the user name corresponding to the session is modified. Is the corresponding username in User-Name. The Framed-IP-Address identifies the IP address of the terminal corresponding to the session, and the Calling-Station-Id identifies the physical address of the terminal corresponding to the session. Both the IP address and the physical address of the terminal can be used to associate the session.

Step 414: The AC associates the session with the terminal IP address in the COA message sent by the AAA server (the charging session established in step 405), and modifies the default user name in the session as the terminal user name, and modifies the session according to the updated control policy. Control Strategy.

After the session is modified, the AC sends a COA Acknowledge (ACK) message to the AAA server. Subsequent billing for the AAA server will be billed using the real username.

Compared with the prior art, the embodiment of the present invention bypasses the interconnection between the Portal server and the AC, and expands the function of the RADIUS protocol-based COA interface between the AAA server and the AC. The AAA server notifies the AC through the COA message. The authentication of the terminal has been passed, and the real user name of the AC and the updated control policy are notified, so that the policy control of the terminal is implemented, that is, the network authentication of the terminal is completed.

Referring to FIG. 6, FIG. 6 is a hardware structural diagram of an authentication server and an access controller according to Embodiment 6 of the present invention.

The authentication server and the access controller may respectively be the authentication server and the access controller shown in FIG. 1 . The authentication server and access controller employs general purpose computer hardware including a processor 601, a memory 602, a bus 603, an input device 604, an output device 605, and a network interface 606.

In particular, memory 602 can include computer storage media in the form of volatile and/or nonvolatile memory, such as read only memory and/or random access memory. Memory 602 can store operating systems, applications, other program modules, executable code, and program data.

Input device 604 can be used to input commands and information to an authentication server and an access controller, such as a keyboard or pointing device such as a mouse, trackball, touch pad, microphone, joystick, game pad, satellite television antenna, scanning Instrument or similar device. These input devices can be connected to the processor 601 via the bus 603.

The output device 605 can be used to authenticate the server and access controller output information. In addition to the monitor, the output device 605 can also be configured for other peripheral outputs, such as speakers and/or printing devices, which can also pass through the bus 603. Connected to the processor 601.

The authentication server and the access controller can be connected to the network through the network interface 106, for example, to a local area network (LAN). In a networked environment, computer execution instructions stored in the authentication server and access controller may be stored in a remote storage device, and are not limited to being stored locally.

When the processor 601 in the authentication server executes the executable code or the application stored in the memory 602, the authentication server may perform the method steps on the authentication server side in the second embodiment and the third embodiment and the fifth embodiment, for example, step 101 is performed. -103, 201-206, 403, 411, etc. For the specific implementation process, refer to the foregoing Embodiment 2 and Embodiment 3, and details are not described herein again.

When the processor 601 in the access controller executes the executable code or application stored in the memory 602, the access controller may perform the method steps on the access controller side in the fourth and fifth embodiments above, such as performing Steps 301-303, 402, 404-405, and the like. For details, refer to the fourth embodiment and the fifth embodiment, and details are not described herein again.

Referring to FIG. 7, FIG. 7 is a schematic structural diagram of an authentication server according to Embodiment 7 of the present invention.

As shown in the figure, the authentication server provided by the embodiment of the present invention includes:

The authentication receiving module 710 is configured to receive an authentication request message sent by the portal server, where the authentication request message carries the identifier of the terminal, the authentication information, and the address information of the access controller.

The authentication module 720 is configured to authenticate the terminal according to the authentication information.

The authentication notification module 730 is configured to send an authentication result to the access controller corresponding to the address information when the authentication is passed, where the authentication result carries the identifier of the terminal that is authenticated.

The authentication server provided by the embodiment of the present invention may be used in the foregoing method embodiments 2, 3, and 5, and the implementation of the second embodiment is implemented by the cooperation between the authentication receiving module 710, the authentication module 720, and the authentication notification module 730. The method steps on the authentication server side in the third and fifth embodiments. Compared with the authentication server in the prior art, the authentication server provided in this embodiment has the same beneficial effects as the foregoing method embodiment when performing network authentication.

In the authentication server provided by the embodiment, the authentication receiving module 710 is further configured to: before receiving the authentication request message sent by the portal server, receive an access request message sent by the access controller, where the access request message carries the The default authentication information of the terminal. The default authentication information carries the default username.

