WO2018076712A1 - 一种终端认证的方法及设备 - Google Patents

一种终端认证的方法及设备 Download PDF

Info

Publication number
WO2018076712A1
WO2018076712A1 PCT/CN2017/088231 CN2017088231W WO2018076712A1 WO 2018076712 A1 WO2018076712 A1 WO 2018076712A1 CN 2017088231 W CN2017088231 W CN 2017088231W WO 2018076712 A1 WO2018076712 A1 WO 2018076712A1
Authority
WO
WIPO (PCT)
Prior art keywords
terminal
address
portal server
authentication
application
Prior art date
Application number
PCT/CN2017/088231
Other languages
English (en)
French (fr)
Inventor
袁先虎
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to EP17865053.7A priority Critical patent/EP3525411B1/en
Publication of WO2018076712A1 publication Critical patent/WO2018076712A1/zh
Priority to US16/392,157 priority patent/US10701073B2/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/16—Implementing security features at a particular protocol layer
    • H04L63/166—Implementing security features at a particular protocol layer at the transport layer
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L47/00—Traffic control in data switching networks
    • H04L47/10—Flow control; Congestion control
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0884—Network architectures or network communication protocols for network security for authentication of entities by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L65/00—Network arrangements, protocols or services for supporting real-time applications in data packet communication
    • H04L65/40—Support for services or applications
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/02—Protocols based on web technology, e.g. hypertext transfer protocol [HTTP]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/50—Network services
    • H04L67/56—Provisioning of proxy services
    • H04L67/563—Data redirection of data network streams
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L69/00—Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass
    • H04L69/16—Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
    • H04L69/161—Implementation details of TCP/IP or UDP/IP stack architecture; Specification of modified or new header fields
    • H04L69/162—Implementation details of TCP/IP or UDP/IP stack architecture; Specification of modified or new header fields involving adaptations of sockets based mechanisms
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0876—Network architectures or network communication protocols for network security for authentication of entities based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint

