WO2018196329A1 - 接入设备、认证服务器、终端设备接入控制方法及系统 - Google Patents

接入设备、认证服务器、终端设备接入控制方法及系统 Download PDF

Info

Publication number
WO2018196329A1
WO2018196329A1 PCT/CN2017/109984 CN2017109984W WO2018196329A1 WO 2018196329 A1 WO2018196329 A1 WO 2018196329A1 CN 2017109984 W CN2017109984 W CN 2017109984W WO 2018196329 A1 WO2018196329 A1 WO 2018196329A1
Authority
WO
WIPO (PCT)
Prior art keywords
access
terminal device
local area
area network
network
Prior art date
Application number
PCT/CN2017/109984
Other languages
English (en)
French (fr)
Inventor
李晓龙
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Priority to EP17907831.6A priority Critical patent/EP3618477A4/en
Publication of WO2018196329A1 publication Critical patent/WO2018196329A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H04W12/069—Authentication using certificates or pre-shared keys
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W48/00—Access restriction; Network selection; Access point selection
    • H04W48/16—Discovering, processing access restriction or access information
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0876—Network architectures or network communication protocols for network security for authentication of entities based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/08—Access security
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W84/00—Network topologies
    • H04W84/02—Hierarchically pre-organised networks, e.g. paging networks, cellular networks, WLAN [Wireless Local Area Network] or WLL [Wireless Local Loop]
    • H04W84/10—Small scale networks; Flat hierarchical networks
    • H04W84/12—WLAN [Wireless Local Area Networks]

Definitions

  • the present application relates to the field of local area network applications, and in particular, to an access device, an authentication server, a terminal device access control method and system, and a computer storage medium.
  • the embodiment of the present application provides an access device, an authentication server, a terminal device access control method and system, and a computer storage medium, so as to at least solve the problem that the prior art uses only wireless parameters of the wireless local area network to authenticate the user, resulting in low security.
  • the problem is to at least solve the problem that the prior art uses only wireless parameters of the wireless local area network to authenticate the user, resulting in low security.
  • a terminal device access control method including:
  • the access request is a request for the terminal device to access the wireless local area network according to the access parameter of the wireless local area network;
  • a control operation corresponding to the judgment result is performed on the terminal device.
  • a terminal device access control method including:
  • the device identifier of the network device is sent to the access device of the public local area network, and the public local area network is formed by the wireless local area network provided by at least two access devices.
  • a terminal device access control method including:
  • the authentication server acquires the device identifier of the network device, and sends the device identifier of the network device to the access device of the public local area network, where the public local area network is formed by the wireless local area network provided by the at least two access devices;
  • the access device After detecting the access request of the terminal device to access the wireless local area network, the access device obtains the device identifier of the terminal device, and determines whether the terminal device is an in-network device according to the device identifier of the terminal device and the device identifier of the network device; The device performs a control operation corresponding to the judgment result.
  • an access device including: a communication module and a processor, where
  • the communication module is configured to provide a wireless local area network and communicate with the terminal device and the authentication server;
  • the processor is configured to: after detecting the access request of the terminal device to access the wireless local area network, obtain the device identifier of the terminal device, and determine, according to the device identifier of the terminal device and the device identifier of the network device, whether the terminal device is an in-network device; A control operation corresponding to the judgment result is performed on the terminal device.
  • an authentication server including: an authentication module and a processor, where
  • the authentication module is configured to communicate with the access device
  • the processor is configured to acquire the device identifier of the network device, and send the device identifier of the network device to the access device of the public local area network; the public local area network is formed by the wireless local area network provided by the at least two access devices.
  • a terminal device access control system including: an authentication server provided by an embodiment of the present application, and multiple access devices, where a wireless local area network of multiple access devices forms a public local area network; At least one access device provided by the embodiment of the present application, where
  • the authentication server is configured to acquire the device identifier of the network device, and send the device identifier of the network device to the access device of the public local area network;
  • the access device is configured to obtain the device identifier of the terminal device after detecting the access request of the terminal device to access the wireless local area network, and determine whether the terminal device is the in-network device according to the device identifier of the terminal device and the device identifier of the network device. A control operation corresponding to the judgment result is performed on the terminal device.
  • a computer storage medium in another aspect, storing computer executable instructions configured to perform the aforementioned terminal device access control method.
  • the embodiment of the present application provides an access device, an authentication server, a terminal device access control method and system, and a computer storage medium, wherein the method detects that a terminal device requests access to a wireless local area network according to an access parameter of a wireless local area network.
  • the device identifier is obtained, and the terminal device is determined to be an in-network device.
  • different control operations are performed on the terminal device. For example, when the device is in the network device, the terminal device is directly accessed.
  • the device is authenticated, it will be authenticated by the authentication server, and the terminal device will be accessed only when the authentication is passed. Thus, even if the wireless parameter of the access device providing the wireless local area network is leaked, the illegal terminal device is in use.
  • the terminal device authentication is not denied access, and the access parameter of the existing access device that only authenticates the access parameters of the WLAN is resolved, so that the illegal user can access the WLAN at any time.
  • the resulting wireless LAN security problem is low.
  • FIG. 1 is a schematic diagram of networking of a terminal device access control system according to a first embodiment of the present disclosure
  • FIG. 2 is a structural block diagram of an access device according to a first embodiment of the present application.
  • FIG. 3 is a first flowchart of a terminal device access control method according to a first embodiment of the present disclosure
  • FIG. 4 is a second flowchart of a terminal device access control method according to a first embodiment of the present disclosure
  • FIG. 5 is a schematic diagram of networking of a terminal device access control system according to a second embodiment of the present disclosure
  • FIG. 6 is a structural block diagram of an access device according to a second embodiment of the present application.
  • FIG. 7 is a structural block diagram of an authentication server according to a second embodiment of the present application.
  • FIG. 8 is a flowchart of a terminal device access control method according to a second embodiment of the present application.
  • FIG. 9 is a general flowchart of a terminal device access control method according to a second embodiment of the present application on an access device side;
  • FIG. 10 is a second flowchart of a terminal device access control method according to a second embodiment of the present disclosure.
  • FIG. 11 is a first flowchart of a terminal device access control method according to a second embodiment of the present application on an authentication server side;
  • FIG. 12 is a second flowchart of a terminal device access control method according to a second embodiment of the present application on an authentication server side;
  • FIG. 13 is a schematic diagram of networking of a terminal device access control system according to a third embodiment of the present disclosure.
