WO2018133683A1 - 网络鉴权方法及装置 - Google Patents

网络鉴权方法及装置 Download PDF

Info

Publication number
WO2018133683A1
WO2018133683A1 PCT/CN2018/071707 CN2018071707W WO2018133683A1 WO 2018133683 A1 WO2018133683 A1 WO 2018133683A1 CN 2018071707 W CN2018071707 W CN 2018071707W WO 2018133683 A1 WO2018133683 A1 WO 2018133683A1
Authority
WO
WIPO (PCT)
Prior art keywords
network
server
user
user equipment
identity information
Prior art date
Application number
PCT/CN2018/071707
Other languages
English (en)
French (fr)
Inventor
朱碧军
杨豪
孙健康
Original Assignee
阿里巴巴集团控股有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 阿里巴巴集团控股有限公司 filed Critical 阿里巴巴集团控股有限公司
Priority to SG11201906323PA priority Critical patent/SG11201906323PA/en
Publication of WO2018133683A1 publication Critical patent/WO2018133683A1/zh
Priority to US16/516,186 priority patent/US20190342289A1/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0876—Network architectures or network communication protocols for network security for authentication of entities based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0884—Network architectures or network communication protocols for network security for authentication of entities by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/104—Grouping of entities
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/107—Network architectures or network communication protocols for network security for controlling access to devices or network resources wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/108—Network architectures or network communication protocols for network security for controlling access to devices or network resources when the policy decisions are valid for a limited amount of time
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0819—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s)
    • H04L9/0825—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3263—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/006—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols involving public key infrastructure [PKI] trust models
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/60—Context-dependent security
    • H04W12/69—Identity-dependent
    • H04W12/72—Subscriber identity