Definitions

  • the present invention relates to the field of communications technologies, and in particular, to a method and device for terminal authentication.
  • Portal English: Portal
  • Portal authentication is a way to effectively protect network security.
  • Portal authentication means that the terminal needs to obtain the authorization of the Portal server to access network data.
  • the portal authentication process may include: when the access device receives the Hypertext Transfer Protocol (HTTP) traffic request initiated by the unauthorized terminal for the first time, the access device returns a Portal server to the terminal.
  • the HTTP response of the Uniform Resource Locator (URL) address is sent by the terminal to the Portal server according to the URL address, and the Portal server can complete the transmission control protocol with the terminal (English: Transmission Control) Protocol, short for example: TCP) handshake and Secure Sockets Layer (English: Secure Sockets Layer, SSL for short), return a response containing the HTTP authentication page to be loaded to the terminal; the terminal loads and displays the HTTP authentication page according to the response, and receives The authentication information entered by the user on the HTTP authentication page is sent to the Portal server for authentication.
  • HTTP Hypertext Transfer Protocol
  • the access device returns a Portal server to the terminal.
  • the HTTP response of the Uniform Resource Locator (URL) address is sent by the terminal to the Portal server according to the URL address
  • the Portal server can complete the transmission control protocol with the terminal (English: Transmission Control
  • the above HTTP traffic request may trigger a valid traffic request initiated by the terminal browser by the user, or may be an invalid traffic request automatically initiated by the application other than the browser in the terminal.
  • the access device cannot identify the valid traffic request and the invalid traffic request. Then, even if the terminal initiates an invalid traffic request to the access device, the terminal can obtain the URL address of the portal server, and perform the operation of "initiating an HTTP authentication page request to the portal server and completing the TCP handshake and the SSL handshake".
  • the problem is that, for the invalid traffic request, the terminal cannot load and display the HTTP authentication page through the application, and thus the authorization authentication cannot be completed; that is, after the terminal obtains the URL address of the Portal server,
  • the above-mentioned authorization authentication operation is an invalid operation with no result.
  • the present invention provides a method and a device for terminal authentication, which can reduce the occupation of network resources by invalid operations corresponding to invalid traffic requests during terminal authentication, and reduce the load of the Portal server.
  • a method of terminal authentication includes: the terminal sends an HTTP traffic request to the access device, where the HTTP traffic request is a traffic request initiated by the first application in the terminal; the terminal receives an HTTP traffic response sent by the access device, the HTTP The traffic response is sent after the access device determines that the terminal is an unauthorized terminal, and the HTTP traffic response includes a JavaScript tag. If the terminal uses the first application, the address of the portal server is obtained according to the JavaScript tag, and the terminal according to the The address of the portal server for authorization authentication of the terminal.
  • the terminal may obtain the address of the portal server according to the JavaScript tag, and when the first application of the terminal cannot be parsed In the above JavaScript tag, the terminal cannot obtain the address of the portal server based on the above JavaScript tag. Therefore, according to the solution, even if the terminal initiates an HTTP traffic request to the access device by using the first application, and receives an HTTP traffic response including the JavaScript tag, if the terminal adopts the first application, the JavaScript tag cannot be used according to the JavaScript tag.
  • the address of the management server may be included in the JavaScript tag.
  • the method that the terminal uses the first application to obtain the address of the portal server according to the JavaScript tag may include: the terminal adopts the first application, and obtains an address of the management server from the JavaScript tag, according to the management server.
  • the first application executes the asynchronous literal translation scripting language and the Asynchronous JavaScript And XML (Ajax) script, and obtains the lowest load among the portal servers managed by the management server from the management server.
  • the address of the portal server may be included in the JavaScript tag.
  • the method that the terminal uses the first application to obtain the address of the portal server according to the JavaScript tag may include: the terminal adopts the first application, and obtains an address of the management server from the JavaScript tag, according to the management server.
  • the first application executes the asynchronous literal translation scripting language and the Asynchronous JavaScript And XML (Ajax) script, and obtains the lowest load among the portal servers managed by the management server from the management server.
  • the method for obtaining the address of the portal server from the address of the management server may include: the terminal may execute the Ajax script by using the first application, and send the message to the management server.
  • the management server can manage at least two portal servers, that is, at least two portal servers can provide authentication services for the terminal, and the load of each of the at least two portal servers may not be the same, such as some portals.
  • the load of the server is relatively high, and the load of some portal servers is relatively low. Therefore, by performing the above-mentioned "authorization authentication of the terminal according to the address of the portal server with the lowest load", the load of the portal server managed by the above management server can be realized. balanced.
  • the terminal performs the authorization authentication of the terminal according to the address of the portal server, including: the terminal executes the JavaScript script by using the first application, and redirects according to the address of the portal server. Go to the terminal authentication page of the portal server to perform authorization authentication of the terminal.
  • the specific process of the terminal using the first application to execute the JavaScript script and redirecting to the terminal authentication page of the portal server according to the address of the portal server may include: the terminal adopts the first application direction
  • the portal server initiates an HTTP authentication page request; executes a JavaScript script, completes a TCP handshake and an SSL handshake with the portal server, and after receiving the HTTP authentication page response, parses the URL of the HTTP authentication page included in the HTTP authentication page response, according to The URL of the HTTP authentication page loads and displays the HTTP authentication page, and receives the authentication information input by the user on the HTTP authentication page, and then sends the authentication information to the portal server to perform authorization authentication of the terminal.
  • the process of "redirecting to the terminal authentication page of the portal server according to the address of the portal server by executing the JavaScript script" does not need to reload the entire webpage, but provides the user with the entire page.
  • a partial page of the authentication information input is updated. That is, executing a JavaScript script can load only a portion of the page, not the entire page, which reduces the amount of information requested to the portal server, which can further reduce the load on the portal server.
  • the first application in the terminal can obtain the address of the management server even if the JavaScript tag can be parsed, for example, the browser can parse the JavaScript tag to obtain the address of the management server; however, the browser does not Ajax must be supported, that is, some browsers may support Ajax, and some browsers do not support Ajax.
  • the JavaScript tag may include not only the address of the management server but also the address of the default portal server.
  • the method for the terminal authentication may further include: if the first application does not support Ajax, the first application is used to perform authorization authentication of the terminal according to the address of the default portal server.
  • the first application such as a browser
  • the Ajax script cannot be executed, and the address of the portal server is obtained from the management server, and thus the execution cannot be performed.
  • the JavaScript script redirects to the terminal authentication page of the portal server according to the address of the portal server, and performs authorization authentication of the terminal.
  • the terminal adopts the first application, although the Ajax script cannot be executed, but can execute the JavaScript script, so that the JavaScript script can be executed according to the address of the default portal server, and the terminal authentication page of the default portal server is redirected. Perform authorization authentication for the terminal. Therefore, even if the first application does not support Ajax, the terminal can complete the authorization authentication of the terminal after the first application initiates the HTTP traffic request.
  • the HTTP traffic response includes a JavaScript tag, where the HTTP traffic response includes a Hyper Text Markup Language (HTML) information.
  • HTML Hyper Text Markup Language
  • a JavaScript tag is embedded in the above HTML information.
  • the above HTML information may carry related information of a page that needs to be loaded.
  • the JavaScript tag includes a list of portal servers including addresses of at least one portal server.
  • the terminal adopts the first application
  • the method for obtaining the address of the portal server according to the JavaScript tag may include: the terminal adopting the first application, and obtaining an address of any one of the portal servers included in the portal server list from the JavaScript tag.
  • the load of each of the at least one portal server may be different, for example, the load of the portal server in the at least one portal server is higher, and some The load on the portal server is lower. It is conceivable that after obtaining the list of portal servers in the JavaScript tag, the terminal may query the load of each of the at least one portal server and determine the least loaded portal server among the at least one portal server. In this way, the terminal can adopt the first application, and perform authorization authentication of the terminal according to the address of the portal server with the lowest load included in the portal server list, so that load balancing of the at least one portal server can be implemented.
  • a second aspect provides a method for terminal authentication, including: an access device receiving an HTTP sent by a terminal a traffic request, the HTTP traffic request is a traffic request initiated by the terminal by the first application in the terminal; if the terminal is determined to be an unauthorized terminal, the access device sends an HTTP traffic response to the terminal, where the HTTP traffic response includes A JavaScript tag for the terminal to obtain the address of the portal server and perform authorization authentication of the terminal according to the address of the portal server.
  • the terminal cannot use the first application to obtain the portal server according to the JavaScript tag.
  • the address is even less authorized for terminal authentication. That is to say, the terminal does not perform the invalid operation of "initiating an HTTP authentication page request to the Portal server and completing the TCP handshake and the SSL handshake", so as to avoid the use of the network resources by the invalid operation without the result. Reduce the load on the Portal server.
  • the JavaScript tag includes an address of the management server; or the JavaScript tag includes an address of the management server and an address of the default portal server; or the JavaScript tag includes the portal server.
  • List, the portal server list contains the address of at least one portal server.
  • the HTTP traffic response includes a JavaScript tag, where the HTTP traffic response includes HTML information, and the JavaScript tag is embedded in the HTML information.
  • the HTML information is included in the HTTP traffic response transmitted by the access device to the terminal, the HTML information includes the JavaScript tag, and may be one of the methods of including the JavaScript tag in the HTTP traffic response.
  • the method for the terminal authentication may further include: the access device receiving the JavaScript tag sent by the management server.
  • the access device may receive HTML information sent by the management server, where the HTML information includes a JavaScript tag.
  • the access device may send an HTML information request to the management server, and receive the HTML information that is sent by the management server and includes the JavaScript tag.
  • the access device may start at startup.
  • the HTML information request is sent to the management server, and then the HTML information containing the JavaScript tag delivered by the management server is received.
  • the access device can also receive the HTML information that is sent by the management server and contains the JavaScript tag.
  • the access device receives the HTML information including the JavaScript tag sent by the management server before sending the HTTP traffic response to the terminal, and can send the HTTP traffic response including the HTML information to the terminal, that is, sending the JavaScript tag to the terminal. HTTP traffic response.
  • a method for terminal authentication comprising: a management server sending a JavaScript tag to an access device.
  • the JavaScript tag is used by the terminal to obtain an address of the portal server, and performs authorization authentication of the terminal according to the address of the portal server.
  • the management server may send the JavaScript tag to the access device, and after receiving the HTTP traffic request sent by the terminal, the access device sends an HTTP traffic response including the JavaScript tag to the terminal.
  • the terminal cannot use the first application to obtain the address of the portal server according to the JavaScript tag, and is less likely to perform authorization authentication of the terminal. That is to say, the terminal does not perform the invalid operation such as "initiating an HTTP authentication page request to the Portal server and completing the TCP handshake and the SSL handshake", such as This can avoid the use of network resources by invalid operations without results, and can reduce the load of the Portal server.
  • the foregoing JavaScript tag includes an address of the management server.
  • the method for authenticating the terminal may further include: the management server receiving the authentication address request sent by the terminal, and acquiring the address of the portal server having the lowest load among the portal servers managed by the management server; The management server sends an authentication address response to the terminal, where the authentication address response includes the address of the portal server with the lowest load. Because the management server obtains and sends to the terminal the address of the portal server with the lowest load, the terminal can interact with the portal server with the lowest load to perform authorization authentication of the terminal, and load balancing of the at least two portal servers can be implemented.
  • the first application in the terminal can obtain the address of the management server even if the JavaScript tag can be parsed, for example, the browser can parse the JavaScript tag to obtain the address of the management server; however, the browser does not Ajax must be supported, that is, some browsers may support Ajax, and some browsers do not support Ajax.
  • the JavaScript tag may include not only the address of the management server but also the address of the default portal server.
  • the JavaScript tag includes a portal server list, where the portal server list includes an address of the at least one portal server.
  • a fourth aspect provides a terminal, where the terminal includes: a sending module, a receiving module, an obtaining module, and an authentication module.
  • the sending module is configured to send an HTTP traffic request to the access device, where the HTTP traffic request is a traffic request initiated by the first application in the terminal, and the receiving module is configured to receive an HTTP traffic response sent by the access device, where the HTTP traffic is sent.
  • the response is that the access device determines that the terminal is an unauthorized terminal, and the HTTP traffic response includes a JavaScript tag.
  • the acquiring module is configured to obtain the address of the portal server according to the JavaScript tag by using the first application, and the authentication module is used by the authentication module. If the obtaining module obtains the address of the portal server according to the JavaScript tag by using the first application, the authorization of the terminal is performed according to the address of the portal server acquired by the obtaining module.
  • the foregoing authentication module is specifically configured to execute a JavaScript script by using the foregoing first application, to redirect to a terminal authentication page of the portal server according to an address of the portal server, and perform the terminal Authorized certification.
  • the foregoing JavaScript tag includes an address of the management server, where the acquiring module is specifically configured to: obtain the address of the management server from the JavaScript tag by using the first application, according to the management The address of the server, using the first application to execute an Ajax script, and obtaining, from the management server, the address of the portal server with the lowest load among the portal servers managed by the management server.
  • the foregoing authentication module is further configured to: if the first application does not support Ajax, use the first application to perform authorization authentication of the terminal according to an address of the default portal server.
  • the foregoing JavaScript tag includes a portal server list, where the portal server list includes an address of the at least one portal server, where the acquiring module is specifically configured to: use the first application, The address of any one of the portal servers included in the above list of portal servers is obtained in the JavaScript tag.
  • the foregoing HTTP traffic response received by the receiving module The JavaScript tag is included, and the HTTP traffic response received by the receiving module includes HTML information, and the JavaScript tag is embedded in the HTML information.
  • a terminal including: a processor, a memory, a bus, and a communication interface, wherein the processor, the memory, and the communication interface are connected by a bus.
  • the above memory is for storing computer program code, the computer program code comprising instructions, when the processor of the terminal executes the instruction, the terminal performs a method of terminal authentication as in the first aspect and its various possible implementations.
  • a computer storage medium stores computer program code, and the computer program code includes instructions.
  • the processor of the terminal executes the instruction, the terminal performs the first aspect and various possible implementation manners thereof.
  • the method of terminal authentication is provided.
  • the application provides an access device, where the access device includes: a receiving module, a determining module, and a sending module; wherein the receiving module is configured to receive an HTTP traffic request sent by the terminal, where the HTTP traffic request is the terminal a traffic request initiated by the first application in the terminal; the determining module is configured to determine whether the terminal is an unauthorized terminal; and the sending module is configured to send an HTTP traffic request to the terminal, where the HTTP traffic response includes a JavaScript tag, the JavaScript tag