  • FIG. 14 is a first flow chart of a terminal device access control method according to a third embodiment of the present disclosure Figure
  • FIG. 15 is a second flowchart of a terminal device access control method according to a third embodiment of the present disclosure.
  • 16 is a schematic diagram of determining a home wireless local area network of a terminal according to an embodiment of the present application.
  • 17 is a schematic diagram of forming a public local area network by using a wireless local area network according to an embodiment of the present application.
  • FIG. 18 is a first flowchart of a terminal device access control method according to a second embodiment of the present application on an access device side.
  • This application is mainly used in application scenarios such as hotels and shopping malls.
  • a small range of wireless LANs provided by multiple access devices are required to form a large-scale local area network.
  • this wide-area local area network becomes the current local area network.
  • the coverage of the WLAN provided by the neighboring access devices may overlap.
  • the present application provides a new method for dividing the WLAN of the terminal device.
  • the access device 1 and the access device 2 respectively provide a wireless local area network 1 and a wireless local area network 2 partially overlapping each other.
  • the wireless local area network connection constitutes a boundary of the home wireless local area network, in the area.
  • the terminal device a in the range A belongs to the wireless local area network 1
  • the terminal device b in the area B belongs to the wireless local area network 2; the division mode of the terminal device belonging to the wireless local area network is simple.
  • the access device 1, the access device 2, the access device 3, and the access device 4 respectively provide a wireless local area network 1, a wireless local area network 2, a wireless local area network 3, and a wireless local area network. 4.
  • the wireless local area network 1, the wireless local area network 2, the wireless local area network 3, and the wireless local area network 4 are then overlapped or covered with each other to form a public local area network C.
  • the access device 1, the access device 2, the access device 3, and the access device 4 is another access device forming a public local area network.
  • the determined access device of the public local area network C includes the access device 1, the access device 2, the access device 3, and the access device 4.
  • the first predetermined duration and the second predetermined duration involved in the present application may be set according to experience and needs.
  • the first predetermined duration may be set to be a normal user walking from the first wireless local area network to the second wireless local area network.
  • the time is generally 10 minutes
  • the second predetermined duration can be set to the time when the normal user goes out to work, such as 24 hours.
  • the device identifiers referred to in this application refer to the only parameters that can determine the identity of the user, such as the MAC address (Media Access Control address, media access control address) of the device, and the SIM (Subscriber Identity Module). ) The phone number corresponding to the card.
  • the network device referred to in this application refers to a device that has access to a small range of wireless local area network provided by an access device in the current local area network, and correspondingly, the terminal device is an in-network device and represents a terminal device.
  • the switching behavior of switching from the wireless LAN 1 in the public local area network C to the wireless local area network 2 or the like occurs, or the behavior of re-accessing the local area network after returning from the public local area network C after a short period (less than the second predetermined time length) occurs, and the terminal device is not in the network.
  • the device represents the behavior of the terminal device accessing the wireless local area network in the public local area network C for the first time, and the behavior of re-accessing the local area network after returning from the public local area network C after the timeout (greater than the second predetermined time length).
  • the implementation of the device identifier of the network device in the present application may be a method of setting a legal user, where the setting of the legal user means that some users are legal users, and the device identifiers of these users are recorded as The device ID of the legal user, and the device ID of the network device is specifically the device ID of the legal user.
  • the specific implementation is as follows, and details are not described in detail.
  • the terminal device access control system provided in this embodiment includes: multiple access devices, multiple accesses.
  • the wireless local area network of the device forms a public local area network; wherein the access devices communicate directly or indirectly through third-party devices for data interaction;
  • the access device is configured to provide a wireless local area network; after detecting the access request of the terminal device to access the wireless local area network, obtain the device identifier of the terminal device, and determine whether the device identifier is the device identifier of the network device, and if yes, connect the terminal device
  • the wireless local area network provides a wireless access service for the terminal device, wherein the access request is a request for the terminal device to access the wireless local area network according to the access parameter of the wireless local area network, such as the network name and the access password.
  • the method provided by the present application has at least the advantage that, after the access request of the terminal device is authenticated, the device identifier of the terminal device needs to be authenticated, and only the device identifier is allowed to be accessed.
  • the illegal terminal device accesses the wireless local area network when using the wireless parameter, and the device identifier of the device not being used by the network device is rejected.
  • the access problem solves the problem that the access parameters of the existing access device only authenticate the access parameters of the wireless local area network are leaked, so that the illegal user can access the wireless local area network at any time to achieve low security of the wireless local area network.
  • the access device provided in this embodiment includes: a network local area network module 21, an access control module 22, and a service providing module 23, wherein ,
  • the network local area network module 21 is configured to provide a wireless local area network
  • the access control module 22 is configured to obtain the device identifier of the terminal device after detecting the access request of the terminal device to access the wireless local area network, and determine whether the device identifier is the device identifier of the network device. If yes, the trigger service providing module 23 connects the terminal device to the wireless local area network; the access request is a request for the terminal device to access the wireless local area network according to the access parameter of the wireless local area network;
  • the service providing module 23 is configured to connect the terminal device to the wireless local area network to provide a wireless access service for the terminal device.
  • the access device in the foregoing embodiment further includes a storage module, where:
  • the storage module is configured to store a list of legal user information.
  • the legal user information list includes at least one legal user information item.
  • the legal user information item includes the device ID and resource usage information of the legal user.
  • the resource usage information includes the terminal Internet traffic and the duration of the terminal accessing the Internet. At least one
  • the access control module 22 is configured to invoke a legal user information list, and in the legal user information list, find a legal user information item that matches the device identifier; if the legal user information item matching the device identifier is found, the device identifier is consistent with the pre- If the device ID of the device is not found, the device ID is not the device ID of the device in the network.
  • the access control module 22 in the foregoing embodiment after providing the wireless access service for the terminal device, is further configured to: detect whether the terminal device leaves the wireless local area network; and after detecting that the terminal device leaves the wireless local area network, determine Receiving terminal access information within a first predetermined time period, wherein the terminal access information is information generated by other access devices forming a public local area network after providing wireless access services for the terminal device, and the public local area network is connected by at least two The wireless local area network provided by the device is formed; if the terminal access information is not received, the terminal device is considered to leave the public local area network, and it is determined whether the terminal device reconnects to the public local area network within a second predetermined time period; if the public local area network is not re-accessed, The legal user information item matching the device ID in the legal user information list is deleted, and the updated legal user information list is sent to other access devices forming a public local area network directly or through a third-party device.