Definitions

  • the present application relates to the field of network authentication technologies, and in particular, to a network authentication method and apparatus.
  • the user equipment When the user wants to connect the user equipment to the wireless network, the user equipment is first connected to a network device such as an AP (Wireless Access Point), and the network device is further accessed through the network device.
  • the network access operation is actually an access operation to the Ethernet, and the network device is equivalent to a bridge between the wireless network and the Ethernet.
  • wireless networks comply with the IEEE 802.1x standard to provide access control and authentication.
  • IEEE 802.1x Standard Authentication Protocol-Transport Layer Security
  • an EAP-TLS (Extensible Authentication Protocol-Transport Layer Security) protocol such as the IEEE 802.1x standard can be used to network the user equipment accessing the network device. Authentication.
  • a PKI (Public Key Infrastructure) system needs to be deployed in the enterprise, and the PKI system is very large and complex, and the initial investment and the post-maintenance requirements are very high; Based on the deployed PKI system, the digital certificate needs to be saved on the user equipment and the server, and the validity of the digital certificate is periodically maintained. In the authentication process, the two parties need to perform two-way verification on the digital certificate, which complicates the authentication process. ,low efficiency.
  • the present application provides a network authentication method and apparatus, which can simplify the network authentication process for user equipment.
  • a network authentication method including:
  • the server determines an authentication result of the unique device identifier of the user equipment
  • the server returns the authentication result to the network device, to instruct the network device to control a network access operation of the user equipment according to the authentication result.
  • a network authentication method including:
  • the network device client running on the network device acquires the unique device identifier of the user equipment
  • the network device client sends an authentication request including the unique device identifier of the user equipment to the server of the preset instant messaging application, where the authentication request is used to instruct the server to preset according to the pre-stored
  • the network device client receives an authentication result of the unique device identifier of the user equipment returned by the server, and controls a network access operation of the user equipment according to the authentication result.
  • a network authentication method including:
  • the user client of the preset instant messaging application running on the electronic device determines the identity information of the logged-in user
  • the user client sends an advertisement message to the server of the instant messaging application, where the notification message includes the identity information and a unique device identifier of the electronic device, to record the identity information by the server a mapping relationship between the electronic devices, wherein the mapping relationship is used to instruct the server to apply the network access rights of the identity information in a preset community to the electronic device to control the electronic device Network access operations implemented based on network devices under the preset community.
  • a network authentication apparatus including:
  • the request receiving unit is configured to enable the server of the preset instant messaging application to receive the authentication request sent by the network device, where the authentication request includes the unique device identifier of the user equipment;
  • An authentication unit according to a preset group that has a binding relationship with the network device, a mapping relationship between the identity information of the associated user of the preset community and the unique device identifier recorded in the server, and each The network access right corresponding to the identity information, so that the server determines an authentication result of the unique device identifier of the user equipment;
  • a network authentication apparatus including:
  • the network device client running on the network device acquires the unique device identifier of the user equipment
  • a sending unit configured to send, by the network device client, an authentication request including a unique device identifier of the user equipment to a server of the preset instant messaging application, where the authentication request is used to indicate that the server is pre-stored according to the The mapping between the identity information of the associated user of the preset community and the unique device identifier, and the network access authority corresponding to each identity information, and authenticating the unique device identifier of the user equipment;
  • the control unit is configured to enable the network device client to receive an authentication result of the unique device identifier of the user equipment returned by the server, and control a network access operation of the user equipment according to the authentication result.
  • a network authentication apparatus including:
  • a sending unit configured to send, by the user client, an advertisement message to a server of the instant messaging application, where the notification message includes the identity information and a unique device identifier of the electronic device, to be recorded by the server a mapping relationship between the identity information and the electronic device, wherein the mapping relationship is used to instruct the server to apply the network access rights of the identity information in a preset community to the electronic device to control
  • the electronic device is based on a network access operation implemented by a network device under the preset community.
  • the present application pre-stores the mapping relationship between the identity information and the device MAC address, so that the network device only needs to obtain the MAC address of the user equipment, and the server can perform the comparison according to the pre-stored mapping relationship.
  • the right can not only simplify the authentication process of the user equipment on the server side, improve the authentication efficiency of the user equipment, but also avoid deploying the PKI system and reduce the input and complexity of the overall system.
  • FIG. 1 is a flowchart of a server side-based network authentication method according to an exemplary embodiment of the present application
  • FIG. 2 is a flowchart of a network device client-side network authentication method according to an exemplary embodiment of the present application
  • FIG. 3 is a flowchart of a network authentication method based on a user client side according to an exemplary embodiment of the present application
  • FIG. 4 is a schematic diagram of a scenario of an application network device according to an exemplary embodiment of the present disclosure
  • FIG. 5 is a flowchart of a network authentication method according to an exemplary embodiment of the present application.
  • FIG. 6 is a flowchart of another network authentication method according to an exemplary embodiment of the present disclosure.
  • FIG. 7 is a schematic structural diagram of an electronic device based on a server side according to an exemplary embodiment of the present application.
  • FIG. 8 is a block diagram of a server side-based network authentication apparatus according to an exemplary embodiment of the present application.
  • FIG. 9 is a schematic structural diagram of an electronic device based on a client side of a network device according to an exemplary embodiment of the present disclosure.
  • FIG. 10 is a block diagram of a network device client side based network authentication apparatus according to an exemplary embodiment of the present application.
  • FIG. 11 is a schematic structural diagram of an electronic device based on a user client side according to an exemplary embodiment of the present disclosure
  • FIG. 12 is a block diagram of a network authentication device based on a user client side according to an exemplary embodiment of the present application.
  • FIG. 1 is a flowchart of a server side-based network authentication method according to an exemplary embodiment of the present application. As shown in FIG. 1, the method is applied to a server, and may include the following steps:
  • Step 102 The server that presets the mobile enterprise office platform receives the authentication request sent by the network device, where the authentication request includes the unique device identifier of the user equipment.
  • the mobile enterprise office platform can not only realize the communication function, but also can be used as an integrated function platform for many other functions, such as approval events (such as leave, office item application, financial and other approval events), attendance events.
  • approval events such as leave, office item application, financial and other approval events
  • attendance events such as attendance events.
  • the mobile enterprise office platform can be carried in instant messaging applications in related technologies, such as enterprise instant messaging (EIM) applications, such as Skype For. Microsoft Wait.
  • EIM enterprise instant messaging
  • the instant messaging function is only one of the communication functions supported by the mobile enterprise office platform.
  • the enterprise office platform can also implement more functions such as the above, and will not be described here.
  • the unique device identifier can uniquely indicate and determine the corresponding user device, that is, the unique device identifier has a one-to-one correspondence with the user device. All the unique identification information can be used as the unique device identifier. The application does not limit this.
  • the unique device identifier can be the MAC (Media Access Control) address and sequence of the user equipment. No..
  • Step 104 According to a preset group that has a binding relationship with the network device, a mapping relationship between the identity information of the associated user of the preset community and the unique device identifier pre-recorded in the server, and each identity The network access right corresponding to the information, the server determines an authentication result of the unique device identifier of the user equipment.
  • the network device since the network device can only cover a certain range near the installation location, that is, only the user equipment in the range can access the network device, the network device is usually bound to the preset community, and is installed in the network device. Within the working range of the preset group, the associated users of the preset group access and perform network access operations.
  • the "group” may refer to various organizations such as enterprises, schools, hospitals, military units, and government agencies. These forms of organizations may adopt the above-mentioned mobile enterprise office platform to implement the technical solution of the present application.
  • the server pre-records the mapping relationship between each associated user of the preset community and the corresponding unique device identifier, so as to be unique to the user equipment sent by the network device according to the recorded mapping relationship.
  • the device ID is authenticated.
  • the server when receiving the notification message sent by the electronic device, according to the identity information registered on the user client of the mobile enterprise office platform running on the electronic device included in the notification message, and the unique device identifier of the electronic device The identity information and the unique device identifier included in the advertisement message are recorded as corresponding mapping relationships.
  • the mapping relationship may be manually created by the administrative user of the preset community, or the mapping relationship already recorded in the server may be edited.
  • the associated user of the preset group may include at least one of the following: an internal member of the preset group, and an external contact of the preset group (such as an internal member of another group that has an association with the preset group, For example, there is a cooperative relationship between the other group and the preset group, the external visitor of the preset group, and the like.
  • an internal member of the preset group such as an internal member of another group that has an association with the preset group, For example, there is a cooperative relationship between the other group and the preset group, the external visitor of the preset group, and the like.
  • other types of related users may also be adapted to the technical solution of the present application, which is not limited by the present application.
  • the same user equipment can be logged in by multiple associated users, and the same associated user can also perform account login on multiple user devices, so that the server may have multiple corresponding devices at the same time.
  • the mapping relationship of the unique device identifier the server may select the most recently recorded mapping relationship to determine the authentication result corresponding to the unique device identifier of the user equipment.
  • the user equipment may send the foregoing notification message to the server, so that the server updates the mapping relationship corresponding to the user equipment, thereby ensuring that the user equipment is used for the mapping relationship corresponding to the user equipment.
  • the mapping relationship of the authentication corresponds to the associated user currently logged in on the user equipment, and avoids applying the network access rights corresponding to other associated users for authentication.
  • Step 106 The server returns the authentication result to the network device, to instruct the network device to control a network access operation of the user equipment according to the authentication result.
  • FIG. 2 is a flowchart of a network device client-side network authentication method according to an exemplary embodiment of the present application. As shown in FIG. 2, the method is applied to a network device client, and may include the following steps:
  • Step 202 When the network device bound to the preset community detects the user equipment access, the network device client running on the network device acquires the unique device identifier of the user equipment.
  • the network device client may be a client based on the mobile enterprise office platform, or may be any other client, as long as it can cooperate with the server to perform authentication and network access control on the user device.
  • This application does not control this.
  • the network device client is a client based on the mobile enterprise office platform, the network device client has built-in control logic matched with the server, and the technical solution based on the application is more easily implemented.
  • the network device may include any electronic device that implements the network access function, such as an AP device, which is not limited in this application.
  • Step 204 The network device client sends an authentication request that includes the unique device identifier of the user equipment to the server of the preset mobile enterprise office platform, where the authentication request is used to indicate that the server is pre-stored according to the pre-storage The mapping relationship between the identity information of the associated user of the preset community and the unique device identifier, and the network access authority corresponding to each identity information, and authenticating the unique device identifier of the user equipment.
  • Step 206 The network device client receives an authentication result of the unique device identifier of the user equipment returned by the server, and controls a network access operation of the user equipment according to the authentication result.
  • the network device client may control the network access operation according to the value of the permission option included in the authentication result; wherein the permission option may include at least one of the following:
  • the number of remaining usage of the permission For example, for the network permission of the temporary application, the number of remaining usages of the permission may be limited to 1, that is, the user can access the network device only once and implement network access; wherein, after the associated user accesses the network device and implements network access, The corresponding number of remaining usages of the permission is decremented by 1 to manage the remaining usage of the permission. Then, when the number of remaining usages of the permission is not zero, the network access can be directly opened, and further access control can be performed in combination with other permission options; when the number of remaining usages of the permission is zero, the network access can be directly denied.
  • the range of networks allowed to access can be pre-divided into multiple ranges, such as the internal network of the preset group, the public network outside the preset group, the domestic scope in the public network, and the foreign scope in the public network, thereby making the network access operation more For detailed permission control, it will not be described here.
  • FIG. 3 is a flowchart of a network authentication method based on a user client side according to an exemplary embodiment of the present application. As shown in FIG. 3, the method is applied to a user client, and may include the following steps:
  • Step 302 The user client of the preset mobile enterprise office platform running on the electronic device determines the identity information of the logged-in user.
  • the client application of the mobile enterprise office platform can be pre-installed on the electronic device such that the client can be launched and run on the electronic device; of course, when using an online such as HTML5 technology. Client", you can get and run the client without installing the corresponding application on the electronic device.
  • the network device client is the client of the mobile enterprise office platform, and details are not described herein again.
  • Step 304 The user client sends an advertisement message to the server of the mobile enterprise office platform, where the advertisement message includes the identity information and a unique device identifier of the electronic device, to be recorded by the server. a mapping relationship between the identity information and the electronic device.
  • the mapping relationship recorded by the server is the mapping relationship in the embodiment shown in FIG. 1 and FIG. 2, and the mapping relationship is used to instruct the server to access the network information of the identity information in the preset community. Applicable to the electronic device (the electronic device can be determined according to the unique device identifier recorded in the mapping relationship) to control the network access operation of the electronic device based on the network device under the preset community.
  • the electronic device may send the notification message described above when the user client detects the user login behavior. Then, as long as the user account that is logged in on the electronic device changes, the mapping relationship recorded by the server may be updated according to the correspondence between the identity information corresponding to the currently logged-in user account and the unique device identifier of the electronic device. Thereby ensuring that the server can authenticate the electronic device using the latest mapping relationship.
  • the electronic device may send the notification message described above when the user client detects an access instruction for any of the network devices. Then, when an account change occurs when the electronic device is not connected to the network device, even if the notification message is not sent when the user login behavior occurs, the notification message may be sent when the access command is detected, so that the server records the The mapping relationship is updated in time to ensure that the electronic device is authenticated using the latest mapping relationship.
  • the present application pre-stores the mapping relationship between the identity information and the device MAC address, so that the network device only needs to obtain the MAC address of the user equipment, and the server can perform the comparison according to the pre-stored mapping relationship.
  • the right can not only simplify the authentication process of the user equipment on the server side, improve the authentication efficiency of the user equipment, but also avoid deploying the PKI system and reduce the input and complexity of the overall system.
  • FIG. 4 is a schematic diagram of a scenario of an application network device according to an exemplary embodiment of the present application.
  • the AP device 41 as a network device is installed at point A in the office area 42 of the enterprise AA, and the AP device 41 can be in the range 40 (with the point A as the center and the emission radius d as the radius of the range)
  • the Beacon (beacon) frame signal is transmitted, so that the electronic device in the range 40 can access the AP device 41 by scanning the Beacon frame signal; of course, the electronic device can adopt an active scanning manner.
  • this application does not limit this.
  • the mobile phone 43 used by the user can scan and access the AP device 41, and the mobile phone 43 and the AP device 41 can respectively implement data interaction with the server 44, and further implement the present application.
  • Network authentication scheme when the user is located at point B in the range 40, the mobile phone 43 used by the user can scan and access the AP device 41, and the mobile phone 43 and the AP device 41 can respectively implement data interaction with the server 44, and further implement the present application.
  • Network authentication scheme when the user is located at point B in the range 40, the mobile phone 43 used by the user can scan and access the AP device 41, and the mobile phone 43 and the AP device 41 can respectively implement data interaction with the server 44, and further implement the present application.
  • Network authentication scheme when the user is located at point B in the range 40, the mobile phone 43 used by the user can scan and access the AP device 41, and the mobile phone 43 and the AP device 41 can respectively implement data interaction with the server 44, and further implement the present application.
  • Network authentication scheme when the user is located at point B in the range
  • the server 44 may be a physical server including a separate host, or the server 44 may be a virtual server hosted by the host cluster, or the server 44 may be a cloud server. During operation, the server 44 can run a server-side program of an application to implement related business functions of the application, such as a network authentication function.
  • the handset 43 is just one type of electronic device that a user can use. In fact, users obviously can also use electronic devices such as tablet devices, notebook computers, PDAs (Personal Digital Assistants), wearable devices (such as smart glasses, smart watches, etc.), etc. This is a limitation.
  • the electronic device can run a client-side program of an application to implement related business functions of the application, such as the network authentication function described above.
  • the network may include a Public Switched Telephone Network (PSTN) and the Internet.
  • PSTN Public Switched Telephone Network
  • FIG. 5 is a network provided by an exemplary embodiment of the present application. Flow chart of the authentication method. As shown in FIG. 5, the method may include the following steps:
  • step 502 the mobile phone 43 detects the user login behavior.
  • the enterprise WeChat client running on the mobile phone 43 can monitor the user login behavior, and send the following notification message accordingly. To ensure timely update of the mapping relationship recorded on the enterprise WeChat server running on the server 44.
  • step 504 the mobile phone 43 sends an advertisement message to the server 44, where the notification message includes the identity information of the logged-in account and the MAC address of the mobile phone 43.
  • the enterprise WeChat client running on the mobile phone 43 obtains the identity information of the logged-in account, and generates an advertised message including the identity information.
  • the advertised message itself includes the MAC address of the mobile phone 43 (ie, the source).
  • the MAC address the notification message includes both the identity information of the logged-in account and the MAC address of the mobile phone 43 without the need for the enterprise WeChat client to actively add the MAC address to the notification message.
  • step 506 the server 44 records the corresponding mapping relationship according to the identity information and the MAC address included in the advertisement message.
  • the server 44 may create the mapping relationship; and when the notification message has been recorded in the server 44, The mapping relationship between the included identity information and the MAC address, the server 44 can update the recording time of the mapping relationship.
  • the same user account can be logged in on multiple electronic devices respectively. Therefore, for the identity information included in the advertisement message, the mapping relationship between the identity information and multiple MAC addresses can be separately recorded on the server 44. Similarly, different user accounts can be separately logged in the same electronic device. Therefore, for the MAC address included in the advertisement message, the mapping relationship between the MAC address and the plurality of identity information can be separately recorded on the server 44.
  • steps 502-506 describe the process by which the server 44 records the mapping relationship, which may occur before step 512 (to ensure that the mapping relationship can be applied to the authentication operation in step 512).
  • the arbitrary time is determined in the embodiment shown in FIG. 5 by the detection time of the user login behavior in step 502.
  • step 508 a WIFI connection is established between the mobile phone 43 and the AP device 41.
  • the mobile phone 43 can scan to the AP device 41 by means of active scanning or passive scanning, and access the AP device 41 based on the access instruction, so that between the mobile phone 43 and the AP device 41. Establish a WIFI connection.
  • the access command may be sent by the user of the mobile phone 43.
  • the mobile phone 43 may display all the AP devices scanned, and when the user selects the AP device 41, the mobile phone 43 may determine that the mobile device 43 receives the AP device 41. Access instruction.
  • the access command may also be automatically generated by the mobile phone 43. For example, in the previous access process to the AP device 41, the access operation is set to the "automatic access" mode, and then the mobile phone 43 scans to the AP device 41 in the subsequent process. When accessing other AP devices, the mobile phone 43 will automatically generate or determine that an access command has been generated and automatically access the AP device 41.
  • step 510 the AP device 41 acquires the MAC address of the mobile phone 43 and sends an authentication request for the MAC address to the server 44.
  • step 512 the server 44 authenticates the mobile phone 43 according to the recorded mapping relationship.
  • the AP device 41 is pre-bound to the enterprise AA, for example, the management user of the enterprise AA binds the AP device 41 on the enterprise WeChat, and the server 44 records the AP device 41 and the enterprise.
  • a binding relationship between the AAs, and the server 44 also records: a mapping relationship corresponding to all associated users of the enterprise AA, and network access rights of each associated user.
  • the server 44 can determine that the mobile phone 43 does not have network access rights, that is, the authentication result is that the authentication fails.
  • the server 44 receives the MAC address of the mobile phone 43 and finds a mapping relationship that matches the MAC address, and the identity information recorded in the mapping relationship belongs to the associated user of the enterprise AA, then:
  • the server 44 can determine that the mobile phone 43 has passed the authentication and return the corresponding authentication result to the AP device 41, so that the AP device 41 opens the network access permission of the mobile phone 43, for example, permission.
  • the handset 43 accesses the external public network from within the enterprise AA.
  • the MAC address of the mobile phone 43 may be further determined according to the MAC address of the mobile phone 43. Mapping the identity information recorded in the relationship, determining the associated user type to which the identity information belongs, and returning the corresponding authentication result to the AP device 41 according to the network access right corresponding to the associated user type, so that the AP device 41 can The weight result controls the network access operation of the handset 43.
  • the associated users of the same category can be further divided into multiple sub-categories, such as further dividing the internal members into management classes, R&D classes, sales classes, etc., and the associated users of each sub-category can have corresponding network access rights, and The server 44 can also send corresponding authentication results according to this, and details are not described herein again.
  • the server 44 may only find a mapping relationship that matches the MAC address of the mobile phone 43.
  • the server 44 may directly authenticate the mobile phone 43 according to the identity information of the associated user recorded in the mapping relationship. While the server 44 may also find a plurality of mapping relationships matching the MAC addresses of the mobile phone 43 at the same time, the server 44 may select the most recently recorded mapping relationship to authenticate the mobile phone 43.
  • the most recently recorded mapping relationship that is, the mapping relationship closest to the last editing time, may be the creation time or the update time.
  • the server 44 receives the advertisement message including the identity information 1 and the MAC address 1, and creates the mapping relationship 1 between the identity information 1 and the MAC address 1 at time 1.
  • the last edited time of the mapping relationship 1 is the creation time.
  • Time 1 when the server 44 receives the notification message including the identity information 1 and the MAC address 1 again, the server 44 may update the last editing time of the mapping relationship 1 at time 2, and then the last editing time is changed from the creation time to The update time (ie, the time at which the update operation is performed) is time 2; similarly, when the server 44 receives the notification message including the identity information 1 and the MAC address 1 again, the server 44 may at the end of the mapping relationship 1 at time 3.
  • the editing time is updated, the last editing time is changed from time 2 to the update time (that is, the time at which the update operation is performed), that is, time 3.
  • step 514 the server 44 sends the authentication result to the AP device 41.
  • step 516 the AP device 41 performs rights control on the mobile phone 43 according to the authentication result to manage its network access operation.
  • the authentication result may include a plurality of permission options
  • the AP device 41 may control the network access operation of the mobile phone 43 according to the value of the permission option.
  • the permission option includes at least one of the following: Permissions, the effective duration of the permissions, the number of remaining usages of the permissions, the range of networks allowed to access, and of course more types of permissions options may be used, and this application does not limit this.
  • the authentication result may include only the privilege. For example, when the value is 1, it means that the privilege is 0. At 1 o'clock, the mobile phone 43 is allowed to perform a full network access operation, and when the value is 0, the mobile phone 43 is denied any network access operation.
  • the authentication result can contain multiple permission options at the same time.
  • the authentication result includes both "whether it has permission” and "network range allowed to access”
  • the value of "whether it has permission” means that the value of the network range with permission and "access allowed” indicates internal LAN and external
  • the public network allows the mobile phone 43 to perform network access operations on the internal local area network and the external public network; if the value of "whether having the right authority” indicates that the value of the network range that has the permission and the “allowed access” indicates the internal local area network, the mobile phone 43 is allowed. Perform network access operations on the internal LAN, restrict access to the external public network by the mobile phone 43; if the value of "whether or not the permission is available" indicates that there is no permission, the mobile phone 43 is rejected regardless of the value of the "network range allowed to access”. Any network access operation; other situations are not repeated here.
  • the authentication result includes both "whether it has permission”, “permission valid duration”, and “permitted network range”
  • the value of "whether it has permission” means that the value has permission and “permission valid duration”
  • the mobile phone 43 is allowed to perform network access operations on the internal local area network and the external public network; The value of "permission valid duration” indicates that the timeout has expired. Regardless of the value of the "network range allowed to access", the mobile phone 43 is denied any network access operation; other situations will not be described again.
  • the privilege management of different modes can be implemented by using a combination of any of the multiple privilege options, so as to meet the privilege management requirements in different scenarios, which are not repeatedly described herein, and the application does not limit this.
  • the mobile phone 43 may send a notification message to the server 44 by using "detected user login behavior" as a trigger condition, so that the server 44 can create or update the mapping relationship corresponding to the mobile phone 43:
  • the user account is logged in for the first time on the mobile phone 43 (the first time logging in on the mobile phone 43, but may have logged in on other electronic devices), the server 44 needs to create a corresponding mapping relationship, if the user account is not the first time to log in on the mobile phone 43 (previously The login operation has been performed on the handset 43, and the server 44 needs to update the corresponding mapping relationship (such as updating its last editing moment).
  • the mobile phone 43 can also send the above-mentioned notification message to the server 44 based on other conditions to ensure that the mapping relationship recorded on the server 44 remains updated.
  • the method may include the following steps:
  • step 602 the mobile phone 43 scans to the AP device 41.
  • the mobile phone 43 can scan to the AP device 41 by means of active scanning or passive scanning, which is not limited in this application.
  • the handset 43 detects the access command.
  • the access command may be sent by the user of the mobile phone 43, for example, the mobile phone 43 may show all the AP devices scanned, and when the user selects the AP device 41, the mobile phone 43 may determine that the mobile phone 43 receives the The access instruction of the AP device 41.
  • the access command may also be automatically generated by the mobile phone 43. For example, in the previous access process to the AP device 41, the access operation is set to the "automatic access" mode, and then the mobile phone 43 scans to the AP device 41 in the subsequent process. When accessing other AP devices, the mobile phone 43 will automatically generate or determine that an access command has been generated and automatically access the AP device 41.
  • step 606 the mobile phone 43 sends an advertisement message to the server 44, where the notification message includes the identity information of the logged-in account and the MAC address of the mobile phone 43.
  • the present application desires the rights management of the network access of the mobile phone 43 by the AP device 41, when the user account is logged in when the mobile phone 43 is logged in, if the access command is not detected, it indicates that the AP device 41 is not involved.
  • the rights management of the handset 43 is such that the handset 43 does not need to send an announcement message to the server 44.
  • the server 44 can promptly create or update the mapping relationship corresponding to the mobile phone 43 by sending an advertisement message to the server 44 to ensure that the mapping relationship recorded on the server 44 is the latest data.
  • steps 608-618 reference may be made to steps 506-516 in the embodiment shown in FIG. 5, and details are not described herein again.
  • the application is based on the mobile enterprise office platform, and the mapping relationship between the identity information and the device MAC address can be recorded on the server end of the mobile enterprise office platform, and the network access of the user equipment is performed according to the mapping relationship.
  • the quick authentication of the authority effectively simplifies the complexity of the authentication process and ensures the efficiency of authentication when ensuring the security of the network data.
  • FIG. 7 shows a schematic structural diagram of an electronic device according to an exemplary embodiment of the present application.
  • the electronic device includes a processor 702, an internal bus 704, a network interface 706, a memory 708, and a non-volatile memory 710, and of course may also include hardware required for other services.
  • the processor 702 reads the corresponding computer program from the non-volatile memory 710 into the memory 702 and then operates to form a network authentication device at a logical level.
  • the present application does not exclude other implementation manners, such as a logic device or a combination of software and hardware, etc., that is, the execution body of the following processing flow is not limited to each logical unit, and may be Hardware or logic device.
  • the network authentication device may include a request receiving unit 801, an authentication unit 802, and a return unit 803. among them:
  • the request receiving unit 801 is configured to enable the server of the preset mobile enterprise office platform to receive an authentication request sent by the network device, where the authentication request includes a unique device identifier of the user equipment;
  • the authentication unit 802 according to a preset group that has a binding relationship with the network device, a mapping relationship between the identity information of the associated user of the preset community and the unique device identifier that is pre-recorded in the server, and The network access right corresponding to each identity information, so that the server determines an authentication result of the unique device identifier of the user equipment;
  • the returning unit 803 is configured to enable the server to return the authentication result to the network device, to instruct the network device to control a network access operation of the user equipment according to the authentication result.
  • it also includes:
  • the message receiving unit 804 is configured to enable the server to receive an advertisement message sent by the electronic device, where the notification message includes the identity information and the login information of the user client of the mobile enterprise office platform running on the electronic device.
  • the unique device identification of the electronic device is configured to enable the server to receive an advertisement message sent by the electronic device, where the notification message includes the identity information and the login information of the user client of the mobile enterprise office platform running on the electronic device. The unique device identification of the electronic device;
  • the recording unit 805 is configured to enable the server to record the identity information and the unique device identifier included in the advertisement message as corresponding mapping relationships.
  • it also includes:
  • the associated user includes at least one of the following: an internal member of the preset group, an external contact of the preset group, and an external visitor of the preset group.
  • FIG. 9 shows a schematic structural diagram of an electronic device according to an exemplary embodiment of the present application.
  • the electronic device includes a processor 902, an internal bus 904, a network interface 906, a memory 908, and a non-volatile memory 910, and of course may also include hardware required for other services.
  • the processor 902 reads the corresponding computer program from the non-volatile memory 910 into the memory 902 and then operates to form a network authentication device at a logical level.
  • the present application does not exclude other implementation manners, such as a logic device or a combination of software and hardware, etc., that is, the execution body of the following processing flow is not limited to each logical unit, and may be Hardware or logic device.
  • the network authentication apparatus may include an obtaining unit 1001, a sending unit 1002, and a control unit 1003. among them:
  • the acquiring unit 1001 when the network device bound to the preset community detects the user equipment access, the network device client running on the network device acquires the unique device identifier of the user equipment;
  • the sending unit 1002 configured to send, by the network device client, an authentication request including a unique device identifier of the user equipment to a server of the preset mobile enterprise office platform, where the authentication request is used to indicate that the server is configured according to the server Pre-storing the mapping relationship between the identity information of the associated user of the preset community and the unique device identifier, and the network access authority corresponding to each identity information, and authenticating the unique device identifier of the user equipment;
  • the control unit 1003 is configured to enable the network device client to receive an authentication result of the unique device identifier of the user equipment returned by the server, and control a network access operation of the user equipment according to the authentication result.
  • control unit 1003 is specifically configured to:
  • the network device client controls the network access operation according to the value of the permission option included in the authentication result; wherein the permission option includes at least one of the following: whether the user has the permission, the validity time of the permission, and the remaining permission The number of uses, the range of networks allowed to access.
  • FIG. 11 shows a schematic structural diagram of an electronic device according to an exemplary embodiment of the present application.
  • the electronic device includes a processor 1102, an internal bus 1104, a network interface 1106, a memory 1108, and a non-volatile memory 1110, and of course may also include hardware required for other services.
  • the processor 1102 reads the corresponding computer program from the non-volatile memory 1110 into the memory 1102 and then operates to form a network authentication device at a logical level.
  • the present application does not exclude other implementation manners, such as a logic device or a combination of software and hardware, etc., that is, the execution body of the following processing flow is not limited to each logical unit, and may be Hardware or logic device.
  • the network authentication device may include a determining unit 1201 and a sending unit 1202. among them:
  • the determining unit 1201 is configured to determine, by the user client of the preset mobile enterprise office platform running on the electronic device, identity information of the logged-in user;
  • the sending unit 1202 configured to send, by the user client, an advertisement message to a server of the mobile enterprise office platform, where the notification message includes the identity information and a unique device identifier of the electronic device, by the service Recording a mapping relationship between the identity information and the electronic device, where the mapping relationship is used to indicate that the server applies the network access rights of the identity information in a preset community to the electronic device. And controlling a network access operation performed by the electronic device based on the network device under the preset group.
  • the sending unit 1202 sends the advertisement message to the server of the mobile enterprise office platform by using at least one of the following manners:
  • the announcement message is sent when the user client detects an access instruction for any network device.
  • the system, device, module or unit illustrated in the above embodiments may be implemented by a computer chip or an entity, or by a product having a certain function.
  • a typical implementation device is a computer, and the specific form of the computer may be a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email transceiver, and a game control.
  • a computer includes one or more processors (CPUs), input/output interfaces, network interfaces, and memory.
  • processors CPUs
  • input/output interfaces network interfaces
  • memory volatile and non-volatile memory
  • the memory may include non-persistent memory, random access memory (RAM), and/or non-volatile memory in a computer readable medium, such as read only memory (ROM) or flash memory.
  • RAM random access memory
  • ROM read only memory
  • Memory is an example of a computer readable medium.
  • Computer readable media includes both permanent and non-persistent, removable and non-removable media.
  • Information storage can be implemented by any method or technology.
  • the information can be computer readable instructions, data structures, modules of programs, or other data.
  • Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read only memory. (ROM), electrically erasable programmable read only memory (EEPROM), flash memory or other memory technology, compact disk read only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, Magnetic tape cartridges, magnetic tape storage or other magnetic storage devices or any other non-transportable media can be used to store information that can be accessed by a computing device.
  • computer readable media does not include temporary storage of computer readable media, such as modulated data signals and carrier waves.
  • first, second, third, etc. may be used to describe various information in this application, such information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other.
  • first information may also be referred to as the second information without departing from the scope of the present application.
  • second information may also be referred to as the first information.
  • word "if” as used herein may be interpreted as "when” or “when” or “in response to a determination.”