The authentication server further includes an access processing module 740, configured to acquire a control policy and a redirect address corresponding to the default authentication information, and send an access response message to the access controller, where the access response message carries The control policy and the redirected address, so that the access controller assigns an IP address to the terminal, and controls the terminal using a default control policy.

In addition, the authentication server carries the updated control policy to the authentication result sent by the access controller corresponding to the address information after the authentication is passed, so that the access controller controls the terminal according to the updated control policy, so that the terminal can access the internet.

In this embodiment, the authentication server is presented in the form of a functional unit. A "unit" herein may refer to an application-specific integrated circuit (ASIC), circuitry, a processor and memory that executes one or more software or firmware programs, integrated logic circuitry, and/or other functions that provide the functionality described above. Device. In a simple embodiment, those skilled in the art will appreciate that the authentication server may also take the form shown in FIG. The functions of the authentication receiving module 710, the authentication module 720, the authentication notification module 730, and the access processing module 740 can be implemented. This is implemented by the processor 601 and the memory 602 in FIG. For example, the authentication receiving module 710 receiving the authentication request message sent by the portal server can be implemented by the processor 601 executing the code stored in the memory 602.

Referring to FIG. 8, FIG. 8 is a schematic structural diagram of an access controller according to Embodiment 8 of the present invention.

As shown in the figure, the access controller provided by the embodiment of the present invention mainly includes:

The response receiving module 810 is configured to receive a webpage access request sent by the terminal, and return the address information of the access controller to the terminal;

The terminal access module 820 is configured to access the terminal to the network according to the authentication result.

The authentication access controller provided by the embodiment of the present invention can be used in the foregoing method embodiments 4 and 5, and the fourth embodiment and the fifth embodiment are completed by the cooperation between the response receiving module 810 and the terminal access module 820. Method steps on the side of the access controller. Compared with the access controller in the prior art, the access controller provided in this embodiment has the same beneficial effects as the foregoing method embodiments when performing network authentication.

Further, the access controller provided by the embodiment of the present invention may further include:

The request sending module 830 is configured to send an access request message to the authentication server before the webpage access request sent by the receiving terminal, where the access request message carries the default authentication information of the terminal.

Therefore, the response receiving module 810 is further configured to receive an access response message sent by the authentication server, where the access response message carries a default control policy, so as to perform policy control on the terminal according to a default control policy.

Optionally, the foregoing access response message further includes a redirecting address, and the access controller may further include:

The redirection module 840 is configured to redirect the webpage access request according to the redirected address after receiving the webpage access request sent by the terminal. The redirect address may also be pre-stored in the AC.

With further reference to Figure 8, the access controller provided by the embodiment of the present invention further includes:

The session maintenance module 850 is configured to establish a charging session with the authentication server after receiving the access response message sent by the authentication server, where the user name of the session is a default user.

In this embodiment, if the authentication result received by the access controller further carries the terminal user name, the session maintenance module 850 is further configured to modify the user name of the charging session as the terminal user name, so as to be based on the terminal user. The name is used to charge the terminal to access the internet.

In this embodiment, the access controller is presented in the form of a functional unit. A "unit" herein may refer to an application specific integrated circuit circuit, a processor and memory that executes one or more software or firmware programs, integrated logic circuits, and/or other devices that provide the functionality described above. In a simple embodiment, those skilled in the art will appreciate that the access controller can also take the form shown in FIG. The functions implemented by the response receiving module 810, the terminal access module 820, the request sending module 830, the redirecting module 840, and the session maintenance module 850 can be implemented by the processor 601 and the memory 602 in FIG. For example, the response receiving module 810 receives the webpage access request sent by the terminal, and returning the address information of the access controller to the terminal may be implemented by the processor 601 executing the code stored in the memory 602.

Those of ordinary skill in the art will appreciate that various aspects of the present invention, or possible implementations of various aspects, may be embodied as a system, method, or computer program product. Thus, aspects of the invention, or possible implementations of various aspects, may be in the form of an entirely hardware embodiment, an entirely software embodiment (including firmware, resident software, etc.), or a combination of software and hardware aspects, They are collectively referred to herein as "circuits," "modules," or "systems." Furthermore, aspects of the invention, or possible implementations of various aspects, may take the form of a computer program product, a computer program A product refers to computer readable program code stored on a computer readable medium.

The above is only a specific embodiment of the present invention, but the scope of the present invention is not limited thereto, and any person skilled in the art can easily think of changes or substitutions within the technical scope of the present invention. It should be covered by the scope of the present invention. Therefore, the scope of the invention should be determined by the scope of the claims.