  • the terminal obtains an address of the portal server, and performs authorization authentication of the terminal according to the address of the portal server.
  • the HTTP traffic response sent by the sending module includes a JavaScript tag, where the HTTP traffic response sent by the sending module includes HTML information, and the HTML information is embedded in the HTML information.
  • the JavaScript tag is a JavaScript tag.
  • the receiving module is further configured to: before the sending module sends the HTTP response to the terminal, receive the JavaScript tag sent by the management server.
  • an access device comprising: a processor, a memory, a bus, and a communication interface, wherein the processor, the memory, and the communication interface are connected by a bus.
  • the memory is for storing computer program code, the computer program code comprising instructions, when the processor of the access device executes the instructions, the access device performs a method of terminal authentication as in the second aspect and its various possible implementations.
  • a computer storage medium stores computer program code, where the computer program code includes instructions.
  • the processor of the access device executes the instruction, the access device performs the second aspect and various A possible implementation of terminal authentication methods.
  • the application provides a management server, where the management server includes: a sending module.
  • the method is configured to send a JavaScript tag to an access device, where the JavaScript tag is used by the terminal to obtain an address of the portal server, and perform authorization authentication of the terminal according to the address of the portal server.
  • the JavaScript tag includes an address of the management server, or the JavaScript tag includes an address of the management server and an address of the default portal server; and the management server further includes: a receiving module And get the module.
  • the receiving module is used to connect to the sending module After the device sends the JavaScript tag, the receiving terminal sends an authentication address request;
  • the obtaining module is configured to obtain, after receiving the authentication address request sent by the terminal, the address of the portal server with the lowest load among the portal servers managed by the management server;
  • the sending module is further configured to send an authentication address response to the terminal, where the authentication address response includes an address of the portal server with the lowest load.
  • the JavaScript module sent by the sending module to the access device includes a portal server list, where the portal server list includes an address of at least one portal server.
  • a management server comprising: a processor, a memory, a bus, and a communication interface, wherein the processor, the memory, and the communication interface are connected by a bus.
  • the above memory is for storing computer program code comprising instructions for performing a terminal authentication method as in the third aspect and its various possible implementations when the processor of the management server executes the instructions.
  • a computer storage medium having stored therein computer program code, the computer program code comprising instructions, when the processor of the management server executes the instruction, the management server performs the third aspect and various A possible implementation of terminal authentication methods.
  • FIG. 1 is a schematic structural diagram of an authorization authentication network according to an embodiment of the present disclosure
  • FIG. 2 is a schematic structural diagram of another authorization authentication network according to an embodiment of the present invention.
  • FIG. 3 is a flowchart of a method for terminal authentication according to an embodiment of the present invention.
  • FIG. 4 is a flowchart of another method for terminal authentication according to an embodiment of the present invention.
  • FIG. 5 is a flowchart of another method for terminal authentication according to an embodiment of the present invention.
  • FIG. 6 is a flowchart of another method for terminal authentication according to an embodiment of the present invention.
  • FIG. 7 is a flowchart of another method for terminal authentication according to an embodiment of the present invention.
  • FIG. 8 is a schematic structural diagram of a terminal according to an embodiment of the present disclosure.
  • FIG. 9 is a schematic structural diagram of another terminal according to an embodiment of the present disclosure.
  • FIG. 10 is a schematic structural diagram of an access device according to an embodiment of the present disclosure.
  • FIG. 11 is another schematic structural diagram of an access device according to an embodiment of the present disclosure.
  • FIG. 12 is another schematic structural diagram of a management server according to an embodiment of the present invention.
  • FIG. 13 is another schematic structural diagram of a management server according to an embodiment of the present invention.
  • At least two terminals refer to two or more terminals
  • multiple portal servers refer to two or more portal servers.
  • the method and device for terminal authentication provided by the embodiment of the present invention can be applied to an unauthorized terminal for performing authorization authentication and acquiring network rights.
  • FIG. 1 is a schematic diagram of an architecture of an authorization authentication network according to an embodiment of the present invention.
  • the authorization authentication network includes at least two portal servers 11, at least one access device 12, at least one terminal 13, and a management server 14, and the management server 14 is configured to manage the at least two portal servers 11.
  • the terminal 13 is configured to initiate an HTTP traffic request to the access device 12.
  • the access device 12 is configured to send an HTTP traffic response including the address of the management server 14 to the terminal 13 if it is determined that the terminal 13 is an unauthorized terminal after receiving the HTTP traffic request initiated by the terminal 13.
  • the terminal 13 is configured to acquire, from the management server 14, the address of one of the portal servers 11 managed by the management server 14 according to the address of the management server 14, and perform authorization authentication of the terminal 11 according to the address of the portal server 11. .
  • FIG. 2 is a schematic diagram showing another architecture of an authorization authentication network according to an embodiment of the present invention.
  • the authorization authentication network includes a portal server 11, at least one access device 12, and at least one terminal 13.
  • the terminal 13 is configured to initiate an HTTP traffic request to the access device 12.
  • the access device 12 is configured to: after receiving the HTTP traffic request initiated by the terminal 13, if the terminal 13 is determined to be an unauthorized terminal, send an HTTP traffic response including the address of the portal server 11 to the terminal 13; according to the portal server The address of 11 is authorized to authenticate the terminal 11.
  • the foregoing access device 12 may be a device that can provide network access services for the terminal, such as a switch or a firewall.
  • a switch In the embodiment of the present invention, only the switch is used as an example to access the device 12 and the authorized authentication network. The process of interaction between other devices in the description is explained.
  • the terminal 13 in the embodiment of the present invention may be a personal computer (English: Personal Computer, PC for short), a mobile phone, a tablet computer, a portable computer, and the like.
  • the HTTP traffic response sent by the access device 12 in the authorized authentication network shown in FIG. 1 or FIG. 2 to the terminal 13 includes a JavaScript tag, and the unauthorized terminal may use the first application according to the JavaScript tag.
  • the HTTP traffic response sent by the access device 12 in the authorized authentication network shown in FIG. 1 or FIG. 2 to the terminal 13 includes a JavaScript tag, and the unauthorized terminal may use the first application according to the JavaScript tag.
  • the method for terminal authentication provided by the embodiment of the present invention may be based on the principle that “the application used by the terminal (such as a browser) is capable of parsing a JavaScript tag, and some applications cannot parse a JavaScript tag”.
  • the terminal can prevent the terminal from using the first application to initiate the HTTP traffic request and receive the HTTP traffic response, and then continue to perform the "initiating the HTTP authentication page request to the Portal server and completing the TCP handshake and the SSL handshake". Invalid operation of the result, so as to avoid the use of network resources by the invalid operation without the above result, and the load of the Portal server can be reduced.
  • the embodiment of the invention provides a method for terminal authentication.
  • the terminal authentication method includes S301-S307:
  • the terminal sends an HTTP traffic request to the access device, where the HTTP traffic request is a traffic request initiated by the first application in the terminal.
  • the first application in the embodiment of the present invention may be an application capable of parsing a JavaScript tag, or the first application may be an application that cannot parse a JavaScript tag.
  • the terminal can parse the JavaScript tag by using the first application; when the first application is an application other than the browser on the terminal, the terminal cannot parse the JavaScript by using the first application. label.
  • the above browser may be a Microsoft browser (English: Internet Explorer, IE for short) installed in the terminal or a non-IE browser.
  • the access device receives an HTTP traffic request sent by the terminal.
  • the access device determines whether the terminal is an unauthorized terminal.
  • the HTTP traffic request in the embodiment of the present invention may be a service request initiated by the terminal to the service server.
  • the service server may be a base station, and the corresponding service request may be a voice or video communication request initiated by the terminal to the other terminal by using the base station; or the service server may also be a server capable of providing other webpage resources for the terminal, corresponding to The service request may be a webpage resource request message initiated by the terminal to the server.
  • the terminal that initiates the HTTP traffic request to the access device may be an authorized terminal or an unauthorized terminal.
  • the access device may directly forward the HTTP traffic request to the corresponding service server, so that the service server may provide corresponding service data for the terminal according to the HTTP traffic request;
  • the inbound device needs to provide the address of the portal server to the unauthorized terminal, so that the unauthorized terminal interacts with the portal server to perform authorization authentication of the terminal.
  • the method for the access device to determine whether the terminal is an unauthorized terminal may include: after receiving the HTTP traffic request initiated by the terminal, the access device queries whether the identifier of the authorized terminal stored in the access device is The identifier of the terminal is included; if the identifier of the authorized terminal stored in the access device includes the identifier of the terminal, the access device determines that the terminal is an authorized terminal; if the identifier of the authorized terminal stored in the access device is not The identifier of the terminal is included, and the access device determines that the terminal is an unauthorized terminal.
  • the access protocol may be an Internet Protocol (English: Internet Protocol, IP address) address of the terminal, and the access device may parse the IP address of the terminal that sends the HTTP traffic request from the received HTTP traffic request.
  • the method for the access device to determine whether the terminal is an unauthorized terminal includes, but is not limited to, the foregoing method.
  • the access device may also send a permission query request to the authentication server (such as the portal server in the embodiment of the present invention) after receiving the HTTP traffic request initiated by the terminal, where the permission query request includes the identifier of the terminal,
  • the permission query request is used to indicate whether the authentication server queries the terminal as an authorized terminal; the access device receives the permission query response sent by the authentication server, and the permission query response includes the terminal information indicating the authorized terminal or the unauthorized terminal.
  • the access device forwards the HTTP traffic request to the network side.
  • the access device sends an HTTP traffic response to the terminal, where the HTTP traffic response includes a JavaScript tag.
  • the HTTP traffic response includes a JavaScript tag, and specifically, the HTTP traffic response includes HTML information, and the JavaScript tag is embedded in the HTML information.
  • the JavaScript tag is used by the terminal to obtain the address of the portal server, and performs authorization authentication of the terminal according to the address of the portal server.
  • the HTTP traffic response sent by the access device to the terminal may be an HTTP 200 response message.
  • the specific manner of carrying the HTML information of the embedded JavaScript tag in the HTTP traffic response may be that the HTTP 200 response message is an HTTP page containing a JavaScript tag sent by the management server.
  • the terminal receives an HTTP traffic response sent by the access device.
  • the terminal obtains an address of the portal server according to the JavaScript tag by using the first application.
  • the first application may be an application that can parse a JavaScript tag, or an application that cannot parse a JavaScript tag.
  • the terminal adopts the first application, and the address of the portal server can be obtained according to the JavaScript tag; and when the first application cannot parse the JavaScript tag, the terminal adopts the first application, and cannot be based on The JavaScript tag gets the address of the portal server. That is, when the terminal uses the first application to obtain the address of the portal server according to the JavaScript tag, there are two results: the acquisition succeeds and the acquisition fails.
  • the terminal can perform authorization authentication of the terminal according to the address of the portal server.
  • the method for authenticating the terminal further includes S307:
  • the terminal performs authorization authentication of the terminal according to the address of the portal server.
  • the method for performing authorization authentication of the terminal according to the address of the portal server may include: the terminal executing the JavaScript script by using the first application, and initiating an HTTP authentication page request according to the address of the portal server; the portal server and the terminal After the TCP handshake and the SSL handshake are completed, the HTTP authentication page is returned to the terminal.
  • the terminal loads and displays the HTTP authentication page, receives the authentication information input by the user on the HTTP authentication page, and sends the authentication information to the portal server for authorization authentication.
  • the terminal executes the JavaScript script by using the browser, and can exchange data with the portal server without reloading the entire page, that is, the partial refresh effect can be generated without refreshing the entire page.
  • the terminal reloading part of the page requires less loaded data than reloading the entire page, and relatively reduces network load and alleviates network congestion. That is to say, the terminal uses a browser to execute a JavaScript script, which can reduce the possibility of network congestion in the process of performing authorization authentication.
  • the terminal executes the JavaScript script by using the first application (which may be an application capable of parsing the JavaScript tag except the browser), thereby reducing the terminal's authorization process.
  • the first application which may be an application capable of parsing the JavaScript tag except the browser
  • an application such as a browser in the terminal can parse a JavaScript tag, and some applications cannot parse a JavaScript tag; therefore, only when the terminal When the first application can parse the JavaScript tag, the terminal may obtain the address of the portal server according to the JavaScript tag, and when the first application of the terminal cannot parse the JavaScript tag, the terminal cannot obtain the portal server according to the JavaScript tag. the address of. Therefore, according to the solution, even if the terminal initiates an HTTP traffic request to the access device by using the first application, and receives an HTTP traffic response including the JavaScript tag, if the terminal adopts the first application, the JavaScript tag cannot be used according to the JavaScript tag.
  • the JavaScript tag includes an address of the management server.
  • the terminal can obtain the address of the management server by using the first application.
  • S306 in FIG. 3 may include S401-S402, and S307 in FIG. 3 may be replaced with S403:
  • the terminal obtains, by using the first application, an address of the management server according to the JavaScript tag.
  • the terminal executes an Ajax script by using the first application according to the address of the management server, and acquires an address of the portal server from the management server.
  • the address of a portal server acquired by the terminal from the management server may be any one of the at least two portal servers managed by the management server.
  • the terminal executes the Ajax script by using the first application according to the address of the management server, and the address of the portal server obtained from the management server may be the least loaded portal server among the at least two portal servers managed by the management server.
  • the management server can manage at least two portal servers, that is, at least two portal servers can provide authentication services for the terminal, and the load of each portal server may not be the same, such as the load of the portal server. High, some portal servers have a lower load.
  • the terminal may obtain, from the management server, the address of the portal server with the lowest load among the managed portal servers according to the address of the management server.
  • the management server may periodically acquire load information of at least two portal servers managed by the management server from at least two portal servers managed by the management server; or each of the at least two portal servers The load information can be reported to the management server periodically.
  • the load information is used to indicate the level of the load of the portal server.
  • the terminal performs authorization authentication of the terminal according to the address of the portal server acquired from the management server.
  • the first application in the terminal can parse the JavaScript tag to obtain the address of the management server, for example, the browser can parse the JavaScript tag to obtain the address of the management server; however, the browser does not necessarily support Ajax, that is, some browsers may support Ajax. Some browsers do not support Ajax.
  • the JavaScript tag may include not only the address of the management server but also the address of the default portal server.
  • the terminal may further determine whether the first application supports Ajax. As shown in FIG. 5, S401 in FIG. 4 may be replaced by S401'. S402 in FIG. 4 may further include S402'. After S402', S404 may also be included:
  • the terminal uses the first application to obtain the address of the management server and the address of the default portal server according to the JavaScript tag.
  • the terminal determines whether the first application supports Ajax.
  • the terminal may perform authorization authentication of the terminal according to the address of the portal server acquired from the management server, that is, perform S402-S403 in FIG. 5; when the terminal determines that the first application is not When Ajax is supported, the terminal's authorization authentication can be performed according to the address of the default portal server, that is, S404 in Figure 5 is executed:
  • the terminal performs authorization authentication of the terminal according to the address of the default portal server.
  • the terminal cannot use the first application to execute the Ajax script, and the portal server address cannot be obtained according to the management server. It is also possible to redirect to the terminal authentication page of the default portal server at the address of the default portal server obtained according to the JavaScript tag, and perform authorization authentication of the terminal. That is, regardless of whether the first application of the terminal that initiates the HTTP traffic request supports Ajax, the terminal can complete the authorization authentication as long as the terminal initiates the HTTP traffic request by using the first application.
  • the JavaScript tag includes a list of portal servers, the portal server list including addresses of at least one portal server.
  • the terminal can parse the JavaScript tag by using the first application, the address of the at least one portal server can be obtained according to the JavaScript tag.
  • S306 of FIG. 3 may be replaced with S601
  • S307 of FIG. 3 may be replaced with S602:
  • the terminal uses the first application to obtain an address of any one of the portal servers included in the portal server list according to the JavaScript tag.
  • the terminal performs authorization authentication of the terminal according to an address of any one of the portal servers included in the portal server list.
  • the portal server that performs authorization authentication by the terminal in the embodiment of the present invention may be any one of at least one portal server included in the portal server list, or may be at least one portal server included in the portal server list.
  • the least loaded portal server may be any one of at least one portal server included in the portal server list, or may be at least one portal server included in the portal server list.
  • the foregoing JavaScript tag may be pre-configured in the access device; of course, the JavaScript tag may also be obtained by the access device from the management server side. That is, before S304 in any of the figures in FIG. 3-6, the method of the embodiment of the present invention may further include S701. As shown in FIG. 7 , before the method of S304 in FIG. 5 , the method in the embodiment of the present invention may further include S701 as an example.
  • the method for terminal authentication provided by the embodiment of the invention is exemplified:
  • the access device acquires a JavaScript tag from the management server.
  • the method for the access device to obtain the JavaScript tag from the management server may include: the access device receives the HTML information sent by the management server, and the HTML information is embedded with the JavaScript tag. Specifically, the access device may send the HTML information request to the management server after receiving the HTTP traffic request sent by the terminal, and then receive the HTML information sent by the management server; or the access device may send the information to the management server when the device is powered on. The HTML information request is then received by the management server.
  • the access device can also receive HTML information that is actively sent by the management server.
  • the access device receives the HTML information sent by the management server before sending the HTTP traffic response to the terminal, and then sends the HTTP traffic response including the HTML information embedded in the JavaScript tag to the terminal, that is, sends the HTTP message containing the JavaScript tag to the terminal. Traffic response.
  • the access device may determine whether the access device is saved after receiving the HTTP traffic request.
  • the HTML information if the HTML information is not saved in the access device, sends an HTML information request to the management server, and obtains and saves the HTML information from the management server. If the HTML information is stored in the access device, the content is directly returned to the terminal. HTTP traffic response for HTML information stored in the access device.
  • the method and time when the access device obtains the HTML information from the management server includes, but is not limited to, the method listed in the foregoing implementation manner.
  • the access device may also receive the HTML information that is actively sent by the management server.
  • the access device may obtain a JavaScript tag from the management server before receiving the HTTP traffic request sent by the terminal, or may obtain a JavaScript tag from the management server after receiving the HTTP traffic request sent by the terminal. That is, in the embodiment of the present invention, S301-S303 may be executed first, and then S701 may be executed; S701 may be executed first, and then S301-S303 may be executed.
  • the sequence in which S301-S303 and S701 are executed in the embodiment of the present invention is not limited.
  • the address of the management server and the address of the default portal server are included in the JavaScript tag, and the JavaScript tag is included in the HTML information as an example, and the terminal authentication provided by the embodiment of the present invention is given.
  • the method for terminal authentication provided by the embodiment of the present invention may be that an application (such as a browser) in the terminal can parse a JavaScript tag, and some applications cannot parse a JavaScript tag; therefore, only when the terminal is When an application can parse the JavaScript tag, the terminal may obtain the address of the portal server according to the JavaScript tag, and when the first application of the terminal cannot parse the JavaScript tag, the terminal cannot obtain the portal server according to the JavaScript tag. address. Therefore, according to the solution, even if the terminal initiates an HTTP traffic request to the access device by using the first application, and receives an HTTP traffic response including the JavaScript tag, if the terminal adopts the first application, the JavaScript tag cannot be used according to the JavaScript tag.
  • an application such as a browser
  • the terminal can perform authorization authentication of the terminal according to the address of the portal server with the lowest load, and can implement load balancing of each portal server.
  • each network element such as a terminal, an access device, a management server, etc.
  • each network element includes hardware structures and/or software modules corresponding to each function.
  • the present invention can be implemented in a combination of hardware or hardware and computer software in combination with the elements and algorithm steps of the various examples described in the embodiments disclosed herein. Whether a function is implemented in hardware or computer software to drive hardware depends on the specific application and design constraints of the solution. A person skilled in the art can use different methods for implementing the described functions for each particular application, but such implementation should not be considered to be beyond the scope of the present invention.
  • the embodiment of the present invention may divide a module into a terminal, an access device, and the like according to the foregoing method.
  • each module may be divided according to each function, or two or more functions may be integrated into one processing module.
  • the above integrated modules can be implemented in the form of hardware or in the form of software modules. It should be noted that the division of the module in the embodiment of the present invention is schematic, and is only a logical function division, and the actual implementation may have another division manner.
  • FIG. 8 is a schematic diagram showing a possible structure of a terminal involved in the above embodiment.
  • the terminal 800 includes a sending module 801, a receiving module 802, an obtaining module 803, and an authentication module 804.
  • the sending module 801 is configured to send a request message or data to the access device, the management server, and the portal server.
  • the sending module 801 can send an HTTP traffic request to the access device.
  • the sending module 801 is configured to support the terminal to perform S301 in any of the figures in FIG. 3-7, and S307 in FIG. 3, S403 in FIG. 4, FIG. 5, and FIG. 7, S404 in FIG.
  • the request message or data is sent to the access device.
  • the terminal sends a request message to the management server when acquiring the address of the portal server from the management server or Data, and/or other processes for the techniques described herein.
  • the receiving module 802 is configured to receive the response sent by the access device, the management server, and the portal server.
  • the receiving module 802 can be configured to receive an HTTP traffic response sent by the access device.
  • the receiving module 802 is configured to support the terminal to execute S305 in FIG. 3, FIG. 4, FIG. 5, FIG. 6, FIG. 7, and S307 in FIG. 3, S403 in FIG. 4, FIG. 5, and FIG. Receiving the response message or data sent by the access device when the terminal authorization authentication is performed in S404 in S602 and S602 in FIG. 6, when the terminal acquires the address of the portal server from the management server in S402 in FIG. 4, FIG. 5 and FIG. Receiving response messages or data sent by the management server, and/or other processes for the techniques described herein.
  • the obtaining module 803 is configured to obtain the address of the portal server according to the JavaScript tag by using the first application.
  • the obtaining module 803 is configured to support the terminal to execute S306 in FIG. 3, S401, S402 in FIG. 4, FIG. 5, S401', S402' in FIG. 5, S601 in FIG. 6, and/or for this document. Other processes of the described techniques.
  • the foregoing authentication module 804 is configured to perform authorization authentication of the terminal according to the address of the portal server acquired by the obtaining module 803.
  • the authentication module 804 is configured to support the terminal to perform S307 in FIG. 3, S403 in FIG. 4, S404 in FIG. 5, S602 in FIG. 6, and/or other processes for the techniques described herein.
  • the terminal 800 may further include a storage module for storing program codes and data of the terminal 800.
  • the transmitting module 801 and the receiving module 802 can be implemented by being integrated in one communication module, which can be a communication interface, a transceiver circuit or a transceiver, and the like.
  • the obtaining module 803 and the authentication module 804 can be implemented in one processing module.
  • the processing module can be a processor or a controller. For example, it can be a CPU, a general-purpose processor, or a digital signal processor (English: Digital Signal Processor, referred to as DSP). ), Application-Specific Integrated Circuit (ASIC), Field Programmable Gate Array (FPGA) or other programmable logic devices, transistor logic devices, hardware components or Any combination thereof.
  • the processing module can also be a combination of computing functions, such as one or more microprocessor combinations, a combination of a DSP and a microprocessor, and the like.
  • the storage module can be a memory.
  • the processing module is a processor
  • the communication module is a communication interface
  • the storage module is a memory
  • the terminal involved in the embodiment of the present invention may be the terminal 900 shown in FIG.
  • the terminal 900 includes a processor 901, a communication interface 902, a memory 903, and a bus 904.
  • the processor 901, the communication interface 902, and the memory 903 are connected to each other through a bus 904.
  • the bus 904 can be divided into an address bus, a data bus, a control bus, and the like. For ease of representation, only one thick line is shown in Figure 9, but it does not mean that there is only one bus or one type of bus.
  • the embodiment of the present invention further provides a computer storage medium, where the computer program code stores instructions, and the computer program code includes instructions.
  • the processor 901 of the terminal 900 executes the instruction, the terminal 900 executes as shown in FIG. 3 and 4.
  • FIG. 10 is a schematic diagram showing a possible structure of an access device involved in the foregoing embodiment.
  • the access device 1000 includes: a receiving module 1001, a determining module 1002, and a sending module 1003.
  • the receiving module 1001 is configured to receive a message or data sent by a device such as a terminal and a management server.
  • the receiving module 1001 may be configured to receive an HTTP traffic request sent by the terminal.
  • the receiving module 1001 is configured to support the access device to perform S302 in FIG. 3, FIG. 4, FIG. 5, FIG. 6, FIG. 7, S701 in FIG. 7, and/or other processes for the techniques described herein. .
  • the determining module 1002 is configured to determine that the terminal is an unauthorized terminal.
  • the determination module 1002 is configured to support an access device to perform S303 in FIGS. 3, 4, 5, 6, 7, and/or other processes for the techniques described herein.
  • the sending module 1003 is configured to send a message or data to a device such as a terminal and a management server.
  • the sending module 1003 may be configured to send an HTTP traffic response to the terminal.
  • the transmitting module 1003 is configured to support an access device to perform S304 in FIGS. 3, 4, 5, 6, and 7, and/or other processes for the techniques described herein.
  • the access device 1000 may further include a storage module for storing program codes and data of the access device 1000.
  • the receiving module 1001 and the transmitting module 1003 may be implemented by being integrated in one communication module, which may be a communication interface, a transceiver circuit or a transceiver, or the like.
  • the determining module 1002 can be implemented in a processing module, which can be a processor or a controller, such as a CPU, a general-purpose processor, a DSP, an ASIC, an FPGA or other programmable logic device, a transistor logic device, and a hardware component. Or any combination thereof. It is possible to implement or carry out the various illustrative logical blocks, modules and circuits described in connection with the present disclosure.
  • the processing module can also be a combination of computing functions, such as one or more microprocessor combinations, a combination of a DSP and a microprocessor, and the like.
  • the storage module can be a memory.
  • the access device involved in the embodiment of the present invention may be the access device 1100 shown in FIG.
  • the access device 1100 includes a processor 1101, a communication interface 1102, a memory 1103, and a bus 1104.
  • the processor 1101, the communication interface 1102, and the memory 1103 are connected to each other through a bus 1104.
  • the bus 1104 can be divided into an address bus, a data bus, a control bus, and the like. For ease of representation, only one thick line is shown in Figure 11, but it does not mean that there is only one bus or one type of bus.
  • the embodiment of the present invention further provides a computer storage medium, where the computer program code stores instructions, and the computer program code includes instructions.
  • the access device 1100 executes the instruction, the access device 1100 performs, for example, The related method steps in any of the figures in FIG. 3, FIG. 4, FIG. 5, FIG. 6, or FIG. 7 interact with the terminal and the management server to implement authorization authentication of the terminal.
  • FIG. 12 is a schematic diagram showing a possible structure of the management server involved in the above embodiment.
  • the management server 1200 includes a sending module 1201, a receiving module 1202, and an obtaining module 1203.
  • the sending module 1201 is configured to send a message or data to the access device or the terminal, for example, the sending module 1201 may be configured to send a JavaScript tag to the access device.
  • the sending module 1201 is configured to support the management server to execute S402 in FIG. 4, FIG. 5, FIG. 7, S701 in FIG. 7, and/or for the present application. Other processes of the techniques described herein.
  • the receiving module 1202 is configured to receive the authentication address request sent by the unauthorized terminal after the sending module 1201 sends the JavaScript tag to the access device.
  • the receiving module 1202 is configured to support the management server to perform S309 in FIG. 4, S309b in FIG. 5, FIG. 7, and/or other processes for the techniques described herein.
  • the obtaining module 1203 is configured to: after receiving the authentication address request sent by the unauthorized terminal, the receiving module 1202 obtains the least loaded portal server among the at least two portal servers managed by the management server according to the address of the management server included in the JavaScript tag. the address of.
  • the acquisition module 1203 is configured to support a management server to perform S402 in FIGS. 4, 5, 7, and/or other processes for the techniques described herein.
  • management server 1200 may further include a storage module for storing program codes and data of the management server 1200.
  • the transmitting module 1201 and the receiving module 1202 may be implemented by being integrated in one communication module, which may be a communication interface, a transceiver circuit or a transceiver, or the like.
  • the obtaining module 1203 can be implemented by being integrated in a processing module, which can be a processor or a controller, such as a CPU, a general-purpose processor, a DSP, an ASIC, an FPGA or other programmable logic device, a transistor logic device, and a hardware component. Or any combination thereof. It is possible to implement or carry out the various illustrative logical blocks, modules and circuits described in connection with the present disclosure.
  • the processing module can also be a combination of computing functions, such as one or more microprocessor combinations, a combination of a DSP and a microprocessor, and the like.
  • the storage module can be a memory.
  • the management server may be the management server 1300 shown in FIG.
  • the management server 1300 includes a processor 1301, a communication interface 1302, a memory 1303, and a bus 1304.
  • the processor 1301, the communication interface 1302, and the memory 1303 are mutually connected by a bus 1304.
  • the bus 1304 can be divided into an address bus, a data bus, a control bus, and the like. For ease of representation, only one thick line is shown in FIG. 13, but it does not mean that there is only one bus or one type of bus.
  • the embodiment of the present invention further provides a computer storage medium, where the computer program code stores instructions, and the computer program code includes instructions.
  • the management server 1300 executes as shown in FIG. 3.
  • the related method steps in any one of FIG. 4, FIG. 5, FIG. 6 or FIG. 7 interact with the terminal and the access device to implement authorization authentication of the terminal.
  • the steps of a method or algorithm described in connection with the present disclosure may be implemented in a hardware, or may be implemented by a processor executing software instructions.
  • the software instructions may be composed of corresponding software modules, which may be stored in a random access memory (RAM), a flash memory, a read only memory (ROM), an erasable programmable read only memory ( Erasable Programmable ROM (EPROM), electrically erasable programmable read only memory (EEPROM), registers, hard disk, removable hard disk, compact disk read only (CD-ROM) or any other form of storage medium known in the art.
  • An exemplary storage medium is coupled to the processor to enable the processor to Information is read from the storage medium and information can be written to the storage medium.
  • the storage medium can also be an integral part of the processor.
  • the processor and the storage medium may also exist as discrete components in the core network interface device.
  • the functions described herein can be implemented in hardware, software, firmware, or any combination thereof.
  • the functions may be stored in a computer readable medium or transmitted as one or more instructions or code on a computer readable medium.
  • Computer readable media includes both computer storage media and communication media including any medium that facilitates transfer of a computer program from one location to another.
  • a storage medium may be any available media that can be accessed by a general purpose or special purpose computer.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Power Engineering (AREA)
  • Multimedia (AREA)
  • Information Transfer Between Computers (AREA)