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Power Engineering (AREA)
  • Telephonic Communication Services (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Information Transfer Between Computers (AREA)

Abstract

本申请提供一种网络鉴权方法及装置，该方法可以包括：预设移动化企业办公平台的服务端接收到网络设备发送的鉴权请求，所述鉴权请求中包含用户设备的唯一设备标识；根据与所述网络设备存在绑定关系的预设团体，所述服务端中预先记录的所述预设团体的关联用户的身份信息与唯一设备标识之间的映射关系，以及各个身份信息对应的网络访问权限，所述服务端确定对所述用户设备的唯一设备标识的鉴权结果；所述服务端向所述网络设备返回所述鉴权结果，以指示所述网络设备根据所述鉴权结果控制所述用户设备的网络访问操作。通过本申请的技术方案，可以简化对用户设备的网络鉴权过程。

Description

网络鉴权方法及装置
本申请要求2017年01月19日递交的申请号为201710039832.8、发明名称为“网络鉴权方法及装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及网络鉴权技术领域，尤其涉及一种网络鉴权方法及装置。
背景技术
当用户希望将用户设备接入无线网络时，需要首先将用户设备接入AP(Wireless Access Point，无线访问接入点)等网络设备，并进一步通过该网络设备实现网络访问。网络访问操作实际上是对以太网的访问操作，而网络设备相当于无线网络与以太网之间的桥梁。
在相关技术中，无线网络遵循IEEE 802.1x标准来提供访问控制和认证。以企业场景为例，由于涉及到较高的信息安保需求，可以采用IEEE 802.1x标准下的诸如EAP-TLS(Extensible Authentication Protocol-Transport Layer Security)协议，从而对接入网络设备的用户设备进行网络鉴权。
但是，在相关技术的鉴权过程中，需要在企业中部署PKI(Public Key Infrastructure，公钥基础设施)系统，而PKI系统十分庞大、复杂，且前期投入和后期维护要求都非常高；同时，基于已部署的PKI系统，需要在用户设备、服务器上分别保存数字证书，并周期性地维护数字证书的有效性，且鉴权过程中需要由双方对数字证书进行双向验证，造成鉴权过程复杂、效率低下。
发明内容
有鉴于此，本申请提供一种网络鉴权方法及装置，可以简化对用户设备的网络鉴权过程。
为实现上述目的，本申请提供技术方案如下：
根据本申请的第一方面，提出了一种网络鉴权方法，包括：
预设即时通讯应用的服务端接收到网络设备发送的鉴权请求，所述鉴权请求中包含用户设备的唯一设备标识；
根据与所述网络设备存在绑定关系的预设团体，所述服务端中预先记录的所述预设 团体的关联用户的身份信息与唯一设备标识之间的映射关系，以及各个身份信息对应的网络访问权限，所述服务端确定对所述用户设备的唯一设备标识的鉴权结果；
所述服务端向所述网络设备返回所述鉴权结果，以指示所述网络设备根据所述鉴权结果控制所述用户设备的网络访问操作。
根据本申请的第二方面，提出了一种网络鉴权方法，包括：
当被绑定至预设团体的网络设备检测到用户设备接入时，所述网络设备上运行的网络设备客户端获取所述用户设备的唯一设备标识；
所述网络设备客户端向预设即时通讯应用的服务端发送包含所述用户设备的唯一设备标识的鉴权请求，所述鉴权请求用于指示所述服务端根据预存储的所述预设团体的关联用户的身份信息与唯一设备标识之间的映射关系，以及各个身份信息对应的网络访问权限，对所述用户设备的唯一设备标识进行鉴权；
所述网络设备客户端接收所述服务端返回的对所述用户设备的唯一设备标识的鉴权结果，并根据所述鉴权结果控制所述用户设备的网络访问操作。
根据本申请的第三方面，提出了一种网络鉴权方法，包括：
电子设备上运行的预设即时通讯应用的用户客户端确定已登录用户的身份信息；
所述用户客户端向所述即时通讯应用的服务端发送通告消息，所述通告消息中包含所述身份信息与所述电子设备的唯一设备标识，以由所述服务端记录所述身份信息与所述电子设备之间的映射关系；其中，所述映射关系用于指示所述服务端将所述身份信息在预设团体中的网络访问权限适用于所述电子设备，以控制所述电子设备基于所述预设团体下的网络设备实现的网络访问操作。
根据本申请的第四方面，提出了一种网络鉴权装置，包括：
请求接收单元，使预设即时通讯应用的服务端接收到网络设备发送的鉴权请求，所述鉴权请求中包含用户设备的唯一设备标识；
鉴权单元，根据与所述网络设备存在绑定关系的预设团体，所述服务端中预先记录的所述预设团体的关联用户的身份信息与唯一设备标识之间的映射关系，以及各个身份信息对应的网络访问权限，使所述服务端确定对所述用户设备的唯一设备标识的鉴权结果；
返回单元，使所述服务端向所述网络设备返回所述鉴权结果，以指示所述网络设备根据所述鉴权结果控制所述用户设备的网络访问操作。
根据本申请的第五方面，提出了一种网络鉴权装置，包括：
获取单元，当被绑定至预设团体的网络设备检测到用户设备接入时，使所述网络设备上运行的网络设备客户端获取所述用户设备的唯一设备标识；
发送单元，使所述网络设备客户端向预设即时通讯应用的服务端发送包含所述用户设备的唯一设备标识的鉴权请求，所述鉴权请求用于指示所述服务端根据预存储的所述预设团体的关联用户的身份信息与唯一设备标识之间的映射关系，以及各个身份信息对应的网络访问权限，对所述用户设备的唯一设备标识进行鉴权；
控制单元，使所述网络设备客户端接收所述服务端返回的对所述用户设备的唯一设备标识的鉴权结果，并根据所述鉴权结果控制所述用户设备的网络访问操作。
根据本申请的第六方面，提出了一种网络鉴权装置，包括：
确定单元，使电子设备上运行的预设即时通讯应用的用户客户端确定已登录用户的身份信息；
发送单元，使所述用户客户端向所述即时通讯应用的服务端发送通告消息，所述通告消息中包含所述身份信息与所述电子设备的唯一设备标识，以由所述服务端记录所述身份信息与所述电子设备之间的映射关系；其中，所述映射关系用于指示所述服务端将所述身份信息在预设团体中的网络访问权限适用于所述电子设备，以控制所述电子设备基于所述预设团体下的网络设备实现的网络访问操作。
由以上技术方案可见，本申请通过在服务端预存储身份信息与设备MAC地址之间的映射关系，使得网络设备只需要获取用户设备的MAC地址，即可由服务端根据预存储的映射关系进行鉴权，不仅可以简化服务端对用户设备的鉴权过程、提升对用户设备的鉴权效率，而且可以避免部署PKI系统、降低整体系统的投入和复杂程度。
附图说明
图1是本申请一示例性实施例提供的一种基于服务端侧的网络鉴权方法的流程图；
图2是本申请一示例性实施例提供的一种基于网络设备客户端侧的网络鉴权方法的流程图；
图3是本申请一示例性实施例提供的一种基于用户客户端侧的网络鉴权方法的流程图；
图4是本申请一示例性实施例提供的一种应用网络设备的场景示意图；
图5是本申请一示例性实施例提供的一种网络鉴权方法的流程图；
图6是本申请一示例性实施例提供的另一种网络鉴权方法的流程图；
图7是本申请一示例性实施例提供的一种基于服务端侧的电子设备的结构示意图；
图8是本申请一示例性实施例提供的一种基于服务端侧的网络鉴权装置的框图；
图9是本申请一示例性实施例提供的一种基于网络设备客户端侧的电子设备的结构示意图；
图10是本申请一示例性实施例提供的一种基于网络设备客户端侧的网络鉴权装置的框图；
图11是本申请一示例性实施例提供的一种基于用户客户端侧的电子设备的结构示意图；
图12是本申请一示例性实施例提供的一种基于用户客户端侧的网络鉴权装置的框图。
具体实施方式
图1是本申请一示例性实施例提供的一种基于服务端侧的网络鉴权方法的流程图。如图1所示，该方法应用于服务端，可以包括以下步骤：
步骤102，预设移动化企业办公平台的服务端接收到网络设备发送的鉴权请求，所述鉴权请求中包含用户设备的唯一设备标识。
在本实施例中，移动化企业办公平台不仅可以实现通讯功能，还可以作为诸多其他功能的集成化功能平台，比如对于审批事件(如请假、办公物品申领、财务等审批事件)、考勤事件、任务事件、日志事件等企业内部事件的处理，再比如订餐、采购等企业外部事件的处理，本申请并不对此进行限制。
较为具体地，移动化企业办公平台可以承载于相关技术中的即时通讯应用，比如企业即时通讯(Enterprise Instant Messaging，EIM)应用，例如Skype For
Figure PCTCN2018071707-appb-000001
Microsoft 
Figure PCTCN2018071707-appb-000002
Figure PCTCN2018071707-appb-000003
等。当然，即时通讯功能仅为移动化企业办公平台支持的通讯功能之一，该企业办公平台还能够实现更多诸如上述的其他功能，此处不再赘述。
在本实施例中，唯一设备标识能够唯一地指示和确定出相应的用户设备，即唯一设备标识与用户设备之间一一对应。所有具备唯一性的标识信息均能够作为上述的唯一设备标识，本申请并不对此进行限制；举例而言，该唯一设备标识可以为用户设备的MAC(Media Access Control，介质访问控制)地址、序列号等。
步骤104，根据与所述网络设备存在绑定关系的预设团体，所述服务端中预先记录 的所述预设团体的关联用户的身份信息与唯一设备标识之间的映射关系，以及各个身份信息对应的网络访问权限，所述服务端确定对所述用户设备的唯一设备标识的鉴权结果。
在本实施例中，由于网络设备仅能够覆盖其安装位置附近的一定范围，即只有该范围内的用户设备能够接入该网络设备，因而网络设备通常被绑定至预设团体，并安装在该预设团体的工作范围内，以供该预设团体的关联用户进行接入并实施网络访问操作。其中，“团体”可以指企业、学校、医院、部队、政府机关等各种组织，这些形式的团体均可以采用上述的移动化企业办公平台，以实现本申请的技术方案。
在本实施例中，服务端预先记录预设团体的每一关联用户与相应的唯一设备标识之间的映射关系，以便于后续根据已记录的该映射关系，对网络设备发送的用户设备的唯一设备标识进行鉴权。其中，服务端在接收到电子设备发送的通告消息时，根据该通告消息中包含的该电子设备上运行的移动化企业办公平台的用户客户端上登录的身份信息和该电子设备的唯一设备标识，将该通告消息中包含的身份信息与唯一设备标识记录为相应的映射关系。当然，在其他情况下，还可以由该预设团体的管理用户手动创建该映射关系，或者对服务端中已经记录的映射关系进行编辑。
在本实施例中，预设团体的关联用户可以包括以下至少之一：预设团体的内部成员、预设团体的外部联系人(比如与该预设团体存在关联关系的其他团体的内部成员，譬如该其他团体与该预设团体之间存在合作关系等)、预设团体的外部访客等，当然其他类型的关联用户也可以适应于本申请的技术方案中，本申请并不对此进行限制。
在本实施例中，由于同一用户设备可以被多个关联用户进行账号登录，而同一关联用户也可以在多台用户设备上进行账号登录，使得服务端可能同时存在多个对应于该用户设备的唯一设备标识的映射关系，那么服务端可以选取最近记录的映射关系，以确定该用户设备的唯一设备标识对应的鉴权结果。实际上，用户设备在检测到用户登录行为或者对网络设备的接入指令时，可以通过向服务端发送上述的通告消息，使得服务端对该用户设备对应的映射关系进行更新，从而确保用于鉴权的映射关系对应于该用户设备上当前登录的关联用户，而避免应用其他关联用户对应的网络访问权限进行鉴权。
步骤106，所述服务端向所述网络设备返回所述鉴权结果，以指示所述网络设备根据所述鉴权结果控制所述用户设备的网络访问操作。
相应地，图2是本申请一示例性实施例提供的一种基于网络设备客户端侧的网络鉴权方法的流程图。如图2所示，该方法应用于网络设备客户端，可以包括以下步骤：
步骤202，当被绑定至预设团体的网络设备检测到用户设备接入时，所述网络设备 上运行的网络设备客户端获取所述用户设备的唯一设备标识。
在本实施例中，网络设备客户端可以为基于移动化企业办公平台的客户端，也可以为其他任意形式的客户端，只要能够配合于服务端对用户设备进行鉴权和网络访问控制即可，本申请并不对此进行控制。当然，当网络设备客户端为基于移动化企业办公平台的客户端时，该网络设备客户端内置有配合于服务端的控制逻辑，更加易于实现基于本申请的技术方案。