  • the access control module 22 in the foregoing embodiment is further configured to: if the terminal access information is received within the first predetermined duration , updating the resource usage information and updating the resource usage information, Sending to other access devices forming a public local area network directly or through a third-party device; or, after determining whether the terminal device re-accesses the current local area network within a second predetermined time period, the access control module is further configured to: if in the second If the current local area network is re-accessed within a predetermined time period, the resource usage information is updated, and the updated resource usage information is sent to other access devices forming a public local area network directly or through a third-party device.
  • the access control module 22 in the foregoing embodiment is further configured to: if the device identifier is not the device identifier of the network device, obtain the terminal device.
  • Identity authentication information authentication of the identity authentication information; if the authentication is passed, the terminal device is allowed to access the wireless local area network.
  • the identity authentication information needs to carry the identity authentication parameters of the public LAN provider as legitimate users, such as the login account and login password configured by the hotel front desk for the guest, which can be used to identify the user identity and determine whether the user is legal. Users, these login accounts and login passwords are not wireless LAN (WiFi) access accounts and passwords provided by access devices (such as routers).
  • WiFi wireless LAN
  • the access control module 22 is further configured to: acquire resource usage information of the terminal device after the terminal device is allowed to access the wireless local area network;
  • the device ID and resource usage information are stored as a valid user information item and updated to the legal user information list;
  • the updated legal user information list is sent directly or through a third-party device to other accesses forming a public LAN. device.
  • FIG. 3 is a first flowchart of a method for controlling access of a terminal device according to the first embodiment of the present disclosure.
  • the terminal device access control method provided in this embodiment includes:
  • S301 After detecting the access request of the terminal device to access the wireless local area network, obtain the device identifier of the terminal device; the access request is a request for the terminal device to access the wireless local area network according to the access parameter of the wireless local area network;
  • step S302 Determine whether the device identifier is a device identifier of the network device; if yes, perform the step S303, if no, step S305 is performed;
  • S304 Provide a wireless access service for the terminal device.
  • the method in the foregoing embodiment further includes:
  • S305 Acquire identity authentication information of the terminal device if the device identifier is not the device identifier of the network device.
  • step S306 The identity authentication information is authenticated; if the authentication is passed, step S307 is performed; if the authentication fails, then S308 is performed;
  • S308 Denying the terminal device to access the wireless local area network.
  • the method in the foregoing embodiment after the step S307, further includes:
  • the device identifier and the resource usage information of the terminal device are correspondingly stored as a legal user information item, and are updated to the legal user information list.
  • S311 Send the updated legal user information list to the other access device forming the public local area network directly or through a third-party device.
  • step S302 in the above embodiment includes:
  • the legal user information list includes at least one legal user information item, and the legal user information item includes the device identifier and the resource usage information of the legal user, and the resource usage information includes at least one of the terminal Internet traffic and the terminal online time;
  • the device identifier is the device identifier of the network device.
  • the device ID is not the device ID of the network device.
  • FIG. 4 is a second flowchart of a terminal device access control method according to a first embodiment of the present disclosure.
  • the terminal device access control method provided in this embodiment provides a wireless access service for a terminal device. After S304 or S307), it also includes:
  • S401 periodically detecting whether the terminal device leaves the wireless local area network; if left, executing S402, if not, returning to execute S401;
  • step S402 After detecting that the terminal device leaves the wireless local area network, determine whether the terminal access information is received within a first predetermined time period, where the terminal access information is to provide wireless access to the terminal device for other access devices forming a public local area network. The information generated after the service; if the terminal access information is not received, the terminal device is considered to leave the public local area network, step S403 is performed, and if the terminal access information is received within the first predetermined time period, step S405 is performed;
  • step S403 determining whether the terminal device re-accesses the current local area network within a second predetermined time period; if the public local area network is not re-accessed, step S404 is performed; if the public local area network is re-accessed within the second predetermined time period, step S407 is performed;
  • S404 Delete the legal user information item that matches the device identifier in the legal user information list, and send the updated legal user information list to the other access device forming the public local area network directly or through the third-party device.
  • the method in the foregoing embodiment further includes after S402:
  • S406 Send the updated resource usage information to the other access device forming the public local area network directly or through a third-party device.
  • the method in the above embodiment is further packaged after S403. include:
  • S408 Send the updated resource usage information to the other access device forming the public local area network directly or through a third-party device.
  • FIG. 5 is a schematic diagram of a networking diagram of a terminal device access control system according to a second embodiment of the present disclosure.
  • the terminal device access control system provided in this embodiment includes: an authentication server, multiple access devices, and multiple The wireless local area networks of the access devices form a public local area network, and the access devices directly or indirectly communicate with each other for data interaction;
  • the authentication server is configured to acquire the device identifier of the network device, and send the device identifier of the network device to the access device of the public local area network;
  • the access device is configured to obtain the device identifier of the terminal device after detecting the access request of the terminal device to access the wireless local area network, and determine whether the terminal device is the in-network device according to the device identifier of the terminal device and the device identifier of the network device. A control operation corresponding to the judgment result is performed on the terminal device.
  • the terminal device when the access device determines whether the terminal device determines whether the network device is a negative result, the terminal device obtains the identity authentication information of the terminal device, and sends the identity authentication information to the authentication server.
  • the authentication server is further configured to authenticate the identity authentication information, and send the authentication result to the access device.
  • the access device is further configured to connect the terminal device to the wireless local area network when the authentication result is the authentication pass, and provide the wireless access service for the terminal device.
  • FIG. 6 is a structural block diagram of an access device according to a second embodiment of the present disclosure.
  • the access device provided in this embodiment includes: a communication module 61 and a processor 62, where
  • the communication module 61 is configured to provide a wireless local area network and communicate with the terminal device and the authentication server;
  • the processor 62 is configured to: after detecting the access request of the terminal device to access the wireless local area network, obtain the device identifier of the terminal device, and determine, according to the device identifier of the terminal device and the device identifier of the network device, whether the terminal device is an in-network device; And performing, by the terminal device, a control operation corresponding to the determination result; the access request is a request for the terminal device to access the wireless local area network according to the access parameter of the wireless local area network.