Abstract

本发明实施例提供一种终端认证的方法及设备，涉及通信技术领域，可以解决终端认证过程中，Portal服务器负载过高的问题。具体方案为：终端采用第一应用向接入设备发送HTTP流量请求；接收接入设备发送的包含JavaScript标签的HTTP流量响应；采用第一应用从该JavaScript标签中获取门户服务器的地址；根据该门户服务器的地址，进行该终端的授权认证。本发明实施例应用于终端进行授权认证的过程中。

Description

一种终端认证的方法及设备 技术领域
本发明涉及通信技术领域，尤其涉及一种终端认证的方法及设备。
背景技术
随着网络技术的发展，网络安全问题变得尤为突出。门户(英文：Portal)认证是一种可以有效保障网络安全的方法。其中，Portal认证是指终端需要获得Portal服务器的授权认证才可以访问网络数据。
具体的，Portal认证过程可以包括：接入设备在接收到未授权终端第一次发起的超文本传送协议(英文：Hypertext transfer protocol，简称：HTTP)流量请求时，向该终端返回携带有Portal服务器的统一资源定位符(英文：Uniform Resource Locator，简称：URL)地址的HTTP响应；终端根据该URL地址向Portal服务器发起HTTP认证页面请求，Portal服务器可以在与终端完成传输控制协议(英文：Transmission Control Protocol，简称：TCP)握手和安全套接层(英文：Secure Sockets Layer，简称：SSL)握手后，向终端返回包含待加载的HTTP认证页面的响应；终端根据该响应加载并显示HTTP认证页面，接收用户在HTTP认证页面输入的认证信息，并向Portal服务器发送该认证信息，进行授权认证。
上述HTTP流量请求可以为用户触发终端浏览器发起的有效流量请求，也可以为终端中除浏览器之外的其他应用程序自动发起的无效流量请求。其中，接入设备不能够识别上述有效流量请求和无效流量请求。那么，即使终端向接入设备发起的是无效流量请求，该终端还是可以获取到Portal服务器的URL地址，并执行“向Portal服务器发起HTTP认证页面请求，并完成上述TCP握手和SSL握手”操作。
但是，存在的问题是：针对上述无效流量请求而言，由于终端不能够通过应用程序加载并显示HTTP认证页面，因此无法完成上述授权认证；也就是说，终端在获取到Portal服务器的URL地址后执行的上述授权认证操作是没有结果的无效操作，这些没有结果的无效操作无疑会占用网络资源，增大Portal服务器的负载。
发明内容
本申请提供一种终端认证的方法及设备，可以减少终端认证过程中，无效流量请求对应的无效操作对网络资源的占用，降低Portal服务器的负载。
第一方面，提供了一种终端认证的方法。该终端认证的方法包括：终端向接入设备发送HTTP流量请求，该HTTP流量请求为通过该终端中的第一应用发起的流量请求；该终端接收该接入设备发送的HTTP流量响应，该HTTP流量响应为该接入设备确定该终端为未授权终端后发送的，该HTTP流量响应中包含JavaScript标签；若该终端采用上述第一应用，根据上述JavaScript标签获得门户服务器的地址，该终端根据该门户服务器的地址，进行该终端的授权认证。
由于终端中有的应用程序(如浏览器)是可以解析JavaScript标签的，而有的应 用程序是不能解析JavaScript标签的；因此，只有当该终端的第一应用能够解析上述JavaScript标签时，该终端才可能根据上述JavaScript标签获得门户服务器的地址，而当该终端的第一应用不能解析上述JavaScript标签时，该终端便不能根据上述JavaScript标签获得门户服务器的地址。由此可见，通过本方案，即使终端采用第一应用自发的向接入设备发起HTTP流量请求，并接收到包含JavaScript标签的HTTP流量响应；但是，如果终端采用该第一应用不能根据该JavaScript标签获得用于进行该终端授权认证的门户服务器的地址，该终端也不能执行“向门户服务器发起HTTP认证页面请求，并完成上述TCP握手和SSL握手”等没有结果的无效操作，如此便可以避免上述没有结果的无效操作对网络资源的占用，可以降低门户服务器的负载。
在第一方面的一种可能的实现方式中，上述JavaScript标签中可以包含管理服务器的地址。相应的，上述“终端采用第一应用，根据该JavaScript标签获得门户服务器的地址”的方法可以包括：该终端采用该第一应用，从该JavaScript标签中获得该管理服务器的地址，根据该管理服务器的地址，采用该第一应用执行异步直译式脚本语言及可扩展标记语言(英文：Asynchronous JavaScript And XML，简称：Ajax)脚本，从该管理服务器获取该管理服务器所管理的门户服务器中负载最低的门户服务器的地址。
终端采用第一应用获取上述JavaScript标签中包含的管理服务器的地址后，从该管理服务器的地址获得门户服务器的地址的方法可以包括：终端可以采用上述第一应用执行Ajax脚本，向上述管理服务器发送认证地址请求，该认证地址请求用于指示管理服务器获取其所管理的门户服务器中负载最低的门户服务器的地址；终端接收该管理服务器发送的认证地址响应，该认证地址响应中包含负载最低的门户服务器的地址。
由于管理服务器可以管理至少两个门户服务器，即有至少两个门户服务器可以为该终端提供认证服务，而上述至少两个门户服务器中的每一个门户服务器的负载可能并不相同，如有的门户服务器的负载较高，有的门户服务器的负载则比较低；因此，执行上述“根据该负载最低的门户服务器的地址，进行该终端的授权认证”，可以实现上述管理服务器所管理的门户服务器负载均衡。
在第一方面的一种可能的实现方式中，终端根据一个门户服务器的地址，进行该终端的授权认证，包括：该终端采用上述第一应用执行JavaScript脚本，根据该门户服务器的地址，重定向到该门户服务器的终端认证页面，进行该终端的授权认证。
终端获得上述一个门户服务器的地址后，“终端采用第一应用执行JavaScript脚本，根据该门户服务器的地址，重定向到该门户服务器的终端认证页面”的具体过程可以包括：终端采用第一应用向该门户服务器发起HTTP认证页面请求；执行JavaScript脚本，与该门户服务器完成TCP握手和SSL握手，并在接收到HTTP认证页面响应后，解析该HTTP认证页面响应中包含的HTTP认证页面的URL，根据该HTTP认证页面的URL，加载并显示该HTTP认证页面，并接收用户在HTTP认证页面输入的认证信息，再向门户服务器发送该认证信息，进行该终端的授权认证。需要说明的是，上述“通过执行JavaScript脚本，根据该门户服务器的地址，重定向到该门户服务器的终端认证页面”的过程是在终端采用第一应用在终端的后台进行的，在 上述第一应用的显示页面上进行一次页面跳转，就可以为用户显示上述HTTP认证页面，并接收用户输入的认证信息，完成授权认证。
可以想到的是，“通过执行JavaScript脚本，根据该门户服务器的地址，重定向到该门户服务器的终端认证页面”执行的过程中，不需要重新加载整个网页，而是对整个页面中为用户提供认证信息输入的部分页面进行更新。也就是说，执行JavaScript脚本，可以只加载部分页面，而非整个页面，如此可以减少向门户服务器请求的信息量，从而可以进一步降低门户服务器的负载。
在第一方面的一种可能的实现方式中，终端中的第一应用即使可以解析JavaScript标签获得管理服务器的地址，如浏览器可以解析JavaScript标签获得管理服务器的地址；但是，该浏览器也不一定支持Ajax，即可能会存在部分浏览器支持Ajax，部分浏览器不支持Ajax的情况。基于这种情况，本申请保护的终端认证的方法中，上述JavaScript标签中不仅可以包含管理服务器的地址，还可以包含默认门户服务器的地址。相应的，上述终端认证的方法还可以包括：若第一应用不支持Ajax，则采用该第一应用根据该默认门户服务器的地址，进行该终端的授权认证。
示例性的，以上述第一应用为浏览器为例，由于浏览器的版本和权限等因素，并非所有浏览器都支持Ajax。当第一应用(如浏览器)不支持Ajax时，即使该终端采用上述第一应用得到管理服务器的地址，也不能执行Ajax脚本，从上述管理服务器获得门户服务器的地址，也就不能进行“执行JavaScript脚本，根据该门户服务器的地址，重定向到该门户服务器的终端认证页面，进行该终端的授权认证”。在这种情况下，终端采用该第一应用虽然不能执行Ajax脚本，却可以执行JavaScript脚本，从而可以根据上述默认门户服务器的地址，执行JavaScript脚本，重定向到该默认门户服务器的终端认证页面，进行该终端的授权认证。因此，即使上述第一应用不支持Ajax，终端采用该第一应用发起HTTP流量请求后，也可以完成该终端的授权认证。
在第一方面的一种可能的实现方式中，上述HTTP流量响应中包含JavaScript标签，具体可以为：上述HTTP流量响应中包含超文本标记语言(英文：Hyper Text Markup Language，简称：HTML)信息，上述HTML信息中内嵌有JavaScript标签。其中，上述HTML信息可以携带需要加载的页面的相关信息。
在第一方面的一种可能的实现方式中，JavaScript标签中包含门户服务器列表，该门户服务器列表中包含至少一个门户服务器的地址。终端采用第一应用，根据该JavaScript标签获得门户服务器的地址的方法可以包括：终端采用上述第一应用，从该JavaScript标签中获得该门户服务器列表中包含的任意一个门户服务器的地址。
在第一方面的一种可能的实现方式中，上述至少一个门户服务器中每个门户服务器的负载可以是不同的，例如，上述至少一个门户服务器中有的门户服务器的负载较高，而有的门户服务器的负载则较低。可以想到的是，终端获得上述JavaScript标签中包含门户服务器列表之后，可以查询上述至少一个门户服务器中每个门户服务器的负载，并确定出上述至少一个门户服务器中负载最低的门户服务器。如此，终端便可以采用该第一应用，根据上述门户服务器列表中包含的负载最低的门户服务器的地址，进行该终端的授权认证，可以实现上述至少一个门户服务器的负载均衡。
第二方面，提供了一种终端认证的方法，包括：接入设备接收终端发送的HTTP 流量请求，该HTTP流量请求为该终端通过该终端中的第一应用发起的流量请求；若确定该终端为未授权终端，该接入设备向该终端发送HTTP流量响应，该HTTP流量响应中包含JavaScript标签，该JavaScript标签用于该终端获得门户服务器的地址，并根据该门户服务器的地址进行该终端的授权认证。
若第一应用不能解析JavaScript标签，即使接入设备在接收到终端发送的HTTP流量请求后，向终端发送包含JavaScript标签HTTP流量响应，该终端也不能采用第一应用根据该JavaScript标签获得门户服务器的地址，更不能进行终端的授权认证。也就是说，终端不会执行“向Portal服务器发起HTTP认证页面请求，并完成TCP握手和SSL握手”等没有结果的无效操作，如此便可以避免上述没有结果的无效操作对网络资源的占用，可以降低Portal服务器的负载。
在第二方面的一种可能的实现方式中，上述JavaScript标签中包含管理服务器的地址；或者，上述JavaScript标签中包含管理服务器的地址和默认门户服务器的地址；或者，上述JavaScript标签中包含门户服务器列表，该门户服务器列表中包含至少一个门户服务器的地址。
在第二方面的一种可能的实现方式中，上述HTTP流量响应中包含JavaScript标签，具体为：上述HTTP流量响应中包含HTML信息，该HTML信息中内嵌有上述JavaScript标签。在接入设备向终端发送的上述HTTP流量响应中包含上述HTML信息时，上述HTML信息中包含上述JavaScript标签，可以作为上述HTTP流量响应中包含上述JavaScript标签的一种方式。
在第二方面的一种可能的实现方式中，在接入设备向终端发送HTTP流量响应之前，该终端认证的方法还可以包括：接入设备接收管理服务器发送的JavaScript标签。其中，接入设备可以接收管理服务器发送的HTML信息，该HTML信息中包含JavaScript标签。示例性的，接入设备可以在接收到终端发送的HTTP流量请求后，向管理服务器发送HTML信息请求，接收管理服务器下发的包含JavaScript标签的HTML信息；或者，接入设备可以在开机启时便向管理服务器发送HTML信息请求，然后接收管理服务器下发的包含JavaScript标签的HTML信息。当然，接入设备还可以接收管理服务器主动下发的包含JavaScript标签的HTML信息。可以想到的是，接入设备在向终端发送HTTP流量响应之前接收到管理服务器下发的包含JavaScript标签的HTML信息，便可以向终端发送包含HTML信息的HTTP流量响应，即向终端发送包含JavaScript标签的HTTP流量响应。
第三方面，提供了一种终端认证的方法，包括：管理服务器向接入设备发送JavaScript标签。其中，该JavaScript标签用于终端获得门户服务器的地址，并根据该门户服务器的地址进行该终端的授权认证。
管理服务器可以向接入设备发送上述JavaScript标签，再由接入设备在接收到终端发送的HTTP流量请求后，向终端发送包含上述JavaScript标签的HTTP流量响应。此时，若第一应用不能解析JavaScript标签，即使终端接收到包含JavaScript标签HTTP流量响应，该终端也不能采用第一应用根据该JavaScript标签获得门户服务器的地址，更不能进行终端的授权认证。也就是说，终端不会执行“向Portal服务器发起HTTP认证页面请求，并完成TCP握手和SSL握手”等没有结果的无效操作，如 此便可以避免上述没有结果的无效操作对网络资源的占用，可以降低Portal服务器的负载。
在第三方面的一种可能的实现方式中，上述JavaScript标签中包含管理服务器的地址。在管理服务器向接入设备发送JavaScript标签之后，该终端认证的方法还可以包括：管理服务器接收终端发送的认证地址请求，获取该管理服务器所管理的门户服务器中负载最低的门户服务器的地址；该管理服务器向该终端发送认证地址响应，该认证地址响应中包含该负载最低的门户服务器的地址。由于管理服务器获取并发送给终端的是负载最低的门户服务器的地址，因此终端便可以与该负载最低的门户服务器交互进行终端的授权认证，可以实现上述至少两个门户服务器的负载均衡。
在第三方面的一种可能的实现方式中，终端中的第一应用即使可以解析JavaScript标签获得管理服务器的地址，如浏览器可以解析JavaScript标签获得管理服务器的地址；但是，该浏览器也不一定支持Ajax，即可能会存在部分浏览器支持Ajax，部分浏览器不支持Ajax的情况。基于这种情况，本申请保护的终端认证的方法中，上述JavaScript标签中不仅可以包含管理服务器的地址，还可以包含默认门户服务器的地址。
在第三方面的一种可能的实现方式中，上述JavaScript标签中包含门户服务器列表，该门户服务器列表中包含至少一个门户服务器的地址。
第四方面，提供了一种终端，该终端包括：发送模块、接收模块、获取模块和认证模块。其中，发送模块用于向接入设备发送HTTP流量请求，该HTTP流量请求为通过终端中的第一应用发起的流量请求；接收模块用于接收上述接入设备发送的HTTP流量响应，该HTTP流量响应为该接入设备确定终端为未授权终端后发送的，该HTTP流量响应中包含JavaScript标签；获取模块，用于采用上述第一应用，根据所述JavaScript标签获得门户服务器的地址；认证模块用于若上述获取模块采用上述第一应用根据该JavaScript标签获得该门户服务器的地址，则根据上述获取模块获取的该门户服务器的地址，进行该终端的授权认证。
在第四方面的一种可能的实现方式中，上述认证模块具体用于采用上述第一应用执行JavaScript脚本，以根据该门户服务器的地址，重定向到该门户服务器的终端认证页面，进行该终端的授权认证。
在第四方面的一种可能的实现方式中，上述JavaScript标签中包含管理服务器的地址；上述获取模块具体用于：采用上述第一应用，从该JavaScript标签中获得管理服务器的地址，根据该管理服务器的地址，采用该第一应用执行Ajax脚本，从该管理服务器获取该管理服务器所管理的门户服务器中负载最低的门户服务器的地址。
在第四方面的一种可能的实现方式中，上述认证模块还用于若上述第一应用不支持Ajax，则采用该第一应用根据默认门户服务器的地址，进行终端的授权认证。
在第四方面的一种可能的实现方式中，上述JavaScript标签中包含门户服务器列表，该门户服务器列表中包含至少一个门户服务器的地址；上述获取模块具体用于：采用上述第一应用，从该JavaScript标签中获得上述门户服务器列表中包含的任意一个门户服务器的地址。
在第四方面的一种可能的实现方式中，上述接收模块接收的上述HTTP流量响应 中包含JavaScript标签，具体为上述接收模块接收的上述HTTP流量响应中包含HTML信息，该HTML信息中内嵌有该JavaScript标签。
第五方面，提供一种终端，包括：处理器、存储器、总线和通信接口，处理器、存储器和通信接口通过总线相连。上述存储器用于存储计算机程序代码，该计算机程序代码包括指令，当终端的处理器执行指令时，终端执行如第一方面及其各种可能的实现方式的终端认证的方法。
第六方面，提供一种计算机存储介质，计算机存储介质中存储有计算机程序代码，计算机程序代码包括指令，当终端的处理器执行指令时，终端执行如第一方面及其各种可能的实现方式的终端认证的方法。
需要说明的是，上述第四方面和第五方面中终端中各个模块的详细描述和相应技术效果分析可参见上述第一方面及其各种可能的实现方式中的详细描述，本申请这里不再赘述。
第七方面,本申请提供了一种接入设备，该接入设备包括：接收模块、判断模块和发送模块；其中，接收模块用于接收终端发送的HTTP流量请求，该HTTP流量请求为该终端通过该终端中的第一应用发起的流量请求；确定模块用于确定该终端是否为未授权终端；发送模块用于向该终端发送HTTP流量请求，该HTTP流量响应中包含JavaScript标签，该JavaScript标签用于该终端获得门户服务器的地址，并根据该门户服务器的地址进行该终端的授权认证。