在本实施例中，网络设备可以包括任意实现网络接入功能的电子设备，比如AP设备等，本申请并不对此进行限制。
步骤204，所述网络设备客户端向预设移动化企业办公平台的服务端发送包含所述用户设备的唯一设备标识的鉴权请求，所述鉴权请求用于指示所述服务端根据预存储的所述预设团体的关联用户的身份信息与唯一设备标识之间的映射关系，以及各个身份信息对应的网络访问权限，对所述用户设备的唯一设备标识进行鉴权。
步骤206，所述网络设备客户端接收所述服务端返回的对所述用户设备的唯一设备标识的鉴权结果，并根据所述鉴权结果控制所述用户设备的网络访问操作。
在本实施例中，网络设备客户端可以根据所述鉴权结果中包含的权限选项的取值，控制所述网络访问操作；其中，权限选项可以包括以下至少之一：
1)是否具有权限。当具有权限时，可以直接开放网络访问，也可以结合其他权限选项做进一步的访问控制；当不具有权限时，可以直接拒绝网络访问。
2)权限有效时长。比如当关联用户为访客时，限制其只能够在当天内实现网络访问。那么，当未超出权限有效时长时，可以直接开放网络访问，也可以结合其他权限选项做进一步的访问控制；当超出权限有效时长时，可以直接拒绝网络访问。
3)权限剩余使用次数。比如针对临时申请的网络权限，可以限制其权限剩余使用次数为1，即用户仅能够单次接入该网络设备并实现网络访问；其中，当关联用户每次接入网络设备并实现网络访问后，相应的权限剩余使用次数自减1，以实现对该权限剩余使用次数的管理。那么，当权限剩余使用次数不为零时，可以直接开放网络访问，也可以结合其他权限选项做进一步的访问控制；当权限剩余使用次数为零时，可以直接拒绝网络访问。
4)允许访问的网络范围。网络可以被预先划分为多个范围，比如预设团体的内部局域网络、该预设团体外部的公共网络、公共网络中的国内范围、公共网络中的国外范围等，从而对网络访问操作做更为详细地权限控制，此处不再赘述。
相应地，图3是本申请一示例性实施例提供的一种基于用户客户端侧的网络鉴权方法的流程图。如图3所示，该方法应用于用户客户端，可以包括以下步骤：
步骤302，电子设备上运行的预设移动化企业办公平台的用户客户端确定已登录用户的身份信息。
在本实施例中，移动化企业办公平台的客户端的应用程序可以被预先安装在电子设备上，使得该客户端可以在该电子设备上被启动并运行；当然，当采用诸如HTML5技术的在线“客户端”，无需在电子设备上安装相应的应用程序，即可获得并运行该客户端。当网络设备客户端为移动化企业办公平台的客户端时，同样适用于上述描述，此处不再赘述。
步骤304，所述用户客户端向所述移动化企业办公平台的服务端发送通告消息，所述通告消息中包含所述身份信息与所述电子设备的唯一设备标识，以由所述服务端记录所述身份信息与所述电子设备之间的映射关系。
在本实施例中，服务端记录的映射关系，即上述图1和图2所示实施例中的映射关系，该映射关系用于指示服务端将该身份信息在预设团体中的网络访问权限适用于电子设备(根据映射关系中记录的唯一设备标识，可以确定出该电子设备)，以控制该电子设备基于该预设团体下的网络设备实现的网络访问操作。
在一实施例中，电子设备可以在用户客户端检测到用户登录行为时，发送上述的通告消息。那么，只要电子设备上登录的用户账号发生变化时，即可根据当前登录的用户账号对应的身份信息与该电子设备的唯一设备标识之间的对应关系，对服务端记录的映射关系进行更新，从而确保服务端能够使用最新的映射关系对该电子设备进行鉴权。
在另一实施例中，电子设备可以在用户客户端检测到针对任一网络设备的接入指令时，发送上述的通告消息。那么，当该电子设备未接入网络设备时发生账号变更时，即便没有在发生用户登录行为时发送通告消息，也可以通过在检测到接入指令时发送通告消息，以使得服务端对记录的映射关系进行及时更新，从而确保利用最新的映射关系对该电子设备进行鉴权。
由以上技术方案可见，本申请通过在服务端预存储身份信息与设备MAC地址之间的映射关系，使得网络设备只需要获取用户设备的MAC地址，即可由服务端根据预存储的映射关系进行鉴权，不仅可以简化服务端对用户设备的鉴权过程、提升对用户设备的鉴权效率，而且可以避免部署PKI系统、降低整体系统的投入和复杂程度。
图4是本申请一示例性实施例提供的一种应用网络设备的场景示意图。如图4所示， 假定作为网络设备的AP设备41被安装在企业AA的办公区域42内的A点处，该AP设备41可以在范围40(以A点为圆心、发射半径d为范围半径)内发射Beacon(信标)帧信号，以使得该范围40内的电子设备可以通过扫描到该Beacon帧信号，实现对该AP设备41的接入；当然，电子设备可以采用主动扫描的方式，以实现对AP设备41的扫描和接入，本申请并不对此进行限制。例如，当用户位于范围40内的B点时，该用户使用的手机43可以扫描并接入AP设备41，而手机43、AP设备41可以分别与服务器44实现数据交互，并进而实现本申请的网络鉴权方案。
其中，服务器44可以为包含一独立主机的物理服务器，或者该服务器44可以为主机集群承载的虚拟服务器，或者该服务器44可以为云服务器。在运行过程中，服务器44可以运行某一应用的服务器侧的程序，以实现该应用的相关业务功能，比如网络鉴权功能等。
手机43只是用户可以使用的一种类型的电子设备。实际上，用户显然还可以使用诸如下述类型的电子设备：平板设备、笔记本电脑、掌上电脑(PDAs，Personal Digital Assistants)、可穿戴设备(如智能眼镜、智能手表等)等，本申请并不对此进行限制。在运行过程中，该电子设备可以运行某一应用的客户端侧的程序，以实现该应用的相关业务功能，比如上述的网络鉴权功能等。
而对于手机43(或AP设备41)与服务器44之间进行交互的网络，可以包括多种类型的有线或无线网络。在一实施例中，该网络可以包括公共交换电话网络(Public Switched Telephone Network，PSTN)和因特网。
为了便于理解，以企业即时通讯应用“企业微信”为例，假定手机43和AP设备41上分别运行有企业微信客户端、服务器44上运行有企业微信服务端，其中手机43上的企业微信客户端登录有使用者的注册账号，即手机43被配置为该使用者的企业微信客户端。下面以用户通过手机43接入AP设备41进行网络访问的过程为例，结合图5-6对本申请的技术方案进行详细说明；其中，图5是本申请一示例性实施例提供的一种网络鉴权方法的流程图。如图5所示，该方法可以包括以下步骤：
步骤502，手机43检测到用户登录行为。
在本实施例中，当发生用户登录行为时，就可能发生对用户账号的更换，因而手机43上运行的企业微信客户端可以通过对用户登录行为进行监测，并据此发送下述的通告消息，以确保及时更新服务器44运行的企业微信服务端上记录的映射关系。
步骤504，手机43向服务器44发送通告消息，该通告消息中包含已登录账号的身 份信息和手机43的MAC地址。
在本实施例中，手机43上运行的企业微信客户端获取已登录账号的身份信息，并生成包含该身份信息的通告消息；同时，该通告消息本身就包含该手机43的MAC地址(即源MAC地址)，因而该通告消息中同时包含已登录账号的身份信息和手机43的MAC地址，而不需要该企业微信客户端主动将MAC地址添加至该通告消息中。
步骤506，服务器44根据通告消息中包含的身份信息和MAC地址，记录相应的映射关系。
在本实施例中，如果服务器44中并未记录有通告消息中包含的身份信息与MAC地址之间的映射关系，服务器44可以创建该映射关系；而当服务器44中已经记录有该通告消息中包含的身份信息与MAC地址之间的映射关系，则服务器44可以更新该映射关系的记录时刻。
在本实施例中，同一用户账号可以分别在多个电子设备上登录，因而对于通告消息中包含的身份信息而言，服务器44上可以分别记录该身份信息与多个MAC地址之间的映射关系。类似地，同一电子设备上可以分别登录不同的用户账号，因而对于通告消息中包含的MAC地址而言，服务器44上可以分别记录该MAC地址与多个身份信息之间的映射关系。
需要指出的是：上述的步骤502-506，描述了服务器44记录映射关系的过程，该过程可以发生于步骤512之前(以确保该映射关系可以被应用于步骤512中的鉴权操作)的任意时刻，该任意时刻在图5所示的实施例中由步骤502中对用户登录行为的检测时刻而决定。
步骤508，手机43与AP设备41之间建立WIFI连接。
在本实施例中，手机43可以通过主动扫描(scanning)或被动扫描的方式，扫描到AP设备41，并基于接入指令而接入该AP设备41，从而在手机43与AP设备41之间建立WIFI连接。
其中，接入指令可以由手机43的使用者发出，比如手机43可以示出扫描到的所有AP设备，而当该使用者选中AP设备41时，手机43可以确定接收到针对该AP设备41的接入指令。接入指令也可以由手机43自动生成，比如在先前对AP设备41的接入过程中，将接入操作设置为“自动接入”模式，那么手机43在后续扫描到该AP设备41且未接入其他AP设备时，手机43将自动生成或判定为已生成接入指令，并自动接入该AP设备41。
步骤510，AP设备41获取手机43的MAC地址，并向服务器44发送关于该MAC地址的鉴权请求。
步骤512，服务器44根据记录的映射关系，对手机43进行鉴权。
在本实施例中，假定AP设备41被预先绑定至企业AA，比如由该企业AA的管理用户在企业微信上对该AP设备41进行绑定，则服务器44上记录有AP设备41与企业AA之间的绑定关系，同时该服务器44上还记录有：该企业AA的所有关联用户对应的映射关系，以及各个关联用户的网络访问权限。
一种情况下，假定服务器44接收到手机43的MAC地址后，并未查找到匹配于该MAC地址的映射关系，或者与匹配于该MAC地址的映射关系中，身份信息并非企业AA的关联用户，那么服务器44可以判定该手机43没有网络访问权限，即鉴权结果为鉴权失败。
另一种情况下，假定服务器44接收到手机43的MAC地址后，查找到匹配于该MAC地址的映射关系，且映射关系中记录的身份信息属于企业AA的关联用户，那么：
如果企业AA的所有关联用户的网络访问权限都相同，服务器44可以判定手机43鉴权通过，并向AP设备41返回相应的鉴权结果，使得AP设备41开放手机43的网络访问权限，例如允许该手机43从企业AA内部对外部的公共网络进行访问。
如果企业AA中的各类关联用户的网络访问权限不同，比如当企业AA中的关联用户包括内部成员、外部联系人、外部访客等多种类型时，可以进一步根据匹配于手机43的MAC地址的映射关系中记录的身份信息，确定该身份信息所属的关联用户类型，从而根据该关联用户类型对应的网络访问权限，向AP设备41返回相应的鉴权结果，以使得AP设备41可以根据该鉴权结果控制手机43的网络访问操作。当然，同一类别的关联用户可以被进一步划分为多个子类别，比如将内部成员进一步划分为管理类、研发类、销售类等，且每一子类别的关联用户可以具有相应的网络访问权限，而服务器44同样可以据此发送相应的鉴权结果，此处不再赘述。
在本实施例中，服务器44可能仅查找到一个匹配于手机43的MAC地址的映射关系，则服务器44可以直接根据该映射关系中记录的关联用户的身份信息，对手机43进行鉴权。而服务器44也可能同时查找到多个匹配于手机43的MAC地址的映射关系，则服务器44可以选取最近记录的映射关系，以对手机43进行鉴权。
其中，最近记录的映射关系，即最后编辑时刻最近的映射关系，该最后编辑时刻可以为创建时刻或更新时刻。假定服务器44接收到包含身份信息1与MAC地址1的通告 消息，在时刻1创建了身份信息1与MAC地址1之间的映射关系1，则该映射关系1的最后编辑时刻为该创建时刻即时刻1；而当服务器44再次接收到包含身份信息1与MAC地址1的通告消息时，服务器44可以在时刻2对该映射关系1的最后编辑时刻进行更新，则最后编辑时刻由创建时刻变化为更新时刻(即执行更新操作的时刻)即时刻2；类似地，当服务器44又一次接收到包含身份信息1与MAC地址1的通告消息时，服务器44可以在时刻3对该映射关系1的最后编辑时刻进行更新，则最后编辑时刻由时刻2变化为更新时刻(即执行更新操作的时刻)即时刻3。
步骤514，服务器44将鉴权结果发送至AP设备41。
步骤516，AP设备41根据鉴权结果对手机43进行权限控制，以管理其网络访问操作。
在本实施例中，鉴权结果中可以包含若干权限选项，而AP设备41可以根据该权限选项的取值，控制手机43的网络访问操作；其中，该权限选项包括以下至少之一：是否具有权限、权限有效时长、权限剩余使用次数、允许访问的网络范围，当然还可以采用更多类型的权限选项，本申请并不对此进行限制。