  • the processor 62 in the foregoing embodiment is configured to determine whether the terminal device is an in-network device, and if not, obtain the identity authentication information of the terminal device, send the identity authentication information to the authentication server, and receive the return from the authentication server.
  • the authentication result is that when the authentication result is the authentication, the terminal device is connected to the wireless local area network, and the terminal device is provided with the wireless access service.
  • the communication module 61 in the foregoing embodiment is configured to receive a list of legal user information that is sent by the authentication server, where the legal user information list includes at least one legal user information item, and the legal user information item includes the device identifier of the legal user.
  • the processor 62 is configured to use the device ID of the legitimate user as the device identifier of the in-network device.
  • the processor 62 is configured to invoke a legal user information list, and in the legal user information list, find a legal user information item that matches the device identifier of the terminal device, and if a legitimate user information item matching the device identifier is found, the terminal If the device is an in-network device, if no valid user information item matching the device ID is found, the terminal device is not a network device.
  • the legal user information item includes the device identifier of the legal user and the resource usage information
  • the resource usage information includes at least one of the terminal Internet traffic and the terminal access time, so that the processor 62 can use the resource usage information as the terminal device.
  • Provide wireless access service includes
  • the processor 62 in the foregoing embodiment is further configured to: after detecting the wireless access service for the terminal device, detecting whether the terminal device leaves the wireless local area network; after detecting that the terminal device leaves the wireless local area network, determining the communication module 61 Whether to receive recognition within the first predetermined time
  • the terminal access information forwarded by the server wherein the terminal access information is information generated by other access devices forming a public local area network after providing the wireless access service for the terminal device, and the public local area network is provided by at least two access devices.
  • the local area network is formed; if the terminal access information is not received, the terminal device is considered to leave the current local area network, and the user sends an off-network message to the authentication server through the communication module, and the user off-network message is used to trigger the authentication server to determine whether the terminal device is in the second predetermined time period. Re-accessing the public local area network; if the communication module receives the new legal user information list fed back by the authentication server, the stored legal user information list is replaced with the new legal user information list.
  • the access device in the above embodiment includes: a communication bus, a communication unit, a processor, a memory, and a computer program stored on the memory and operable on the processor, wherein
  • the communication bus is configured to implement a communication connection between the communication unit, the processor, and the memory;
  • the communication unit is configured to provide a wireless local area network and to communicate with the terminal device and the authentication server;
  • the processor is configured to execute a computer program to implement the following steps:
  • the terminal device is connected to the wireless local area network, and the terminal device is provided with the wireless access service.
  • the processor in the above embodiments is further configured to execute a computer program to implement the following steps:
  • the device ID of the legal user is used as the device identifier of the network device.
  • the legal user information list is invoked, and the legal user information item matching the device identifier of the terminal device is searched in the legal user information list;
  • the terminal device is the online device. If the legal user information item matching the device identifier is not found, the terminal device is not the network device.
  • the processor in the above embodiments is further configured to execute a computer program to implement the following steps:
  • the communication module After detecting that the terminal device leaves the wireless local area network, it is determined whether the communication module receives the terminal access information within a first predetermined time period, wherein the terminal access information is a wireless access for the terminal device by other access devices forming a public local area network.
  • the information generated after the service, the public local area network is formed by the wireless local area network provided by at least two access devices;
  • the terminal device If the terminal access information is not received, the terminal device is considered to leave the public local area network, and the user sends an off-network message to the authentication server through the communication module.
  • the user off-network message is used to trigger the authentication server to determine whether the terminal device is reconnected within the second predetermined time period.
  • the stored legal user information list is replaced with the new legal user information list.
  • embodiments of the present application further provide a computer readable storage medium storing one or more programs, and one or more programs may be executed to implement the following steps:
  • the terminal device is connected to the wireless local area network, and the terminal device is provided with the wireless access service.
  • one or more of the above-described embodiments can be executed to implement the following steps:
  • the device ID of the legal user is used as the device identifier of the network device.
  • the legal user information list is invoked, and the legal user information item matching the device identifier of the terminal device is searched in the legal user information list;
  • the terminal device is the online device. If the legal user information item matching the device identifier is not found, the terminal device is not the network device.
  • one or more of the above-described embodiments can be executed to implement the following steps:
  • the communication module After detecting that the terminal device leaves the wireless local area network, it is determined whether the communication module receives the terminal access information within a first predetermined time period, wherein the terminal access information is a wireless access for the terminal device by other access devices forming a public local area network.
  • the information generated after the service, the public local area network is formed by the wireless local area network provided by at least two access devices;
  • the terminal device If the terminal access information is not received, the terminal device is considered to leave the public local area network, and the user sends an off-network message to the authentication server through the communication module, and the user off-network message is used to trigger the authentication service.
  • the server determines whether the terminal device re-accesses the public local area network within a second predetermined time period;
  • the stored legal user information list is replaced with the new legal user information list.
  • FIG. 7 is a structural block diagram of an authentication server according to a second embodiment of the present application.
  • the authentication server provided by the embodiment includes: an authentication module 71 and a processor 72, where
  • the authentication module 71 is configured to communicate with the access device
  • the processor 72 is configured to acquire the device identifier of the network device, and send the device identifier of the network device to the access device of the public local area network; the public local area network is formed by the wireless local area network provided by the at least two access devices; wherein, the device of the network device The identifier is used to authenticate the device identifier of the obtained terminal device after receiving the access request of the terminal device to access the wireless local area network, and the terminal device is connected to the wireless device only when the terminal device is the network device.
  • a local area network (LAN) is provided with a wireless access service for the terminal device.
  • the authentication device is used for authentication.
  • the terminal device is authenticated only when the authentication is passed.
  • the access request is the terminal device according to the wireless local area network.
  • the request for accessing the wireless local area network initiated by the access parameter is formed by a wireless local area network provided by at least two access devices.
  • the processor 72 in the foregoing embodiment is configured to: determine an access device forming a public local area network; construct a legal user information list including at least one legal user information item, where the legal user information item includes a device identifier of the legal user Send a list of legitimate user information to the access device.
  • the legal user information item in order to facilitate the access device to provide an access service for the terminal device, includes the device identifier and resource usage information of the legal user, and the resource usage information includes at least one of the terminal Internet traffic and the terminal access time.