在第七方面的一种可能的实现方式中，上述发送模块发送的HTTP流量响应中包含JavaScript标签，具体为：上述发送模块发送的该HTTP流量响应中包含HTML信息，该HTML信息中内嵌有该JavaScript标签。
在第七方面的一种可能的实现方式中，上述接收模块，还用于在该发送模块向该终端发送该HTTP响应之前，接收该管理服务器下发的JavaScript标签。
第八方面，提供一种接入设备，包括：处理器、存储器、总线和通信接口，处理器、存储器和通信接口通过总线相连。上述存储器用于存储计算机程序代码，该计算机程序代码包括指令，当接入设备的处理器执行指令时，接入设备执行如第二方面及其各种可能的实现方式的终端认证的方法。
第九方面，提供一种计算机存储介质，计算机存储介质中存储有计算机程序代码，计算机程序代码包括指令，当接入设备的处理器执行指令时，接入设备执行如第二方面及其各种可能的实现方式的终端认证的方法。
需要说明的是，上述第八方面和第九方面中接入设备中各个模块的详细描述和相应技术效果分析可参见上述第二方面及其各种可能的实现方式中的详细描述，本申请这里不再赘述。
第十方面，本申请提供了一种管理服务器，该管理服务器包括：发送模块。具体用于向接入设备发送JavaScript标签；其中，该JavaScript标签用于终端获得门户服务器的地址，并根据该门户服务器的地址进行该终端的授权认证。
在第十方面的一种可能的实现方式中，上述JavaScript标签中包含管理服务器的地址，或者，上述JavaScript标签中包含管理服务器的地址和默认门户服务器的地址；上述管理服务器，还包括：接收模块和获取模块。接收模块用于在上述发送模块向接 入设备发送JavaScript标签之后，接收终端发送的认证地址请求；获取模块用于上述接收模块接收到终端发送的认证地址请求后，获取该管理服务器所管理的门户服务器中负载最低的门户服务器的地址；上述发送模块，还用于向该终端发送认证地址响应，该认证地址响应中包含该负载最低的门户服务器的地址。
在第十方面的一种可能的实现方式中，上述发送模块向接入设备发送的JavaScript标签中包含门户服务器列表，该门户服务器列表中包含至少一个门户服务器的地址。
第十一方面，提供一种管理服务器，包括：处理器、存储器、总线和通信接口，处理器、存储器和通信接口通过总线相连。上述存储器用于存储计算机程序代码，该计算机程序代码包括指令，当管理服务器的处理器执行指令时，管理服务器执行如第三方面及其各种可能的实现方式的终端认证的方法。
第十二方面，提供一种计算机存储介质，该计算机存储介质中存储有计算机程序代码，计算机程序代码包括指令，当管理服务器的处理器执行指令时，管理服务器执行如第三方面及其各种可能的实现方式的终端认证的方法。
需要说明的是，上述第十方面和第十一方面中管理服务器中各个模块的详细描述和相应技术效果分析可参见上述第三方面及其各种可能的实现方式中的详细描述，本申请这里不再赘述。
附图说明
为了更清楚地说明本申请中的技术方案，下面将对实施例所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本发明的一些实施例。
图1为本发明实施例提供的一种授权认证网络架构示意图；
图2为本发明实施例提供的另一种授权认证网络架构示意图；
图3为本发明实施例提供的一种终端认证的方法流程图；
图4为本发明实施例提供的另一种终端认证的方法流程图；
图5为本发明实施例提供的另一种终端认证的方法流程图；
图6为本发明实施例提供的另一种终端认证的方法流程图；
图7为本发明实施例提供的另一种终端认证的方法流程图；
图8为本发明实施例提供的终端的一种结构示意图；
图9为本发明实施例提供的终端的另一种结构示意图；
图10为本发明实施例提供的接入设备的一种结构示意图；
图11为本发明实施例提供的接入设备的另一种结构示意图；
图12为本发明实施例提供的管理服务器的另一种结构示意图；
图13为本发明实施例提供的管理服务器的另一种结构示意图。
具体实施方式
在本发明的描述中，除非另有说明，“至少两个”或“多个”的含义是指两个或两个以上。例如，至少两个终端是指两个或两个以上终端，多个门户服务器是指两个或两个以上门户服务器。
此外，本发明的描述中所提到的术语“包括”和“具有”以及它们的任何变形，意图在于覆盖不排他的包含。例如包含了一系列步骤或单元的过程、方法、系统、产品或设备没有限定于已列出的步骤或单元，而是可选地还包括其他没有列出的步骤或单元，或可选地还包括对于这些过程、方法、产品或设备固有的其它步骤或单元。
下面将结合本发明实施例中的附图，对本发明实施例中的技术方案进行详细地描述，显然，所描述的具体实施例仅仅是本发明实施例的一部分实施例，而不是全部实施例。
本发明实施例提供的一种终端认证的方法及设备可以应用于未授权终端进行授权认证，获取网络权限的过程中。
请参考图1，其示出了本发明实施例提供的一种授权认证网络架构示意图。如图1所示，该授权认证网络中包含至少两个门户服务器11、至少一个接入设备12、至少一个终端13和管理服务器14，该管理服务器14用于管理上述至少两个门户服务器11。
本发明实施例这里，以门户服务器11与一个接入设备12，以及一个终端13和一个管理服务器14之间交互实现终端的授权认证为例，对终端进行授权认证的方法进行举例说明：
其中，终端13，用于向接入设备12发起HTTP流量请求。接入设备12，用于在接收到终端13发起的HTTP流量请求后，如果确定该终端13为未授权终端，则向该终端13发送包含管理服务器14的地址的HTTP流量响应。终端13，用于根据管理服务器14的地址，从管理服务器14获取管理服务器14所管理的门户服务器11中一个门户服务器11的地址；并根据该门户服务器11的地址，进行该终端11的授权认证。
请参考图2，如图2所示，其示出了本发明实施例提供的另一种授权认证网络架构示意图。该授权认证网络中包含门户服务器11、至少一个接入设备12和至少一个终端13。
本发明实施例这里，以门户服务器11与一个接入设备12，以及一个终端13之间交互实现终端的授权认证为例，对终端进行授权认证的方法进行举例说明：
其中，终端13，用于向接入设备12发起HTTP流量请求。接入设备12，用于在接收到终端13发起的HTTP流量请求后，如果确定该终端13为未授权终端，则向该终端13发送包含门户服务器11的地址的HTTP流量响应；根据该门户服务器11的地址，进行该终端11的授权认证。
示例性的，上述接入设备12可以为交换机或防火墙等能够为终端提供网络接入服务的设备，本发明实施例图1和图3中仅以交换机为例对接入设备12与授权认证网络中的其他设备之间的交互流程进行说明。本发明实施例中的终端13可以为个人计算机(英文：Personal Computer，简称：PC)、手机、平板电脑、便携式计算机等终端设备。
本发明实施例中，如图1或图2所示的授权认证网络中的接入设备12向终端13发送的HTTP流量响应中包含JavaScript标签，未授权终端可以采用第一应用根据该JavaScript标签，获得门户服务器的地址，并根据该门户服务器的地址，进行终端的 授权认证。
本发明实施例提供的终端认证的方法中，可以基于“终端采用有的应用程序(如浏览器)是能够解析JavaScript标签的，而采用有的应用程序不能解析JavaScript标签”的原理，当第一应用不能解析JavaScript标签时，可以避免终端采用上述第一应用发起HTTP流量请求并接收到HTTP流量响应后，继续执行“向Portal服务器发起HTTP认证页面请求，并完成上述TCP握手和SSL握手”等没有结果的无效操作，如此便可以避免上述没有结果的无效操作对网络资源的占用，可以降低Portal服务器的负载。
下面结合附图，通过具体的实施例及其应用场景对本发明实施例提供的一种终端认证的方法及设备进行详细地说明：
本发明实施例提供一种终端认证的方法，如图3所示，该终端认证的方法包括S301-S307：
S301、终端向接入设备发送HTTP流量请求，该HTTP流量请求为通过终端中的第一应用发起的流量请求。
本发明实施例中的第一应用可以为能够解析JavaScript标签的应用程序，或者第一应用可以为不能解析JavaScript标签的应用程序。
例如，假设只有浏览器具备解析JavaScript标签的功能。当上述第一应用为浏览器时，终端采用该第一应用便可以解析JavaScript标签；当上述第一应用为终端上除浏览器之外的其他应用程序时，终端采用该第一应用不能解析JavaScript标签。上述浏览器可以为安装在终端中的微软浏览器(英文：Internet Explorer，简称：IE)或者非IE浏览器。
S302、接入设备接收终端发送的HTTP流量请求。
S303、接入设备判断该终端是否为未授权终端。
可以想到的是，本发明实施例中的HTTP流量请求可以为终端向业务服务器发起的业务请求。其中，上述业务服务器可以为基站，对应的业务请求可以为终端通过基站向另一终端发起的语音或者视频通信请求；或者，该业务服务器还可以为能够为终端提供其他网页资源的服务器，对应的业务请求可以为终端向该服务器发起的网页资源请求消息。
其中，向接入设备发起HTTP流量请求的终端可以为授权终端，也可以为未授权终端。接入设备在接收到一授权终端发起的HTTP流量请求后，则可以直接向对应的业务服务器转发该HTTP流量请求，使得上述业务服务器可以根据该HTTP流量请求为该终端提供相应的业务数据；接入设备在接收到一未授权终端发起的HTTP流量请求后，则需要向该未授权终端提供门户服务器的地址，使得该未授权终端与门户服务器交互进行终端的授权认证。
示例性的，接入设备可判断该终端是否为未授权终端的方法可以包括：接入设备在接收到一个终端发起的HTTP流量请求后，查询该接入设备中保存的授权终端的标识中是否包含该终端的标识；若该接入设备中保存的授权终端的标识中包含该终端的标识，接入设备则确定该终端为授权终端；若该接入设备中保存的授权终端的标识中不包含该终端的标识，接入设备则确定该终端为未授权终端。其中，上述终端的标识 可以为终端的网际协议(英文：Internet Protocol，简称：IP)地址，接入设备可以从接收到的HTTP流量请求中解析得到发送该HTTP流量请求的终端的IP地址。
接入设备判断该终端是否为未授权终端的方法包括但不限于上述的方法。例如，接入设备还可以在接收到一个终端发起的HTTP流量请求后，向认证服务器(如本发明实施例中的门户服务器)发起权限查询请求，该权限查询请求中包含该终端的标识，该权限查询请求用于指示该认证服务器查询该终端是否为授权终端；接入设备接收该认证服务器发送的权限查询响应，权限查询响应中包含该终端为授权终端或者未授权终端的指示信息。
具体的，若该终端为未授权终端，则继续执行S304；若该终端为授权终端，则接入设备向网络侧转发该HTTP流量请求。
S304、接入设备向终端发送HTTP流量响应，该HTTP流量响应中包含JavaScript标签。
其中，上述HTTP流量响应中包含JavaScript标签，具体可以为：上述HTTP流量响应中包含HTML信息，该HTML信息中内嵌有上述JavaScript标签。该JavaScript标签用于终端获得门户服务器的地址，并根据该门户服务器的地址进行该终端的授权认证。
示例性的，本发明实施例中，接入设备向终端发送的HTTP流量响应可以为HTTP200响应报文。上述HTTP流量响应中携带内嵌JavaScript标签的HTML信息的具体方式可以为HTTP 200响应报文的报文体为管理服务器下发的包含JavaScript标签的HTTP页面。
S305、终端接收接入设备发送的HTTP流量响应。
S306、终端采用第一应用根据JavaScript标签获得门户服务器的地址。
其中，上述第一应用可能是能够解析JavaScript标签的应用程序，也可能是不能解析JavaScript标签的应用程序。当上述第一应用能够解析JavaScript标签时，终端采用上述第一应用，可以根据该JavaScript标签获得门户服务器的地址；而当上述第一应用不能解析JavaScript标签时，终端采用上述第一应用，不能根据该JavaScript标签获得门户服务器的地址。即当终端采用第一应用根据该JavaScript标签获取门户服务器的地址会有两种结果：获取成功和获取失败。
可以想到的是，在终端根据上述JavaScript标签成功获得门户服务器的地址之后，便可以根据该门户服务器的地址，进行该终端的授权认证。具体的，该终端认证的方法还包括S307：
S307、终端根据门户服务器地址，进行终端的授权认证。
示例性的，上述终端根据门户服务器的地址，进行终端的授权认证的方法可以包括：终端采用第一应用执行JavaScript脚本，根据该门户服务器的地址向门户服务器发起HTTP认证页面请求；门户服务器与终端完成TCP握手和SSL握手后，向终端返回HTTP认证页面；终端加载并显示HTTP认证页面，接收用户在HTTP认证页面输入的认证信息，并向门户服务器发送该认证信息，进行授权认证。
本发明实施例这里，仅以第一应用为终端中的浏览器为例进行说明：目前大多数浏览器都是支持JavaScript的，即可以解析JavaScript并执行JavaScript脚本的。 本发明实施例保护的方案中，终端采用浏览器执行JavaScript脚本，不需要重新加载整个页面便可以与门户服务器交换数据，即在不刷新整个页面的情况下，可以产生局部刷新的效果。其中，终端重新加载部分页面相比于重新加载整个页面所需要的加载的数据较少，相对而言可以减少网络负载，缓解网络拥塞。也就是说，终端采用浏览器执行JavaScript脚本，可以降低进行授权认证的过程中出现网络拥塞问题的可能性。类似的，当第一应用能够解析JavaScript标签时，终端采用上述第一应用(可以是除浏览器之外，能够解析JavaScript标签的应用程序)执行JavaScript脚本，可以降低该终端进行授权认证的过程中出现网络拥塞问题的可能性。
本发明实施例提供的终端认证的方法中，由于终端中有的应用程序(如浏览器)是可以解析JavaScript标签的，而有的应用程序是不能解析JavaScript标签的；因此，只有当该终端的第一应用能够解析上述JavaScript标签时，该终端才可能根据上述JavaScript标签获得门户服务器的地址，而当该终端的第一应用不能解析上述JavaScript标签时，该终端便不能根据上述JavaScript标签获得门户服务器的地址。由此可见，通过本方案，即使终端采用第一应用自发的向接入设备发起HTTP流量请求，并接收到包含JavaScript标签的HTTP流量响应；但是，如果终端采用该第一应用不能根据该JavaScript标签获得用于进行该终端授权认证的门户服务器的地址，该终端也不能执行“向门户服务器发起HTTP认证页面请求，并完成上述TCP握手和SSL握手”等没有结果的无效操作，如此便可以避免上述没有结果的无效操作对网络资源的占用，可以降低门户服务器的负载。
在本发明实施例的第一种应用场景中，上述JavaScript标签中包含管理服务器的地址。在这种应用场景中，假设第一应用可以解析上述JavaScript标签，那么终端采用第一应用便可以得到上述管理服务器的地址。如图4所示，图3中的S306可以包括S401-S402，图3中的S307可以替换为S403：
S401、终端采用第一应用根据JavaScript标签获得管理服务器的地址。
S402、终端根据管理服务器的地址，采用第一应用执行Ajax脚本，从管理服务器获取一个门户服务器的地址。
其中，本发明实施例中，终端从管理服务器获取的一个门户服务器的地址可以为上述管理服务器所管理的至少两个门户服务器中的任一门户服务器。
可选的，终端根据管理服务器的地址，采用第一应用执行Ajax脚本，从管理服务器获取的门户服务器的地址可以为管理服务器所管理的至少两个门户服务器中负载最低的门户服务器。可以想到的是，管理服务器可以管理至少两个门户服务器，即有至少两个门户服务器可以为该终端提供认证服务，而每一个门户服务器的负载可能并不相同，如有的门户服务器的负载较高，有的门户服务器的负载则比较低。为了实现上述管理服务器管理的至少两个门户服务器的负载均衡，终端可以根据管理服务器的地址，从管理服务器获取其管理的门户服务器中负载最低的门户服务器的地址。
示例性的，管理服务器可以周期性的从该管理服务器管理的至少两个门户服务器获取该管理服务器管理的至少两个门户服务器的负载信息；或者，上述至少两个门户服务器中的每个门户服务器可以周期性的主动向管理服务器上报其负载信息。其中，上述负载信息用于指示门户服务器的负载的高低。
S403、终端根据从管理服务器获取的门户服务器的地址，进行终端的授权认证。
终端中的第一应用即使可以解析JavaScript标签获得管理服务器的地址，如浏览器可以解析JavaScript标签获得管理服务器的地址；但是，该浏览器也不一定支持Ajax，即可能会存在部分浏览器支持Ajax，部分浏览器不支持Ajax的情况。基于这种情况，本申请保护的终端认证的方法中，上述JavaScript标签中不仅可以包含管理服务器的地址，还可以包含默认门户服务器的地址。相应的，终端在采用第一应用根据JavaScript标签获得管理服务器的地址和默认门户服务器的地址之后，还可以先判断上述第一应用是否支持Ajax。如图5所示，图4中的S401可以替换为S401′，图4中的S402之前还可以包括S402′，在S402′之后还可以包括S404：
S401′、终端采用第一应用根据JavaScript标签获得管理服务器的地址和默认门户服务器的地址。
S402′、终端判断第一应用是否支持Ajax。
具体的，当终端判断上述第一应用支持Ajax时，可以根据从管理服务器获取的门户服务器的地址，进行终端的授权认证，即执行图5中的S402-S403；当终端判断上述第一应用不支持Ajax时，可以根据默认门户服务器的地址，进行终端的授权认证，即执行图5中的S404：
S404、终端根据默认门户服务器的地址，进行终端的授权认证。