在较为简单的权限管理逻辑中，鉴权结果可以仅包含“是否具有权限”，比如当取值为1时表示具有权限、取值为0时表示没有权限，则AP设备41可以在取值为1时，允许手机43进行完全的网络访问操作，而当取值为0时，拒绝手机43进行任何网络访问操作。
在较为复杂的权限管理逻辑时，鉴权结果可以同时包含多种权限选项。例如：
当鉴权结果中同时包含“是否具有权限”、“允许访问的网络范围”时，如果“是否具有权限”的取值表示具有权限、“允许访问的网络范围”的取值表示内部局域网和外部公共网络，则允许手机43对内部局域网和外部公共网络进行网络访问操作；如果“是否具有权限”的取值表示具有权限、“允许访问的网络范围”的取值表示内部局域网，则允许手机43对内部局域网进行网络访问操作、限制手机43对外部公共网络的访问；如果“是否具有权限”的取值表示没有权限，则不论“允许访问的网络范围”的取值为何，均拒绝手机43进行任何网络访问操作；其他情况不再一一赘述。
当鉴权结果中同时包含“是否具有权限”、“权限有效时长”、“允许访问的网络范围”时，如果“是否具有权限”的取值表示具有权限、“权限有效时长”的取值表示未超时、“允许访问的网络范围”的取值表示内部局域网和外部公共网络，则允许手机43对内部局域网和外部公共网络进行网络访问操作；如果“是否具有权限”的取值表示 具有权限、“权限有效时长”的取值表示已超时，则不论“允许访问的网络范围”的取值为何，均拒绝手机43进行任何网络访问操作；其他情况不再一一赘述。
当然，可以通过任意多种权限选项之间的组合应用，实现不同方式的权限管理，以满足不同场景下的权限管理需求，此处不再一一赘述，且本申请并不对此进行限制。
在图5所示的实施例中，手机43可以将“检测到用户登录行为”作为触发条件，向服务器44发送通告消息，以使得服务器44可以对手机43对应的映射关系进行创建或更新：如果用户账号在手机43上首次登录(首次在手机43上登录，但是可能已经在其他电子设备上登录过)，则服务器44需要创建相应的映射关系，如果用户账号在手机43上并非首次登录(先前已经在手机43上执行过登录操作)，则服务器44需要对相应的映射关系进行更新(比如更新其最后编辑时刻)。
而实际上，手机43还可以基于其他条件，向服务器44发送上述的通告消息，以确保服务器44上记录的映射关系保持更新。例如图6所示，在另一示例性实施例的网络鉴权方法中，该方法可以包括以下步骤：
步骤602，手机43扫描到AP设备41。
在本实施例中，手机43可以通过主动扫描(scanning)或被动扫描的方式，扫描到AP设备41，本申请并不对此进行限制。
步骤604，手机43检测到接入指令。
在本实施例中，接入指令可以由手机43的使用者发出，比如手机43可以示出扫描到的所有AP设备，而当该使用者选中AP设备41时，手机43可以确定接收到针对该AP设备41的接入指令。接入指令也可以由手机43自动生成，比如在先前对AP设备41的接入过程中，将接入操作设置为“自动接入”模式，那么手机43在后续扫描到该AP设备41且未接入其他AP设备时，手机43将自动生成或判定为已生成接入指令，并自动接入该AP设备41。
步骤606，手机43向服务器44发送通告消息，该通告消息中包含已登录账号的身份信息和手机43的MAC地址。
在本实施例中，由于本申请希望由AP设备41对手机43进行网络访问的权限管理，因而当手机43发生用户账号登录时，如果并未检测到接入指令，表明不涉及到AP设备41对手机43的权限管理，因而手机43无需向服务器44发送通告消息。而在手机43检测到接入指令时，通过向服务器44发送通告消息，使得服务器44可以对该手机43对应的映射关系进行及时创建或更新，以确保服务器44上记录的映射关系为最新数据。
后续的步骤608-618，可以参考图5所示实施例中的步骤506-516，此处不再赘述。
综上所述，本申请基于移动化企业办公平台，可以在该移动化企业办公平台的服务端上记录身份信息与设备MAC地址之间的映射关系，并根据该映射关系对用户设备的网络访问权限进行快速鉴权，在确保网络数据安全性的情况下，有效简化了鉴权过程的复杂度，有助于提升鉴权效率。
图7示出了根据本申请的一示例性实施例的电子设备的示意结构图。请参考图7，在硬件层面，该电子设备包括处理器702、内部总线704、网络接口706、内存708以及非易失性存储器710，当然还可能包括其他业务所需要的硬件。处理器702从非易失性存储器710中读取对应的计算机程序到内存702中然后运行，在逻辑层面上形成网络鉴权装置。当然，除了软件实现方式之外，本申请并不排除其他实现方式，比如逻辑器件抑或软硬件结合的方式等等，也就是说以下处理流程的执行主体并不限定于各个逻辑单元，也可以是硬件或逻辑器件。
请参考图8，在软件实施方式中，该网络鉴权装置可以包括请求接收单元801、鉴权单元802和返回单元803。其中：
请求接收单元801，使预设移动化企业办公平台的服务端接收到网络设备发送的鉴权请求，所述鉴权请求中包含用户设备的唯一设备标识；
鉴权单元802，根据与所述网络设备存在绑定关系的预设团体，所述服务端中预先记录的所述预设团体的关联用户的身份信息与唯一设备标识之间的映射关系，以及各个身份信息对应的网络访问权限，使所述服务端确定对所述用户设备的唯一设备标识的鉴权结果；
返回单元803，使所述服务端向所述网络设备返回所述鉴权结果，以指示所述网络设备根据所述鉴权结果控制所述用户设备的网络访问操作。
可选的，还包括：
消息接收单元804，使所述服务端接收到电子设备发送的通告消息，所述通告消息中包含所述电子设备上运行的所述移动化企业办公平台的用户客户端上登录的身份信息和所述电子设备的唯一设备标识；
记录单元805，使所述服务端将所述通告消息中包含的身份信息与唯一设备标识记录为相应的映射关系。
可选的，还包括：
选取单元806，当存在多个对应于所述用户设备的唯一设备标识的映射关系时，使 所述服务端选取最近记录的映射关系，以确定所述用户设备的唯一设备标识对应的鉴权结果。
可选的，所述关联用户包括以下至少之一：所述预设团体的内部成员、所述预设团体的外部联系人、所述预设团体的外部访客。
图9示出了根据本申请的一示例性实施例的电子设备的示意结构图。请参考图9，在硬件层面，该电子设备包括处理器902、内部总线904、网络接口906、内存908以及非易失性存储器910，当然还可能包括其他业务所需要的硬件。处理器902从非易失性存储器910中读取对应的计算机程序到内存902中然后运行，在逻辑层面上形成网络鉴权装置。当然，除了软件实现方式之外，本申请并不排除其他实现方式，比如逻辑器件抑或软硬件结合的方式等等，也就是说以下处理流程的执行主体并不限定于各个逻辑单元，也可以是硬件或逻辑器件。
请参考图10，在软件实施方式中，该网络鉴权装置可以包括获取单元1001、发送单元1002和控制单元1003。其中：
获取单元1001，当被绑定至预设团体的网络设备检测到用户设备接入时，使所述网络设备上运行的网络设备客户端获取所述用户设备的唯一设备标识；
发送单元1002，使所述网络设备客户端向预设移动化企业办公平台的服务端发送包含所述用户设备的唯一设备标识的鉴权请求，所述鉴权请求用于指示所述服务端根据预存储的所述预设团体的关联用户的身份信息与唯一设备标识之间的映射关系，以及各个身份信息对应的网络访问权限，对所述用户设备的唯一设备标识进行鉴权；
控制单元1003，使所述网络设备客户端接收所述服务端返回的对所述用户设备的唯一设备标识的鉴权结果，并根据所述鉴权结果控制所述用户设备的网络访问操作。
可选的，所述控制单元1003具体用于：
所述网络设备客户端根据所述鉴权结果中包含的权限选项的取值，控制所述网络访问操作；其中，所述权限选项包括以下至少之一：是否具有权限、权限有效时长、权限剩余使用次数、允许访问的网络范围。
图11示出了根据本申请的一示例性实施例的电子设备的示意结构图。请参考图11，在硬件层面，该电子设备包括处理器1102、内部总线1104、网络接口1106、内存1108以及非易失性存储器1110，当然还可能包括其他业务所需要的硬件。处理器1102从非易失性存储器1110中读取对应的计算机程序到内存1102中然后运行，在逻辑层面上形成网络鉴权装置。当然，除了软件实现方式之外，本申请并不排除其他实现方式，比如 逻辑器件抑或软硬件结合的方式等等，也就是说以下处理流程的执行主体并不限定于各个逻辑单元，也可以是硬件或逻辑器件。
请参考图12，在软件实施方式中，该网络鉴权装置可以包括确定单元1201和发送单元1202。其中：
确定单元1201，使电子设备上运行的预设移动化企业办公平台的用户客户端确定已登录用户的身份信息；
发送单元1202，使所述用户客户端向所述移动化企业办公平台的服务端发送通告消息，所述通告消息中包含所述身份信息与所述电子设备的唯一设备标识，以由所述服务端记录所述身份信息与所述电子设备之间的映射关系；其中，所述映射关系用于指示所述服务端将所述身份信息在预设团体中的网络访问权限适用于所述电子设备，以控制所述电子设备基于所述预设团体下的网络设备实现的网络访问操作。
可选的，所述发送单元1202通过以下方式中至少之一，使用户客户端向所述移动化企业办公平台的服务端发送通告消息：
当所述用户客户端检测到用户登录行为时，发送所述通告消息；
当所述用户客户端检测到针对任一网络设备的接入指令时，发送所述通告消息。
上述实施例阐明的系统、装置、模块或单元，具体可以由计算机芯片或实体实现，或者由具有某种功能的产品来实现。一种典型的实现设备为计算机，计算机的具体形式可以是个人计算机、膝上型计算机、蜂窝电话、相机电话、智能电话、个人数字助理、媒体播放器、导航设备、电子邮件收发设备、游戏控制台、平板计算机、可穿戴设备或者这些设备中的任意几种设备的组合。
在一个典型的配置中，计算机包括一个或多个处理器(CPU)、输入/输出接口、网络接口和内存。
内存可能包括计算机可读介质中的非永久性存储器，随机存取存储器(RAM)和/或非易失性内存等形式，如只读存储器(ROM)或闪存(flash RAM)。内存是计算机可读介质的示例。
计算机可读介质包括永久性和非永久性、可移动和非可移动媒体可以由任何方法或技术来实现信息存储。信息可以是计算机可读指令、数据结构、程序的模块或其他数据。计算机的存储介质的例子包括，但不限于相变内存(PRAM)、静态随机存取存储器(SRAM)、动态随机存取存储器(DRAM)、其他类型的随机存取存储器(RAM)、只读存储器(ROM)、电可擦除可编程只读存储器(EEPROM)、快闪记忆体或其他内存技术、 只读光盘只读存储器(CD-ROM)、数字多功能光盘(DVD)或其他光学存储、磁盒式磁带，磁带磁磁盘存储或其他磁性存储设备或任何其他非传输介质，可用于存储可以被计算设备访问的信息。按照本文中的界定，计算机可读介质不包括暂存电脑可读媒体(transitory media)，如调制的数据信号和载波。
还需要说明的是，术语“包括”、“包含”或者其任何其他变体意在涵盖非排他性的包含，从而使得包括一系列要素的过程、方法、商品或者设备不仅包括那些要素，而且还包括没有明确列出的其他要素，或者是还包括为这种过程、方法、商品或者设备所固有的要素。在没有更多限制的情况下，由语句“包括一个……”限定的要素，并不排除在包括所述要素的过程、方法、商品或者设备中还存在另外的相同要素。
这里将详细地对示例性实施例进行说明，其示例表示在附图中。下面的描述涉及附图时，除非另有表示，不同附图中的相同数字表示相同或相似的要素。以下示例性实施例中所描述的实施方式并不代表与本申请相一致的所有实施方式。相反，它们仅是与如所附权利要求书中所详述的、本申请的一些方面相一致的装置和方法的例子。
在本申请使用的术语是仅仅出于描述特定实施例的目的，而非旨在限制本申请。在本申请和所附权利要求书中所使用的单数形式的“一种”、“所述”和“该”也旨在包括多数形式，除非上下文清楚地表示其他含义。还应当理解，本文中使用的术语“和/或”是指并包含一个或多个相关联的列出项目的任何或所有可能组合。
应当理解，尽管在本申请可能采用术语第一、第二、第三等来描述各种信息，但这些信息不应限于这些术语。这些术语仅用来将同一类型的信息彼此区分开。例如，在不脱离本申请范围的情况下，第一信息也可以被称为第二信息，类似地，第二信息也可以被称为第一信息。取决于语境，如在此所使用的词语“如果”可以被解释成为“在……时”或“当……时”或“响应于确定”。
以上所述仅为本申请的较佳实施例而已，并不用以限制本申请，凡在本申请的精神和原则之内，所做的任何修改、等同替换、改进等，均应包含在本申请保护的范围之内。