  • the processor 72 in the foregoing embodiment after transmitting the legal user information list to the access device, is further configured to: receive, by the authentication module, a user off-network message sent by the access device; and determine, by the user, the off-network message. Whether the terminal device re-accesses the public local area network within the second predetermined time period; if not, deletes the legal user whose device identifier matches in the legal user information list The information item generates a new legal user information list; sends a new legal user information list to the access device.
  • the authentication module 71 in the foregoing embodiment is configured to: receive a device identifier of a legal user configured by an administrator, as a device identifier of the network device, and/or receive identity authentication information sent by the access device, The identity authentication information is authenticated. If the authentication is passed, the device identifier corresponding to the identity authentication information is used as the device identifier of the network device.
  • the authentication server in the above embodiment includes: a communication bus, a communication unit, a processor, a memory, and a computer program stored on the memory and executable on the processor, wherein
  • the communication bus is configured to implement a communication connection between the communication unit, the processor, and the memory;
  • the communication unit is configured to communicate with the access device
  • the processor is configured to execute a computer program to implement the following steps:
  • the device identifier of the network device is sent to the access device of the public local area network; the public local area network is formed by the wireless local area network provided by at least two access devices.
  • the processor in the above embodiments is further configured to execute a computer program to implement the following steps:
  • the processor in the above embodiments is further configured to execute a computer program to implement the following steps:
  • the legal user information item matching the device identifier in the legal user information list is deleted, and a new legal user information list is generated.
  • the processor in the above embodiments is further configured to execute a computer program to implement the following steps:
  • the device identifier corresponding to the identity authentication information is used as the device identifier of the network device.
  • embodiments of the present application further provide a computer readable storage medium storing one or more programs, and one or more programs may be executed to implement the following steps:
  • the device identifier of the network device is sent to the access device of the public local area network; the public local area network is formed by the wireless local area network provided by at least two access devices.
  • one or more of the above-described embodiments can be executed to implement the following steps:
  • one or more of the above-described embodiments may be executed to Now the following steps:
  • the legal user information item matching the device identifier in the legal user information list is deleted, and a new legal user information list is generated.
  • one or more of the above-described embodiments can be executed to implement the following steps:
  • the device identifier corresponding to the identity authentication information is used as the device identifier of the network device.
  • FIG. 8 is a flowchart of a terminal device access control method according to a second embodiment of the present disclosure. As shown in FIG. 8, the terminal device access control method provided in this embodiment includes:
  • the authentication server acquires the device identifier of the network device, and sends the device identifier of the network device to the access device of the public local area network, where the public local area network is formed by the wireless local area network provided by the at least two access devices.
  • the access device After detecting the access request of the terminal device to access the wireless local area network, the access device acquires the device identifier of the terminal device, and determines whether the terminal device is the in-network device according to the device identifier of the terminal device and the device identifier of the network device. A control operation corresponding to the judgment result is performed on the terminal device.
  • FIG. 9 is a method for access control of a terminal device according to a second embodiment of the present disclosure, on the access device side
  • the overall flow chart of FIG. 9 shows that the terminal device access control method provided by the embodiment on the access device side includes:
  • S901 After detecting the access request of the terminal device to access the wireless local area network, acquire the device identifier of the terminal device;
  • S902 Determine, according to the device identifier of the terminal device and the device identifier of the network device, whether the terminal device is an in-network device;
  • FIG. 18 is a first flowchart of a terminal device access control method according to a second embodiment of the present invention, which is provided on the access device side, and FIG. 18 shows that the terminal device access control method provided by this embodiment is on the access device side.
  • the embodiment includes:
  • S901 After detecting the access request of the terminal device to access the wireless local area network, obtain the device identifier of the terminal device; the access request is a request for the terminal device to access the wireless local area network according to the access parameter of the wireless local area network;
  • S902 determining, according to the device identifier of the network device, whether the terminal device is an in-network device; if yes, executing S904; if not, executing S905;
  • S904 Connect the terminal device to the wireless local area network, and provide a wireless access service for the terminal device;
  • S905 Acquire identity authentication information of the terminal device, and send the identity authentication information to the authentication server.
  • S906 Receive an authentication result returned by the authentication server, and when the authentication result is the authentication pass, connect the terminal device to the wireless local area network, and provide a wireless access service for the terminal device.
  • steps S904 to S906 are the specific contents of step S903.
  • the method in the foregoing embodiment, before the step S902, further includes:
  • S900 Receive a legal user information list delivered by the authentication server, where the legal user information list includes at least one legal user information item, and the legal user information item includes a device identifier of the legal user.
  • the device ID of the legal user is used as the device identifier of the network device.
  • the legal user information includes the resource usage information of the legal user.
  • the resource usage information includes at least one of the terminal Internet traffic and the terminal access time.
  • step S902 in the above embodiment includes:
  • the legal user information list is invoked, and the legal user information item matching the device identifier of the terminal device is searched in the legal user information list;
  • the terminal device is the online device; if the legal user information item matching the device identifier is not found, the terminal device is not the network device.
  • FIG. 10 is a second flowchart of a terminal device access control method according to a second embodiment of the present invention, where the terminal device access control method is provided on the access device side. After providing wireless access services (S904 and S906) for terminal devices, it also includes:
  • S1001 periodically detecting whether the terminal device leaves the wireless local area network; if left, executing S1002, if not, returning to execute S1001;
  • S1002 After detecting that the terminal device leaves the wireless local area network, determine whether the terminal access information forwarded by the authentication server is received within the first predetermined time period, and the terminal access information is that the other access device forming the public local area network provides wireless for the terminal device. The information generated after accessing the service; if the terminal access information is not received, executing S1003, and if receiving the terminal access information, executing S1006;
  • the terminal device is configured to leave the public local area network, and send the user off-network message to the authentication server.
  • the user off-network message is used to trigger the authentication server to determine whether the terminal device re-accesses within the second predetermined time period.
  • S1004 Waiting for the second predetermined duration, determining whether a new legal user information list is received; if receiving a new legal user information list, executing S1005, if no new legal user information is received List, execute S1007;
  • FIG. 11 is a first flowchart of a terminal device access control method according to a second embodiment of the present invention, which is performed on the authentication server side.
  • FIG. 11 is a schematic diagram of the terminal device access control method provided by the embodiment. include:
  • S1101 Obtain a device identifier of the network device.
  • the device identifier of the network device is used by the access device to authenticate the access device after receiving the access request of the terminal device to access the wireless local area network.