本发明实施例中，若第一应用能够解析JavaScript标签，即使上述第一应用不支持Ajax，终端采用该第一应用不能执行Ajax脚本，不能根据管理服务器获得门户服务器地址；本发明实施例中终端也可以在根据该JavaScript标签获得的默认门户服务器的地址，重定向到默认门户服务器的终端认证页面，进行终端的授权认证。也就是说，无论发起HTTP流量请求的终端的上述第一应用是否支持Ajax，只要是终端采用上述第一应用发起HTTP流量请求的，该终端都能够完成上述授权认证。
在第二种应用场景中，上述JavaScript标签中包含门户服务器列表，该门户服务器列表中包含至少一个门户服务器的地址。在这种应用场景中，如果终端采用第一应用可以解析JavaScript标签，便可以根据上述JavaScript标签获得至少一个门户服务器的地址。如图6所示，图3的S306可以替换为S601，图3的S307可以替换为S602：
S601、终端采用第一应用根据JavaScript标签获得门户服务器列表中包含的任意一个门户服务器的地址。
S602、终端根据门户服务器列表中包含的任意一个门户服务器的地址，进行终端的授权认证。
示例性的，本发明实施例中终端进行授权认证的门户服务器可以为上述门户服务器列表中包含的至少一个门户服务器中的任意一个门户服务器，或者可以为上述门户服务器列表中包含的至少一个门户服务器中负载最低的门户服务器。
可选的，上述JavaScript标签可以为预先配置在接入设备中的；当然，上述JavaScript标签也可以为接入设备从管理服务器侧获取的。即在图3-图6中的任一附图中的S304之前，本发明实施例的方法还可以包括S701。如图7所示，本发明实施例这里以图5中的S304之前，本发明实施例的方法还可以包括S701为例，对本 发明实施例提供的终端认证的方法进行举例说明：
S701、接入设备从管理服务器获取JavaScript标签。
示例性的，接入设备从管理服务器获取JavaScript标签的方法可以包括：接入设备接收管理服务器发送的HTML信息，该HTML信息中内嵌有JavaScript标签。具体的，接入设备可以在接收到终端发送的HTTP流量请求后，向管理服务器发送HTML信息请求，然后接收管理服务器下发的HTML信息；或者，接入设备可以在开机时便向管理服务器发送HTML信息请求，然后接收管理服务器下发的HTML信息。当然，接入设备还可以接收管理服务器主动下发的HTML信息。其中，接入设备在向终端发送HTTP流量响应之前接收到管理服务器下发的HTML信息，便可以向终端发送包含内嵌JavaScript标签的HTML信息的HTTP流量响应，即向终端发送包含JavaScript标签的HTTP流量响应。
为了避免接入设备在每接收到终端发送的一个HTTP流量请求后，便向管理服务器发送HTML信息请求；该接入设备可以在接收到HTTP流量请求后，先判断该接入设备中是否保存有HTML信息，如果该接入设备中没有保存HTML信息，则向管理服务器发送HTML信息请求，从管理服务器获取并保存HTML信息，如果该接入设备中保存有HTML信息，则直接向终端返回包含该接入设备中保存的HTML信息的HTTP流量响应。
接入设备从管理服务器获取HTML信息的方法以及时机包括但不限于上述实现方式中所列举的方法及时机，如接入设备还可以接收管理服务器主动下发的HTML信息。
接入设备可以在接收到终端发送的HTTP流量请求之前，从管理服务器获取JavaScript标签，也可以在接收到终端发送的HTTP流量请求之后从管理服务器获取JavaScript标签。即本发明实施例中可以先执行S301-S303，再执行S701；也可以先执行S701，再执行S301-S303。本发明实施例对S301-S303和S701执行的先后顺序不做限制。
示例性的，本发明实施例这里，以JavaScript标签中包含管理服务器的地址和默认门户服务器的地址，该JavaScript标签包含于HTML信息中为例，给出用于实现本发明实施例提供的终端认证的方法的代码实例：
Figure PCTCN2017088231-appb-000001
Figure PCTCN2017088231-appb-000002
Figure PCTCN2017088231-appb-000003
上述代码段中两个“//”中间的文字为对其所在代码段的解析。
本发明实施例提供的终端认证的方法，由于终端中有的应用程序(如浏览器)是可以解析JavaScript标签的，而有的应用程序是不能解析JavaScript标签的；因此，只有当该终端的第一应用能够解析上述JavaScript标签时，该终端才可能根据上述JavaScript标签获得门户服务器的地址，而当该终端的第一应用不能解析上述JavaScript标签时，该终端便不能根据上述JavaScript标签获得门户服务器的地址。由此可见，通过本方案，即使终端采用第一应用自发的向接入设备发起HTTP流量请求，并接收到包含JavaScript标签的HTTP流量响应；但是，如果终端采用该第一应用不能根据该JavaScript标签获得用于进行该终端授权认证的门户服务器的地址，该终端也不能执行“向门户服务器发起HTTP认证页面请求，并完成上述TCP握手和SSL握手”等没有结果的无效操作，如此便可以避免上述没有结果的无效操作对网络资源的占用，可以降低门户服务器的负载。
进一步的，终端可以根据负载最低的门户服务器的地址，进行该终端的授权认证，可以实现各个门户服务器负载均衡。
上述主要从各个网元之间交互的角度对本发明实施例提供的方案进行了介绍。可以理解的是，各个网元，例如终端、接入设备和管理服务器等为了实现上述功能，其包含了执行各个功能相应的硬件结构和/或软件模块。本领域技术人员应该很容易意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，本发明能够以硬件或硬件和计算机软件的结合形式来实现。某个功能究竟以硬件还是计算机软件驱动硬件的方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用使用不同方法来实现所描述的功能，但是这种实现不应认为超出本发明的范围。
本发明实施例可以根据上述方法示例对终端、接入设备等进行模块的划分，例如，可以对应各个功能划分各个模块，也可以将两个或两个以上的功能集成在一个处理模块中。上述集成的模块既可以采用硬件的形式实现，也可以采用软件模块的形式实现。需要说明的是，本发明实施例中对模块的划分是示意性的，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式。
图8示出了上述实施例中所涉及的终端的一种可能的结构示意图。如图8所示，终端800包括：发送模块801、接收模块802、获取模块803和认证模块804。
其中，上述发送模块801，用于向接入设备、管理服务器、门户服务器发送请求消息或者数据，如发送模块801可以向接入设备发送HTTP流量请求。例如，发送模块801用于支持终端执行图3-图7中任一附图中的S301，以及图3中的S307、图4、图5和图7中的S403、图5中的S404、图6中的S602中进行终端授权认证时，向接入设备发送请求消息或者数据，图4、图5和图7中的S402中终端从管理服务器获取门户服务器的地址时向管理服务器发送请求消息或者数据，和/或用于本文所描述的技术的其它过程。
上述接收模块802，用于接收接入设备、管理服务器、门户服务器发送的响应消 息或者数据，例如，接收模块802可以用于接收接入设备发送的HTTP流量响应。例如，该接收模块802用于支持终端执行图3、图4、图5、图6、图7中的S305，以及图3中的S307、图4、图5和图7中的S403、图5中的S404、图6中的S602中进行终端授权认证时，接收接入设备发送的响应消息或者数据，图4、图5和图7中的S402中终端从管理服务器获取门户服务器的地址时，接收管理服务器发送的响应消息或者数据，和/或用于本文所描述的技术的其它过程。
上述获取模块803，用于采用第一应用根据JavaScript标签获得门户服务器的地址。例如，该获取模块803用于支持终端执行图3中的S306，图4、图5中的S401、S402，图5中的S401′、S402′，图6中的S601，和/或用于本文所描述的技术的其它过程。
上述认证模块804，用于根据上述获取模块803获取的门户服务器的地址，进行终端的授权认证。例如，该认证模块804用于支持终端执行图3中的S307，图4中的S403，图5中的S404，图6中的S602，和/或用于本文所描述的技术的其它过程。
进一步的，终端800还可以包括存储模块，用于存储终端800的程序代码和数据。
在采用集成的模块的情况下，发送模块801和接收模块802可以集成在一个通信模块中实现，该通信模块可以是通信接口、收发电路或收发器等。获取模块803和认证模块804可以集成在一个处理模块中实现，该处理模块可以是处理器或控制器，例如可以是CPU，通用处理器，数字信号处理器(英文：Digital Signal Processor，简称：DSP)，专用集成电路(英文：Application-Specific Integrated Circuit，简称：ASIC)，现场可编程门阵列(英文：Field Programmable Gate Array，简称：FPGA)或者其他可编程逻辑器件、晶体管逻辑器件、硬件部件或者其任意组合。其可以实现或执行结合本发明公开内容所描述的各种举例说明逻辑方框，模块和电路。处理模块也可以是实现计算功能的组合，例如包含一个或多个微处理器组合，DSP和微处理器的组合等等。存储模块可以是存储器。
当处理模块为处理器，通信模块为通信接口，存储模块为存储器时，本发明实施例所涉及的终端可以为图9所示的终端900。
参阅图9，终端900包括：处理器901、通信接口902、存储器903以及总线904。其中，处理器901、通信接口902、存储器903通过总线904相互连接。其中，总线904可以分为地址总线、数据总线、控制总线等。为便于表示，图9中仅用一条粗线表示，但并不表示仅有一根总线或一种类型的总线。
本发明实施例还提供一种计算机存储介质，该计算机存储介质中存储有计算机程序代码，该计算机程序代码包括指令，当终端900的处理器901执行该指令时，终端900执行如图3、图4、图5、图6或图7中任一附图中的相关方法步骤，与接入设备和管理服务器交互实现终端的授权认证。
本发明实施例提供的终端中各个模块或者模块的详细描述以及各个功能单元或者模块执行如图3、图4、图5、图6或图7任一附图中的相关方法步骤后所带来的技术效果可以参考本发明方法实施例中的相关描述，此处不再赘述。
图10示出了上述实施例中所涉及的接入设备的一种可能的结构示意图。如图10所示，接入设备1000包括：接收模块1001、确定模块1002、发送模块1003。
其中，上述接收模块1001，用于接收终端和管理服务器等设备发送的消息或者数据，如接收模块1001可以用于接收终端发送的HTTP流量请求。例如，该接收模块1001用于支持接入设备执行图3、图4、图5、图6、图7中的S302，图7中的S701，和/或用于本文所描述的技术的其它过程。
上述确定模块1002，用于确定终端为未授权终端。例如，该确定模块1002用于支持接入设备执行图3、图4、图5、图6、图7中的S303，和/或用于本文所描述的技术的其它过程。
上述发送模块1003，用于向终端和管理服务器等设备发送消息或者数据，如发送模块1003可以用于向终端发送HTTP流量响应。例如，该发送模块1003用于支持接入设备执行图3、图4、图5、图6和图7中的S304，和/或用于本文所描述的技术的其它过程。
进一步的，接入设备1000还可以包括存储模块，用于存储接入设备1000的程序代码和数据。
在采用集成的模块的情况下，接收模块1001和发送模块1003可以集成在一个通信模块中实现，该通信模块可以是通信接口、收发电路或收发器等。确定模块1002可以集成在一个处理模块中实现，该处理模块可以是处理器或控制器，例如可以是CPU，通用处理器，DSP，ASIC，FPGA或者其他可编程逻辑器件、晶体管逻辑器件、硬件部件或者其任意组合。其可以实现或执行结合本发明公开内容所描述的各种举例说明逻辑方框，模块和电路。处理模块也可以是实现计算功能的组合，例如包含一个或多个微处理器组合，DSP和微处理器的组合等等。存储模块可以是存储器。
当处理模块为处理器，通信模块为通信接口，存储模块为存储器时，本发明实施例所涉及的接入设备可以为图11所示的接入设备1100。
参阅图11，接入设备1100包括：处理器1101、通信接口1102、存储器1103以及总线1104。其中，处理器1101、通信接口1102、存储器1103通过总线1104相互连接。其中，总线1104可以分为地址总线、数据总线、控制总线等。为便于表示，图11中仅用一条粗线表示，但并不表示仅有一根总线或一种类型的总线。
本发明实施例还提供一种计算机存储介质，该计算机存储介质中存储有计算机程序代码，该计算机程序代码包括指令，当接入设备1100的处理器1101执行该指令时，接入设备1100执行如图3、图4、图5、图6或图7中任一附图中的相关方法步骤，与终端和管理服务器交互实现终端的授权认证。
需要说明的是，本发明实施例提供的接入设备中各个功能单元或者模块的详细描述以及各个功能单元或者模块执行如图3、图4、图5、图6或图7任一附图中的相关方法步骤后所带来的技术效果可以参考本发明方法实施例中的相关描述，此处不再赘述。
图12示出了上述实施例中所涉及的管理服务器的一种可能的结构示意图。如图12所示，管理服务器1200包括：发送模块1201、接收模块1202和获取模块1203。
其中，上述发送模块1201，用于向接入设备或者终端发送消息或者数据，如发送模块1201可以用于向接入设备发送JavaScript标签。例如，该发送模块1201用于支持管理服务器执行图4中、图5、图7中的S402，图7中的S701，和/或用于本 文所描述的技术的其它过程。
上述接收模块1202，用于上述发送模块1201向接入设备发送JavaScript标签之后，接收未授权终端发送的认证地址请求。例如，接收模块1202用于支持管理服务器执行图4中的S309、图5、图7中的S309b，和/或用于本文所描述的技术的其它过程。
上述获取模块1203，用于上述接收模块1202接收到未授权终端发送的认证地址请求后，根据JavaScript标签中包含的管理服务器的地址，获取管理服务器管理的至少两个门户服务器中负载最低的门户服务器的地址。例如，该获取模块1203用于支持管理服务器执行图4、图5、图7中的S402，和/或用于本文所描述的技术的其它过程。
进一步的，管理服务器1200还可以包括存储模块，用于存储管理服务器1200的程序代码和数据。
在采用集成的模块的情况下，发送模块1201和接收模块1202可以集成在一个通信模块中实现，该通信模块可以是通信接口、收发电路或收发器等。获取模块1203可以集成在一个处理模块中实现，该处理模块可以是处理器或控制器，例如可以是CPU，通用处理器，DSP，ASIC，FPGA或者其他可编程逻辑器件、晶体管逻辑器件、硬件部件或者其任意组合。其可以实现或执行结合本发明公开内容所描述的各种举例说明逻辑方框，模块和电路。处理模块也可以是实现计算功能的组合，例如包含一个或多个微处理器组合，DSP和微处理器的组合等等。存储模块可以是存储器。
当处理模块为处理器，通信模块为通信接口，存储模块为存储器时，本发明实施例所涉及的管理服务器可以为图13所示的管理服务器1300。
参阅图13，管理服务器1300包括：处理器1301、通信接口1302、存储器1303以及总线1304。其中，处理器1301、通信接口1302、存储器1303通过总线1304相互连接。其中，总线1304可以分为地址总线、数据总线、控制总线等。为便于表示，图13中仅用一条粗线表示，但并不表示仅有一根总线或一种类型的总线。
本发明实施例还提供一种计算机存储介质，该计算机存储介质中存储有计算机程序代码，该计算机程序代码包括指令，当管理服务器1300的处理器1301执行该指令时，管理服务器1300执行如图3、图4、图5、图6或图7中任一附图中的相关方法步骤，与终端和接入设备交互实现终端的授权认证。
本发明实施例提供的管理服务器中各个功能单元或者模块的详细描述以及各个功能单元或者模块执行如图3、图4、图5、图6或图7任一附图中的相关方法步骤后所带来的技术效果可以参考本发明方法实施例中的相关描述，此处不再赘述。
结合本发明公开内容所描述的方法或者算法的步骤可以硬件的方式来实现，也可以是由处理器执行软件指令的方式来实现。软件指令可以由相应的软件模块组成，软件模块可以被存放于随机存取存储器(Random Access Memory，RAM)、闪存、只读存储器(Read Only Memory，ROM)、可擦除可编程只读存储器(Erasable Programmable ROM，EPROM)、电可擦可编程只读存储器(Electrically EPROM，EEPROM)、寄存器、硬盘、移动硬盘、只读光盘(CD-ROM)或者本领域熟知的任何其它形式的存储介质中。一种示例性的存储介质耦合至处理器，从而使处理器能够 从该存储介质读取信息，且可向该存储介质写入信息。当然，存储介质也可以是处理器的组成部分。当然，处理器和存储介质也可以作为分立组件存在于核心网接口设备中。
本领域技术人员应该可以意识到，在上述一个或多个示例中，本发明所描述的功能可以用硬件、软件、固件或它们的任意组合来实现。当使用软件实现时，可以将这些功能存储在计算机可读介质中或者作为计算机可读介质上的一个或多个指令或代码进行传输。计算机可读介质包括计算机存储介质和通信介质，其中通信介质包括便于从一个地方向另一个地方传送计算机程序的任何介质。存储介质可以是通用或专用计算机能够存取的任何可用介质。
以上的具体实施方式，对本发明的目的、技术方案和有益效果进行了进一步详细说明，所应理解的是，以上仅为本发明的具体实施方式而已，并不用于限定本发明的保护范围，凡在本发明的技术方案的基础之上，所做的任何修改、等同替换、改进等，均应包括在本发明的保护范围之内。