Claims (16)

  1. 一种网络鉴权方法，其特征在于，包括：
    预设即时通讯应用的服务端接收到网络设备发送的鉴权请求，所述鉴权请求中包含用户设备的唯一设备标识；
    根据与所述网络设备存在绑定关系的预设团体，所述服务端中预先记录的所述预设团体的关联用户的身份信息与唯一设备标识之间的映射关系，以及各个身份信息对应的网络访问权限，所述服务端确定对所述用户设备的唯一设备标识的鉴权结果；
    所述服务端向所述网络设备返回所述鉴权结果，以指示所述网络设备根据所述鉴权结果控制所述用户设备的网络访问操作。
  2. 根据权利要求1所述的方法，其特征在于，还包括：
    所述服务端接收到电子设备发送的通告消息，所述通告消息中包含所述电子设备上运行的所述即时通讯应用的用户客户端上登录的身份信息和所述电子设备的唯一设备标识；
    所述服务端将所述通告消息中包含的身份信息与唯一设备标识记录为相应的映射关系。
  3. 根据权利要求1所述的方法，其特征在于，还包括：
    当存在多个对应于所述用户设备的唯一设备标识的映射关系时，所述服务端选取最近记录的映射关系，以确定所述用户设备的唯一设备标识对应的鉴权结果。
  4. 根据权利要求1所述的方法，其特征在于，所述关联用户包括以下至少之一：所述预设团体的内部成员、所述预设团体的外部联系人、所述预设团体的外部访客。
  5. 一种网络鉴权方法，其特征在于，包括：
    当被绑定至预设团体的网络设备检测到用户设备接入时，所述网络设备上运行的网络设备客户端获取所述用户设备的唯一设备标识；
    所述网络设备客户端向预设即时通讯应用的服务端发送包含所述用户设备的唯一设备标识的鉴权请求，所述鉴权请求用于指示所述服务端根据预存储的所述预设团体的关联用户的身份信息与唯一设备标识之间的映射关系，以及各个身份信息对应的网络访问权限，对所述用户设备的唯一设备标识进行鉴权；
    所述网络设备客户端接收所述服务端返回的对所述用户设备的唯一设备标识的鉴权结果，并根据所述鉴权结果控制所述用户设备的网络访问操作。
  6. 根据权利要求5所述的方法，其特征在于，所述根据所述鉴权结果控制所述用 户设备的网络访问操作，包括：
    所述网络设备客户端根据所述鉴权结果中包含的权限选项的取值，控制所述网络访问操作；其中，所述权限选项包括以下至少之一：是否具有权限、权限有效时长、权限剩余使用次数、允许访问的网络范围。
  7. 一种网络鉴权方法，其特征在于，包括：
    电子设备上运行的预设即时通讯应用的用户客户端确定已登录用户的身份信息；
    所述用户客户端向所述即时通讯应用的服务端发送通告消息，所述通告消息中包含所述身份信息与所述电子设备的唯一设备标识，以由所述服务端记录所述身份信息与所述电子设备之间的映射关系；其中，所述映射关系用于指示所述服务端将所述身份信息在预设团体中的网络访问权限适用于所述电子设备，以控制所述电子设备基于所述预设团体下的网络设备实现的网络访问操作。
  8. 根据权利要求7所述的方法，其特征在于，所述用户客户端向所述即时通讯应用的服务端发送通告消息，包括以下至少之一：
    当所述用户客户端检测到用户登录行为时，发送所述通告消息；
    当所述用户客户端检测到针对任一网络设备的接入指令时，发送所述通告消息。
  9. 一种网络鉴权装置，其特征在于，包括：
    请求接收单元，使预设即时通讯应用的服务端接收到网络设备发送的鉴权请求，所述鉴权请求中包含用户设备的唯一设备标识；
    鉴权单元，根据与所述网络设备存在绑定关系的预设团体，所述服务端中预先记录的所述预设团体的关联用户的身份信息与唯一设备标识之间的映射关系，以及各个身份信息对应的网络访问权限，使所述服务端确定对所述用户设备的唯一设备标识的鉴权结果；
    返回单元，使所述服务端向所述网络设备返回所述鉴权结果，以指示所述网络设备根据所述鉴权结果控制所述用户设备的网络访问操作。
  10. 根据权利要求9所述的装置，其特征在于，还包括：
    消息接收单元，使所述服务端接收到电子设备发送的通告消息，所述通告消息中包含所述电子设备上运行的所述即时通讯应用的用户客户端上登录的身份信息和所述电子设备的唯一设备标识；
    记录单元，使所述服务端将所述通告消息中包含的身份信息与唯一设备标识记录为相应的映射关系。
  11. 根据权利要求9所述的装置，其特征在于，还包括：
    选取单元，当存在多个对应于所述用户设备的唯一设备标识的映射关系时，使所述服务端选取最近记录的映射关系，以确定所述用户设备的唯一设备标识对应的鉴权结果。
  12. 根据权利要求9所述的装置，其特征在于，所述关联用户包括以下至少之一：所述预设团体的内部成员、所述预设团体的外部联系人、所述预设团体的外部访客。
  13. 一种网络鉴权装置，其特征在于，包括：
    获取单元，当被绑定至预设团体的网络设备检测到用户设备接入时，使所述网络设备上运行的网络设备客户端获取所述用户设备的唯一设备标识；
    发送单元，使所述网络设备客户端向预设即时通讯应用的服务端发送包含所述用户设备的唯一设备标识的鉴权请求，所述鉴权请求用于指示所述服务端根据预存储的所述预设团体的关联用户的身份信息与唯一设备标识之间的映射关系，以及各个身份信息对应的网络访问权限，对所述用户设备的唯一设备标识进行鉴权；
    控制单元，使所述网络设备客户端接收所述服务端返回的对所述用户设备的唯一设备标识的鉴权结果，并根据所述鉴权结果控制所述用户设备的网络访问操作。
  14. 根据权利要求13所述的装置，其特征在于，所述控制单元具体用于：
    所述网络设备客户端根据所述鉴权结果中包含的权限选项的取值，控制所述网络访问操作；其中，所述权限选项包括以下至少之一：是否具有权限、权限有效时长、权限剩余使用次数、允许访问的网络范围。
  15. 一种网络鉴权装置，其特征在于，包括：
    确定单元，使电子设备上运行的预设即时通讯应用的用户客户端确定已登录用户的身份信息；
    发送单元，使所述用户客户端向所述即时通讯应用的服务端发送通告消息，所述通告消息中包含所述身份信息与所述电子设备的唯一设备标识，以由所述服务端记录所述身份信息与所述电子设备之间的映射关系；其中，所述映射关系用于指示所述服务端将所述身份信息在预设团体中的网络访问权限适用于所述电子设备，以控制所述电子设备基于所述预设团体下的网络设备实现的网络访问操作。
  16. 根据权利要求15所述的装置，其特征在于，所述发送单元通过以下方式中至少之一，使用户客户端向所述即时通讯应用的服务端发送通告消息：
    当所述用户客户端检测到用户登录行为时，发送所述通告消息；
    当所述用户客户端检测到针对任一网络设备的接入指令时，发送所述通告消息。
PCT/CN2018/071707 2017-01-19 2018-01-08 网络鉴权方法及装置 WO2018133683A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
SG11201906323PA SG11201906323PA (en) 2017-01-19 2018-01-08 Network authentication method and apparatus
US16/516,186 US20190342289A1 (en) 2017-01-19 2019-07-18 Network Authentication Method and Apparatus