  • S1102 Sending a device identifier of the network device to an access device of a public local area network, where the public local area network is formed by a wireless local area network provided by at least two access devices.
  • step S1101 in the above embodiment includes:
  • the device identifier corresponding to the user authentication information is used as the device identifier of the network device.
  • step S1102 in the above embodiment includes:
  • the information includes the device ID of the legal user.
  • the legal user information item also includes the resource usage information of the legal user.
  • the resource usage information includes at least one of the terminal Internet traffic and the terminal access time.
  • FIG. 12 is a second flowchart of a terminal device access control method according to a second embodiment of the present invention, which is provided on the authentication server side, and FIG. 12 is a schematic diagram of the terminal device access control method provided by the embodiment.
  • the method After the sending of the legal user information list to the access device (step S1102), the method further includes:
  • S1201 Periodically determining whether the user's off-network message sent by the access device is received; if yes, executing S1202: if not, returning to execute S1201;
  • S1202 Determine whether the terminal device corresponding to the user's off-network message re-accesses the public local area network within a second predetermined time period; if not, the user terminal device is considered to have left the public local area network, and S1203 is performed; if yes, the user terminal device is considered to be re-established. Join the public local area network, then execute S1205;
  • S1204 Send a new legal user information list to the access device.
  • CPE equipment has been widely used as a relatively portable communication terminal, but CPE is usually used as a device used in a narrow environment (such as homes, small cafes, etc.), and CPE equipment is usually relatively compared. Independent does not have the characteristics of unified management, especially when accessing multiple users, as long as these users have the current CPE authentication information, they can log in. Into, the security is poor, these authentication information can be changed on the CPE, when there are multiple CPEs for networking, it seems to be powerless. For this problem, this embodiment proposes a method for managing CPE user access based on the authentication (remote authentication dial in user service).
  • the management control system includes: a radius server (ie, an authentication server in the foregoing embodiment), multiple CPE devices (that is, access devices involved in the foregoing embodiments), and multiple User terminal devices, among them,
  • the authentication server process is used to monitor the AAA (Authentication, Authorization, Accounting, Authentication, Authentication, and Accounting) authentication information transmitted by each CPE device.
  • the RADIUS server runs a master control process, which is responsible for controlling all CPE device user information data.
  • the authentication service process triggers the total control process, and the total control process utilizes VLAN technology (by IP).
  • Multicast partitioning is a definition of a VLAN. A multicast group is considered to be a VLAN. This method of partitioning expands the VLAN to the WAN. Therefore, this method has more flexibility.
  • the multicast information is sent to the multicast group. In each CPE in the network.
  • the master control process is used to schedule all CPE device message processing, and control all event processing.
  • Server off-net timer This timer runs on the server. After the master control process in the server receives the off-net message from a user terminal sent by the CPE monitoring process (running in the CPE device), this timer is started. After the device reaches the set value, the master control process broadcasts a message on the local area network to delete the user information of the user terminal in all CPE devices. If the message that the user terminal broadcasted by the CPE device re-accesses is received within this time, the timer is turned off.
  • the radius client (authentication client) is run on the CPE.
  • the login user name and password are entered.
  • the network administrator needs to set different settings. Username parameters, given different/same internet access Information, Internet traffic, etc.
  • the CPE device runs the CPE monitoring process. After receiving the multicast packet message sent by the total control process in the radius server, all the CPE devices parse the message to obtain the parameter information of the logged-in user.
  • the list is the legal user involved in this application.
  • the information list is as shown in the following table 1.
  • the device MAC (Media Access Control) address is the device unique identifier
  • User_name is the terminal login user name
  • passwpord is the password
  • traffic is the user's login remaining traffic.
  • the unit is mega ( M)
  • time is the remaining time for this user login
  • the unit is minutes (min).
  • the CPE off-network timer runs on the CPE device and is used to calculate whether the time that the user terminal leaves the WIFI network of the device is greater than the first preset duration. If the user does not receive the broadcast of the remaining CPE devices in the LAN within the first preset duration.
  • the terminal access information triggers the CPE monitoring process of the CPE device to send the terminal device off-network message to the total control process of the radius server.
  • the network administrator For traffic, the network administrator first sets the initial traffic of each terminal device and notifies all CPE devices by broadcasting messages in the LAN through the master control process on the radius server. After the CPE device obtains this message, it initializes and updates the parameters of this user to the list of legitimate user information.
  • the CPE device uses the iptables traffic statistics capability of the linux firewall to uniformly monitor the traffic of all terminal devices connected to the network, and set the upper limit of the traffic. The value is equal to the corresponding value in the traffic. (1) When the user traffic exceeds the network, the network is disconnected.
  • the CPE monitoring process broadcasts a notification in the local area network to inform all CPE devices to set the traffic value in their user information to zero.
  • the monitoring process in CPE-1 reads the iptables process in this time. Monitor the traffic used by the user, update the user information parameter table, and use the VLAN to broadcast the packet in the LAN through the monitoring process. The other CPE devices update the user parameter table after receiving the broadcast information. When the user enters the remaining CPE coverage, The upper limit setting, counting, and the like are performed according to the traffic in the updated user information parameter table.
  • the network administrator first sets the initial online time of each terminal device and triggers all CPE devices to be broadcasted in the LAN through the master control process on the radius server. After the CPE device obtains this message, it initializes and will update the parameters of the user. Go to the list of legitimate user information. At this time, each CPE device starts a timer for the user, but the timer is in the wait state. When the user actually accesses a CPE device (such as CPE-1) in the network, the CPE device starts the timer. 1) If the time is up, the monitoring process notifies the device to close the link for this user. (2) If the time is not up, Case 1: The user leaves the coverage of CPE-1 and enters the WIFI coverage of CPE-2.
  • the monitoring module receives the terminal access information broadcast by CPE-2 and sends a pause message to the CPE timer.
  • the timer stops and triggers the monitoring process to update the list of valid user information.
  • the monitoring process then broadcasts an update message in the local area network to notify all CPE devices to update the list of legitimate user information.
  • the CPE-2 device starts its own timer and starts timing.
  • Case 2 When the user leaves the local area network and the CPE-1 does not receive the user access message broadcasted by the remaining CPE devices within a certain period of time, the timer is closed, and the user's off-network message and the updated user parameter list information are sent to the user. Radius server, the radius server starts the suspend timer of this user.
  • Case 3 The user re-enters the local area network, and the accessed CPE device also sends a username and password authentication request to the radius server.