Claims (14)

  1. 一种终端认证的方法，其特征在于，包括：
    终端向接入设备发送超文本传送协议HTTP流量请求，所述HTTP流量请求为通过所述终端中的第一应用发起的流量请求；
    所述终端接收所述接入设备发送的HTTP流量响应，所述HTTP流量响应为所述接入设备确定所述终端为未授权终端后发送的，所述HTTP流量响应中包含JavaScript标签；
    若所述终端采用所述第一应用，根据所述JavaScript标签获得门户服务器的地址，所述终端根据所述门户服务器的地址，进行所述终端的授权认证。
  2. 根据权利要求1所述的方法，其特征在于，所述JavaScript标签中包含管理服务器的地址；
    所述终端采用所述第一应用，根据所述JavaScript标签获得门户服务器的地址，包括：
    所述终端采用所述第一应用，从所述JavaScript标签中获得所述管理服务器的地址，根据所述管理服务器的地址，采用所述第一应用执行Ajax脚本，从所述管理服务器获取所述管理服务器所管理的门户服务器中负载最低的门户服务器的地址。
  3. 根据权利要求2所述的方法，其特征在于，所述JavaScript标签中还包含默认门户服务器的地址；
    所述方法还包括：
    若所述第一应用不支持Ajax，则采用所述第一应用根据所述默认门户服务器的地址，进行所述终端的授权认证。
  4. 根据权利要求1所述的方法，其特征在于，所述JavaScript标签中包含门户服务器列表，所述门户服务器列表中包含至少一个门户服务器的地址；
    所述终端采用所述第一应用，根据所述JavaScript标签获得门户服务器的地址，包括：
    所述终端采用所述第一应用，从所述JavaScript标签中获得所述门户服务器列表中包含的任意一个门户服务器的地址。
  5. 根据权利要求1至4任一项所述的方法，其特征在于，所述终端根据所述门户服务器的地址，进行该终端的授权认证，包括：
    所述终端采用所述第一应用执行JavaScript脚本，根据所述门户服务器的地址，重定向到所述门户服务器的终端认证页面，进行所述终端的授权认证。
  6. 根据权利要求5所述的方法，其特征在于，所述终端采用所述第一应用执行JavaScript脚本，根据所述门户服务器的地址，重定向到所述门户服务器的终端认证页面，进行所述终端的授权认证，包括：
    所述终端采用所述第一应用向所述门户服务器发起HTTP认证页面请求；执行所述JavaScript脚本，与所述门户服务器完成传输控制协议TCP握手和安全套接层SSL握手，并在接收到HTTP认证页面响应后，解析所述HTTP认证页面响应中包含的HTTP认证页面的统一资源定位符URL，根据所述URL，加载并显示所述HTTP认证页面，并接收用户在所述HTTP认证页面输入的认证信息，再向所述门户服务器发送 所述认证信息，进行所述终端的授权认证。
  7. 一种终端认证的方法，其特征在于，包括：
    接入设备接收终端发送的超文本传送协议HTTP流量请求，所述HTTP流量请求为所述终端通过所述终端中的第一应用发起的流量请求；
    若确定所述终端为未授权终端，所述接入设备向所述终端发送HTTP流量响应，所述HTTP流量响应中包含JavaScript标签，所述JavaScript标签用于所述终端获得门户服务器的地址，并根据所述门户服务器的地址进行所述终端的授权认证。
  8. 根据权利要求7所述的方法，其特征在于，所述JavaScript标签中包含管理服务器的地址；或者，所述JavaScript标签中包含管理服务器的地址和默认门户服务器的地址；或者，所述JavaScript标签中包含门户服务器列表，所述门户服务器列表中包含至少一个门户服务器的地址。
  9. 一种终端，其特征在于，包括：
    发送模块，用于向接入设备发送超文本传送协议HTTP流量请求，所述HTTP流量请求为通过所述终端中的第一应用发起的流量请求；
    接收模块，用于接收所述接入设备发送的HTTP流量响应，所述HTTP流量响应为所述接入设备确定所述终端为未授权终端后发送的，所述HTTP流量响应中包含JavaScript标签；
    获取模块，用于采用所述第一应用，根据所述JavaScript标签获得门户服务器的地址；
    认证模块，用于若所述获取模块采用所述第一应用根据所述JavaScript标签获得所述门户服务器的地址，则根据所述获取模块获取的所述门户服务器的地址，进行所述终端的授权认证。
  10. 根据权利要求9所述的终端，其特征在于，所述JavaScript标签中包含管理服务器的地址；
    所述获取模块，具体用于：
    采用所述第一应用，从所述JavaScript标签中获得所述管理服务器的地址，根据所述管理服务器的地址，采用所述第一应用执行Ajax脚本，从所述管理服务器获取所述管理服务器所管理的门户服务器中负载最低的门户服务器的地址。
  11. 根据权利要求10所述的终端，其特征在于，所述认证模块，还用于若所述第一应用不支持Ajax，则采用所述第一应用根据所述默认门户服务器的地址，进行所述终端的授权认证。
  12. 根据权利要求9所述的终端，其特征在于，所述JavaScript标签中包含门户服务器列表，所述门户服务器列表中包含至少一个门户服务器的地址；
    所述获取模块，具体用于：
    采用所述第一应用，从所述JavaScript标签中获得所述门户服务器列表中包含的任意一个门户服务器的地址。
  13. 一种接入设备，其特征在于，包括：
    接收模块，用于接收终端发送的HTTP流量请求，所述HTTP流量请求为所述终端通过所述终端中的第一应用发起的流量请求；
    确定模块，用于确定所述终端为未授权终端；
    发送模块，用于向所述终端发送HTTP流量响应，所述HTTP流量响应中包含JavaScript标签，所述JavaScript标签用于所述终端获得门户服务器的地址，并根据所述门户服务器的地址进行所述终端的授权认证。
  14. 根据权利要求13所述的接入设备，其特征在于，
    所述JavaScript标签中包含管理服务器的地址；
    或者，所述JavaScript标签中包含管理服务器的地址和默认门户服务器的地址；
    或者，所述JavaScript标签中包含门户服务器列表，所述门户服务器列表中包含至少一个门户服务器的地址。
PCT/CN2017/088231 2016-10-25 2017-06-14 一种终端认证的方法及设备 WO2018076712A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP17865053.7A EP3525411B1 (en) 2016-10-25 2017-06-14 Terminal authentication method and device
US16/392,157 US10701073B2 (en) 2016-10-25 2019-04-23 Terminal authentication method and device

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201610940602.4A CN107979577B (zh) 2016-10-25 2016-10-25 一种终端认证的方法及设备
CN201610940602.4 2016-10-25

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US16/392,157 Continuation US10701073B2 (en) 2016-10-25 2019-04-23 Terminal authentication method and device

Publications (1)

Publication Number Publication Date
WO2018076712A1 true WO2018076712A1 (zh) 2018-05-03

Family

ID=62005033

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/088231 WO2018076712A1 (zh) 2016-10-25 2017-06-14 一种终端认证的方法及设备

Country Status (4)

Country Link
US (1) US10701073B2 (zh)
EP (1) EP3525411B1 (zh)
CN (1) CN107979577B (zh)
WO (1) WO2018076712A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109698832A (zh) * 2018-12-28 2019-04-30 杭州迪普科技股份有限公司 快速提供Portal认证、快速弹出Portal认证页面的方法及相关设备
CN114285900A (zh) * 2021-12-09 2022-04-05 中国联合网络通信集团有限公司 调度系统、认证方法、调度方法、装置、服务器及介质

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113760533A (zh) * 2021-02-05 2021-12-07 北京沃东天骏信息技术有限公司 一种业务处理方法和装置
CN113344567B (zh) * 2021-06-23 2023-03-24 支付宝（中国）网络技术有限公司 一种聚合码的支付页面的访问方法、装置、设备及介质

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20040068665A1 (en) * 1998-04-30 2004-04-08 Openwave Systems Inc. Method and apparatus for maintaining security in a push server
CN103220345A (zh) * 2013-03-29 2013-07-24 中兴通讯股份有限公司 门户设备管理方法以及门户设备和系统
CN105871853A (zh) * 2016-04-11 2016-08-17 上海斐讯数据通信技术有限公司 一种入口认证方法和系统

Family Cites Families (14)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6584505B1 (en) * 1999-07-08 2003-06-24 Microsoft Corporation Authenticating access to a network server without communicating login information through the network server
US6678731B1 (en) * 1999-07-08 2004-01-13 Microsoft Corporation Controlling access to a network server using an authentication ticket
US7251827B1 (en) * 2002-05-01 2007-07-31 Microsoft Corporation In-line sign in
US8370732B2 (en) * 2006-10-20 2013-02-05 Mixpo Portfolio Broadcasting, Inc. Peer-to-portal media broadcasting
GB2449510A (en) * 2007-05-24 2008-11-26 Asim Bucuk A method and system for the creation, management and authentication of links between people, entities, objects and devices
US7933946B2 (en) * 2007-06-22 2011-04-26 Microsoft Corporation Detecting data propagation in a distributed system
US8347405B2 (en) * 2007-12-27 2013-01-01 International Business Machines Corporation Asynchronous java script and XML (AJAX) form-based authentication using java 2 platform enterprise edition (J2EE)
US8782755B2 (en) * 2009-03-20 2014-07-15 Citrix Systems, Inc. Systems and methods for selecting an authentication virtual server from a plurality of virtual servers
US20130080635A1 (en) * 2011-09-23 2013-03-28 Loyal3 Holdings, Inc. Massively Scalable Electronic Gating System
US20150281225A1 (en) * 2014-03-27 2015-10-01 Microsoft Corporation Techniques to operate a service with machine generated authentication tokens
WO2016022693A1 (en) * 2014-08-05 2016-02-11 Moxie Software, Inc. Systems and methods for client-side contextual engagement
GB201415860D0 (en) * 2014-09-08 2014-10-22 User Replay Ltd Systems and methods for recording and recreating interactive user-sessions involving an on-line server
US9148408B1 (en) * 2014-10-06 2015-09-29 Cryptzone North America, Inc. Systems and methods for protecting network devices
US9825928B2 (en) * 2014-10-22 2017-11-21 Radware, Ltd. Techniques for optimizing authentication challenges for detection of malicious attacks

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20040068665A1 (en) * 1998-04-30 2004-04-08 Openwave Systems Inc. Method and apparatus for maintaining security in a push server
CN103220345A (zh) * 2013-03-29 2013-07-24 中兴通讯股份有限公司 门户设备管理方法以及门户设备和系统
CN105871853A (zh) * 2016-04-11 2016-08-17 上海斐讯数据通信技术有限公司 一种入口认证方法和系统

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3525411A4 *

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109698832A (zh) * 2018-12-28 2019-04-30 杭州迪普科技股份有限公司 快速提供Portal认证、快速弹出Portal认证页面的方法及相关设备
CN114285900A (zh) * 2021-12-09 2022-04-05 中国联合网络通信集团有限公司 调度系统、认证方法、调度方法、装置、服务器及介质
CN114285900B (zh) * 2021-12-09 2023-10-03 中国联合网络通信集团有限公司 调度系统、认证方法、调度方法、装置、服务器及介质

Also Published As

Publication number Publication date
US20190253418A1 (en) 2019-08-15
CN107979577A (zh) 2018-05-01
CN107979577B (zh) 2021-10-15
EP3525411A1 (en) 2019-08-14
EP3525411B1 (en) 2022-08-24
EP3525411A4 (en) 2019-08-14
US10701073B2 (en) 2020-06-30

Similar Documents

Publication Publication Date Title
JP4729651B2 (ja) 認証装置，認証方法およびその方法を実装した認証プログラム
WO2017067227A1 (zh) 一种第三方账号授权方法、设备、服务器及其系统
EP3203709B1 (en) Cloud service server and method for managing cloud service server
US8387140B2 (en) Method and apparatus for controlling access to encrypted network communication channels
CN115021991A (zh) 未经管理的移动设备的单点登录
CN103634301A (zh) 客户端及其访问服务器中用户存储的私有数据的方法
WO2018076712A1 (zh) 一种终端认证的方法及设备
CN112491778A (zh) 认证方法、装置、系统及介质
WO2015074443A1 (en) An operation processing method and device
US12026218B2 (en) Technologies for cross-device shared web resource cache
KR20190069574A (ko) 무선 네트워크 유형 검출 방법과 장치, 및 전자 디바이스
CN112491776A (zh) 安全认证方法及相关设备
CN109889468B (zh) 网络数据的传输方法、系统、装置、设备及存储介质
JP4667326B2 (ja) 認証装置，認証方法およびその方法を実装した認証プログラム
CN108293047B (zh) 由用户访问跨多个分布式计算网络的资源的系统和方法
US8195818B2 (en) Enforcing communication security for selected resources
CN112202813B (zh) 网络访问方法及装置
WO2024208097A1 (zh) 网页鉴权方法、装置、介质及电子设备
CN114338130A (zh) 信息的处理方法、装置、服务器及存储介质
US11240225B1 (en) Single sign-on techniques
US20150379285A1 (en) Secure access to running client application features from a browser application
CN110177096B (zh) 客户端认证方法、装置、介质和计算设备
US12047469B1 (en) Inserting and replacing placeholders in resource code
US9794255B2 (en) Communication terminal and communication processing method
CN108259456B (zh) 实现用户免登录的方法、装置、设备、计算机存储介质

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17865053

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 2017865053

Country of ref document: EP

Effective date: 20190508