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201710039832.8 2017-01-19
CN201710039832.8A CN108337677B (zh) 2017-01-19 2017-01-19 网络鉴权方法及装置

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US16/516,186 Continuation US20190342289A1 (en) 2017-01-19 2019-07-18 Network Authentication Method and Apparatus

Publications (1)

Publication Number Publication Date
WO2018133683A1 true WO2018133683A1 (zh) 2018-07-26

Family

ID=62908432

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2018/071707 WO2018133683A1 (zh) 2017-01-19 2018-01-08 网络鉴权方法及装置

Country Status (5)

Country Link
US (1) US20190342289A1 (zh)
CN (1) CN108337677B (zh)
SG (2) SG11201906323PA (zh)
TW (1) TWI745473B (zh)
WO (1) WO2018133683A1 (zh)

Families Citing this family (14)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US11049032B2 (en) * 2017-08-24 2021-06-29 Facebook, Inc. Determining correlations between types of user identifying information maintained by an online system
CN110972093B (zh) 2018-09-28 2023-10-24 贵州白山云科技股份有限公司 一种移动办公实现方法及系统
US20200106773A1 (en) * 2018-09-29 2020-04-02 Fortinet, Inc. Device integration for a network access control server based on device mappings and testing verification
CN111464479B (zh) * 2019-01-18 2022-03-25 千寻位置网络有限公司 终端设备用户身份的识别方法及系统
CN111756721B (zh) * 2020-06-18 2023-04-25 赵旭华 一种关联认证方法、装置、iam服务器及可读存储介质
CN111737717B (zh) * 2020-06-28 2024-04-09 深信服科技股份有限公司 一种权限管控方法、系统、设备及计算机可读存储介质
US12081979B2 (en) 2020-11-05 2024-09-03 Visa International Service Association One-time wireless authentication of an Internet-of-Things device
CN116349269A (zh) * 2020-11-23 2023-06-27 Oppo广东移动通信有限公司 异构网络设备的控制方法、装置、设备及存储介质
CN112637378B (zh) * 2020-12-23 2023-02-03 携程旅游信息技术（上海）有限公司 基于用户的网络地址关联方法、系统、设备及存储介质
CN113034771B (zh) * 2021-03-12 2023-06-02 浙江大华技术股份有限公司 基于人脸识别的过闸方法、装置、设备及计算机存储介质
CN113746684B (zh) * 2021-09-18 2022-10-21 中国工商银行股份有限公司 一种网络设备纳管方法、装置、计算机设备及存储介质
CN114666129B (zh) * 2022-03-23 2024-02-20 深圳供电局有限公司 网络安全认证方法、系统、计算机设备、存储介质
CN114745169A (zh) * 2022-04-06 2022-07-12 北京天融信网络安全技术有限公司 基于nat映射的多端口访问方法、装置、设备、介质和产品
CN115495716B (zh) * 2022-08-15 2023-10-10 荣耀终端有限公司 一种本地鉴权方法和电子设备

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102404738A (zh) * 2010-09-14 2012-04-04 中国移动通信集团山东有限公司 一种接入、退出wlan网络的方法、系统及认证服务器
CN104104654A (zh) * 2013-04-07 2014-10-15 阿里巴巴集团控股有限公司 一种设置Wifi访问权限、Wifi认证的方法和设备
CN105307169A (zh) * 2015-09-18 2016-02-03 腾讯科技（深圳）有限公司 访客网络的接入方法、装置和系统

Family Cites Families (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7185360B1 (en) * 2000-08-01 2007-02-27 Hereuare Communications, Inc. System for distributed network authentication and access control
JP2005204189A (ja) * 2004-01-19 2005-07-28 Hitachi Communication Technologies Ltd アクセスユーザ管理システム、アクセスユーザ管理装置
TW201121280A (en) * 2009-12-10 2011-06-16 Mao-Cong Lin Network security verification method and device and handheld electronic device verification method.
US9178889B2 (en) * 2013-09-27 2015-11-03 Paypal, Inc. Systems and methods for pairing a credential to a device identifier
CN104519020B (zh) * 2013-09-29 2017-10-13 阿里巴巴集团控股有限公司 管理无线网络登录密码分享功能的方法、服务器及系统

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102404738A (zh) * 2010-09-14 2012-04-04 中国移动通信集团山东有限公司 一种接入、退出wlan网络的方法、系统及认证服务器
CN104104654A (zh) * 2013-04-07 2014-10-15 阿里巴巴集团控股有限公司 一种设置Wifi访问权限、Wifi认证的方法和设备
CN105307169A (zh) * 2015-09-18 2016-02-03 腾讯科技（深圳）有限公司 访客网络的接入方法、装置和系统

Also Published As

Publication number Publication date
TW201828645A (zh) 2018-08-01
SG10202107770WA (en) 2021-09-29
US20190342289A1 (en) 2019-11-07
CN108337677A (zh) 2018-07-27
TWI745473B (zh) 2021-11-11
CN108337677B (zh) 2020-10-09
SG11201906323PA (en) 2019-08-27

Similar Documents

Publication Publication Date Title
WO2018133683A1 (zh) 网络鉴权方法及装置
US11075903B2 (en) Facilitation of service login
US10853511B2 (en) Securely accessing and processing data in a multi-tenant data store
US9374369B2 (en) Multi-factor authentication and comprehensive login system for client-server networks
TWI761385B (zh) 設備配置方法及裝置、系統
US10728234B2 (en) Method, system and device for security configurations
JP2021512380A (ja) 資産管理方法および装置、ならびに電子デバイス
US8590007B2 (en) Method and system for authenticating internet user identity
US20100274859A1 (en) Method And System For The Creation, Management And Authentication Of Links Between Entities
US11978053B2 (en) Systems and methods for estimating authenticity of local network of device initiating remote transaction
US10554645B2 (en) Method for authenticating internet users
CN104159225A (zh) 一种基于无线网络的实名制管理方法及系统
US11727101B2 (en) Methods and systems for verifying applications
EP3552135B1 (en) Integrated consent system
US20240163279A1 (en) Systems and methods for securing login access
US20220116404A1 (en) Methods and systems for adaptive multi-factored geo-location based document access rights management and enforcement
KR20190069574A (ko) 무선 네트워크 유형 검출 방법과 장치, 및 전자 디바이스
US10341114B2 (en) Providing device, terminal device, providing method, non-transitory computer readable storage medium, and authentication processing system
CA3032876A1 (en) System for managing jointly accessible data
US20240275794A1 (en) Limiting discovery of a protected resource in a zero trust access model
WO2017020551A1 (zh) 一种用于管理无线接入点的方法和设备
US9336375B1 (en) Restricting access to data on portable storage media based on access to a private intranet
US11978052B2 (en) Method for validating electronic transactions
US20240031169A1 (en) Methods of authenticating the identity of a computer

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 18741855

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 18741855

Country of ref document: EP

Kind code of ref document: A1