  • the radius server closes the suspension timer, sends the authentication pass information, and the user parameter list to all CPE devices for parameter list. Update, the CPE device accessed by this user starts the timer to open for online time statistics.
  • the user terminal When the user enters the local area network for the first time (assuming that the WIFI coverage of the CPE-1 device is first entered), the user terminal first passes the SSID of the WIFI device and the WIFI password.
  • the form is linked to the CPE-1 device WIFI, but at this time, the CPE device does not connect the user terminal to the network, but displays the authentication page, and requires the user terminal device to input the user name and password for authentication, and the CPE-1 device transmits the username and password.
  • the authentication is performed on the radius server. If the authentication fails, the radius server authentication service process triggers the LAN broadcast message of the master control process to notify all CPEs to block the user terminal.
  • the authentication triggers the master control process to broadcast a message in the local area network through the radius server authentication service process, the message has the parameter information in the parameter information table of the user terminal (ie, the terminal MAC address, the login user name, the password, the remaining Internet traffic, and the remaining Internet time), all CPE devices will update their parameter information list after receiving this message.
  • the authentication is enabled by turning on the Internet access rights of the user, and the rights are monitored according to whether the user accesses the Internet according to the traffic or time.
  • the coverage here is not very accurate, and there is bound to be a cross zone in the middle.
  • the terminal will access the WIFI signal of the CPE-2.
  • the broadcast message will be sent in the local area network.
  • the CPE-1 sends the parameter information list of the remaining statistics and the remaining time to the CPE-2 device after receiving the broadcast message.
  • the CPE-2 device updates the user parameter information table and starts monitoring and counting the time and traffic of the user.
  • the WIFI coverage of the CPE-2 is removed.
  • the CPE-2 device does not find the user terminal within a certain period of time (this time is the current WIFI universal disconnection time). If the user terminal access message broadcasted by the CPE device in the remaining local area network is not received, the user is considered to have left the local area network to send information to the radius server, and the radius server suspends the user and starts a suspend timer when the user is in the If the CPE device is not newly connected to the local area network before the timer expires, the user is considered to leave, and the broadcast information will be sent to clear the user information on all CPE devices.
  • step (1) When the user re-enters the local area network, the operation steps are similar to the step (1).
  • the user name and password are also re-registered.
  • the CPE sends the user name and password for authentication.
  • the radius server is authenticated, all CPEs are notified by broadcast messages to obtain the user. Parameter information table.
  • FIG. 14 is a flow chart of the user terminal flow rate Internet access. As can be seen from FIG. 14, the method includes:
  • S1401 The network administrator configures the user terminal to be accessed on the server, configures the user name and password that is allowed to be accessed through the authentication service process, and configures the parameter information (MAC address, user name, password, and password) of the user. Remaining internet traffic).
  • the terminal device accesses the local area network to obtain the device identifier.
  • the user terminal accesses the WIFI of the CPE-1 device through the CPE-1 device (for example, any CPE device in the network), and obtains the device identifier.
  • the CPE-1 device for example, any CPE device in the network
  • S1403 determining whether the user terminal is a newly accessed user terminal; the step is mainly implemented according to a legal user equipment identifier list maintained by each access device; if it is a new device, executing S1404; if the terminal device temporarily leaves the local area network, The server returns to the LAN within the time of the off-network timer.
  • the CPE device first searches for the list of legitimate user information. If the device is not a new device, the S1415 is executed.
  • CPE-1 displays the authentication page, prompting the terminal user to input the username and password that need to be authenticated (that is, the username and password configured by the network administrator for this user);
  • the radius client on the CPE-1 device uploads the username and password information to the server and performs AAA authentication on the radius server.
  • the total control process in the server queries the parameter information of the user terminal configured by the network administrator and broadcasts the parameter information in the local area network. After receiving the broadcast message, the monitoring process of all CPE devices updates its own user parameter information table.
  • the CPE-1 device uses the firewall function to release the user and enable the terminal device to access the network.
  • the firewall's metering function is used to collect statistics on the Internet traffic of the user and compare the parameter information table in real time.
  • S1407-S1409 The traffic of the user terminal that is counted by the CPE device is smaller than the remaining Internet traffic, and the user directly removes the WIFI coverage of any CPE device in the local area network.
  • the CPE-1 device starts the off-net timer of the user.
  • the timer process (the length is equal to the first preset duration) does not receive the user access message broadcast by another CPE.
  • the monitoring process sends the user off-network message. Give the server.
  • the server control process starts the server off-net timer (the length is equal to the second preset duration), and calculates the time when the user terminal leaves the LAN, and receives the network within the specified time period.
  • the terminal enters the network message broadcast by the CPE, and the timer is turned off. If the timeout expires but the terminal does not receive the network access message broadcasted by the CPE, the master control process broadcasts the user's off-network acknowledgment message, triggering all CPE devices in the network to delete the information of the terminal in the user information list, and then ending.
  • the Internet traffic of the user terminal that is counted by the CPE device is smaller than the remaining Internet traffic and the user moves from the WIFI coverage of the CPE-1 device to the WIFI coverage of the CPE-2 device.
  • the CPE-1 device starts an off-net timer. At this time, the CPE-2 device receives the WIFI access request sent by the device.
  • the WIFI module sends an authentication request to the monitoring process of the CPE-2 device.
  • the monitoring process queries its own user. Information List. If present, the monitoring process of the CPE-2 device broadcasts the access message of the user terminal in the local area network.
  • the device of CPE-1 in the local area network (the rest of the devices ignore this message) after the monitoring process receives the access information of the user terminal.
  • the remaining traffic in the user information list is updated, and the updated user information list message is sent to the CPE-2 device.
  • the CPE-2 device receives the message containing the user information sent by CPE-1, it first updates itself. A list of user status messages. After that, the user's Internet access permission is opened, and the traffic statistics function of the firewall is used to perform statistics on the Internet traffic of the user, and the parameter information table is compared in real time.
  • S1415-S1416 Notifies the server to turn off the off-net timer; allows access to the network and starts the traffic fee.
  • the CPE device first searches for its own legitimate user information list, if it does not need to authenticate the user name and password, directly enters the step. S1416 (equivalent to S1406).
  • FIG. 15 is a flow chart of time-based charging for a user terminal. As shown in FIG. 15, the method includes:
  • S1501 The network administrator configures the user terminal to be accessed on the server, configures the username and password to be accessed through the authentication service process, and configures the parameter information (MAC address, user name, password, and password) of the user. Remaining internet time).