Claims

A network authentication method is applied to an authentication server, which is characterized by:

Receiving an authentication request message sent by the portal server, where the authentication request message carries the identifier of the terminal, the authentication information, and the address information of the access controller;

And authenticating the terminal according to the authentication information;

When the authentication is passed, the authentication result is sent to the access controller corresponding to the address information, where the authentication result carries the identifier of the terminal that is authenticated.
The method according to claim 1, wherein before the receiving the authentication request message sent by the portal server, the method further comprises:

Receiving an access request message sent by the access controller, where the access request message carries default authentication information of the terminal;

Obtaining a control policy and a redirecting address corresponding to the default authentication information, and sending an access response message to the access controller, where the access response message carries the control policy and a redirect address.
The method according to claim 2, wherein the authentication result carries an updated control policy.
The method according to claim 1 or 2, wherein the authentication information of the terminal includes a terminal user name and a password, and the authenticating the terminal according to the authentication information includes:

Verifying that the terminal user name and password in the authentication information are consistent with the locally saved user name and password;

If the terminal user name and password in the authentication information are consistent with the locally saved user name and password, the authentication of the terminal is passed.
A network authentication method, applied to an access controller, includes:

Receiving a webpage access request sent by the terminal, and returning address information of the access controller to the terminal;

Receiving an authentication result sent by the authentication server according to the address information of the access controller, where the authentication result carries an identifier of the terminal that passes the authentication;

The terminal is connected to the network according to the authentication result.
The method according to claim 5, further comprising: before the webpage access request sent by the receiving terminal,

Sending an access request message to the authentication server, where the access request message carries the default authentication information of the terminal;

Receiving an access response message sent by the authentication server, where the access response message carries a control policy corresponding to the default authentication information.
The method according to claim 6, wherein after receiving the access response message sent by the authentication server, the method further includes:

A charging session is established with the authentication server, and the user name of the session is a default user.
The method according to claim 7, wherein the authentication result further carries a terminal user name, and the method further includes

The user name of the charging session is modified to be the terminal user name.
The method according to any one of claims 6-8, wherein the access response message carries a redirect address, the method further includes

After receiving the webpage access request sent by the terminal, the webpage access request is redirected according to the redirected address.
An authentication server, comprising:

The authentication receiving module is configured to receive an authentication request message sent by the portal server, where the authentication request message carries the identifier of the terminal, the authentication information, and the address information of the access controller.

An authentication module, configured to authenticate the terminal according to the authentication information;

The authentication notification module is configured to send an authentication result to the access controller corresponding to the address information when the authentication is passed, where the authentication result carries the identifier of the terminal that is authenticated.
The authentication server according to claim 10, further comprising:

The authentication receiving module is further configured to: before receiving the authentication request message sent by the portal server, receive an access request message sent by the access controller, where the access request message carries the default authentication information of the terminal;

An access processing module, configured to obtain a control policy and a redirect address corresponding to the default authentication information, and send an access response message to the access controller, where the access response message carries the control policy and Targeted address.
The authentication server according to claim 10, wherein the authentication result carries an updated control policy.
An access controller, comprising:

The response receiving module is configured to receive a webpage access request sent by the terminal, and return the address information of the access controller to the terminal;

The response receiving module is further configured to receive an authentication result that is sent by the authentication server according to the address information of the access controller, where the authentication result carries an identifier of the terminal that is authenticated;

The terminal access module is configured to access the terminal to the network according to the authentication result.
The access controller of claim 13, further comprising:

a request sending module, configured to send an access request message to the authentication server before the webpage access request sent by the receiving terminal, where the access request message carries the default authentication information of the terminal;

The response receiving module is further configured to receive an access response message sent by the authentication server, where the access response message carries a default control policy.
The access controller of claim 14, further comprising:

The session maintenance module is configured to establish a charging session with the authentication server after receiving the access response message sent by the authentication server, where the user name of the session is a default user.
The access controller according to claim 15, wherein the authentication result further carries a terminal user name, and the session maintenance module is further configured to modify a user name of the charging session as the terminal user name. .
The access controller according to any one of claims 14-16, wherein the access response message further carries a redirect address, and the access controller further includes

And a redirection module, configured to redirect the webpage access request according to the redirected address after receiving the webpage access request sent by the terminal.