  • the terminal device accesses the local area network to obtain the device identifier.
  • the user terminal accesses the WIFI of the CPE-1 device through the CPE-1 device (for example, any CPE device in the network), and obtains the device identifier.
  • the CPE-1 device for example, any CPE device in the network
  • S1503 determining whether the user terminal is a newly accessed user terminal; the step is mainly implemented according to the legal user equipment identifier list maintained by each access device; if it is a new device, executing S1504; if the terminal device temporarily leaves the local area network, The server returns to the local area network within the time of the off-net timer.
  • the CPE device first searches for the list of legitimate user information. If the device terminal is not a new device, execute S1515.
  • CPE-1 displays the authentication page, prompting the terminal user to input the username and password that need to be authenticated (that is, the username and password configured by the network administrator for this user);
  • S1505 Whether the authentication of the radius server is a legitimate user; if the authentication is passed, executing S1506; if the authentication fails, executing S1514;
  • the radius client on the CPE-1 device uploads the username and password information to the server, and performs AAA authentication through the authentication service process in the radius server.
  • the authentication service process in the radius server first triggers the total control process in the server.
  • the master control process queries the parameter information (mac address, user name, password, and remaining Internet time) of the user terminal configured by the network administrator and broadcasts the parameter information in the local area network.
  • the monitoring process of all CPE devices updates its own user parameter information table.
  • the CPE-1 device uses the firewall function to release the user and enable the terminal device to access the network.
  • the Internet timer is started to time the access time of the user, and the parameter information table is compared in real time.
  • S1507-S1509 The online time of the user terminal that is counted by the CPE device is less than the remaining online time, and the user directly removes the WIFI coverage from any CPE device in the local area network.
  • the CPE-1 device starts the off-net timer of the user. During this timer, if the user access message broadcasted by another CPE is not received, the monitoring process sends the user off-network message to the server. After receiving the off-network user message sent by the CPE, the server control process starts the server off-net timer to calculate the time when the user terminal leaves the LAN. If the network access message is received by the CPE broadcasted by the CPE in the network within the time limit, the timer is closed. Device. If the timeout expires but the CPE broadcasts the terminal network access message, the master control process broadcasts the user's off-network acknowledgment message to notify all CPE devices in the network to delete the information of the terminal in the user information list.
  • the online time of the user terminal that is counted by the CPE device is less than the remaining online time, and the user moves from the WIFI coverage of the CPE-1 device to the WIFI coverage of the CPE-2 device.
  • the CPE-1 device will start the off-net timer. At this time, the CPE-2 device will receive the device.
  • the WIFI access request the WIFI module sends an authentication request to the monitoring process of the CPE-2 device, and the monitoring process queries its own user information list. if it exists.
  • the monitoring process of the CPE-2 device broadcasts an access message of the user terminal in the local area network.
  • the device of CPE-1 in the local area network (the rest of the devices ignore this message) after the monitoring process receives the access information of the user terminal.
  • the CPE-2 device Upon receiving the message containing the user information sent by the CPE-1, the CPE-2 device first updates its own list of user status messages. After that, the user's Internet access right is turned on, and the Internet timer counts the access time of the user, and compares the parameter information table in real time.
  • S1515-S1516 Notify the server to turn off the off-net timer; allow access to the network and turn on the traffic fee.
  • the CPE device first searches for its own legitimate user information list, if it does not need to authenticate the user name and password, directly enters the step. S1516 (equivalent to S1506).
  • the embodiment of the present invention provides an access device, an authentication server, and a terminal device access control method and system, where the method acquires a device when detecting that the terminal device requests to access the wireless local area network according to the access parameter of the wireless local area network. Identifying, determining whether the terminal device is an in-network device, performing different control operations on the terminal device according to different judgment results, for example, when the device is in the network device, directly accessing the terminal device, when not in the network device, Pass the authentication server Line authentication, only when the authentication is passed, the terminal device is connected; thus, even if the wireless parameter of the access device of the wireless local area network is leaked, the illegal terminal device accesses the wireless local area network by using the wireless parameter, and the terminal device is not authenticated. By being denied access, the problem that the existing access device only authenticates the access parameter of the WLAN access parameter is disclosed, so that the illegal user can access the wireless local area network at any time to achieve low security of the wireless local area network.
  • embodiments of the present application can be provided as a method, system, or computer program product. Accordingly, the application can take the form of a hardware embodiment, a software embodiment, or an embodiment in combination with software and hardware. Moreover, the application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage and optical storage, etc.) including computer usable program code.
  • the computer program instructions can also be stored in a computer readable memory that can direct a computer or other programmable data processing device to operate in a particular manner, such that the instructions stored in the computer readable memory produce an article of manufacture comprising the instruction device.
  • the apparatus implements the functions specified in one or more blocks of a flow or a flow and/or block diagram of the flowchart.
  • These computer program instructions can also be loaded onto a computer or other programmable data processing device such that a series of operational steps are performed on a computer or other programmable device to produce computer-implemented processing for execution on a computer or other programmable device. Instructions are provided for implementation The steps of a function specified in a block or blocks of a flow or a flow and/or a block diagram of a flow chart.
  • the technical solution of the embodiment of the present application when detecting that the terminal device requests to access the wireless local area network according to the access parameter of the wireless local area network, obtains the device identifier, determines whether the terminal device is a network device, and determines the terminal device according to different judgment results. Perform different control operations. For example, when the device is in the network device, the terminal device is directly accessed. When the device is not in the network device, the authentication device is used for authentication. When the authentication is passed, the terminal device is accessed.
  • the illegal terminal device accesses the wireless local area network by using the wireless parameter, and the terminal device authentication fails to be denied access, thereby solving the problem that the existing access device only authenticates the wireless local area network.
  • the access parameter leakage of the access parameter allows the illegal user to access the wireless local area network at any time to cause low security of the wireless local area network.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Power Engineering (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Small-Scale Networks (AREA)

Abstract

本申请实施例提供了一种接入设备、认证服务器、终端设备接入控制方法及系统；该方法在检测到终端设备根据无线局域网的接入参数请求接入无线局域网时，将获取设备标识，判断终端设备是否为在网设备，根据判断结果的不同，对终端设备执行不同的控制操作，例如，在为在网设备时，直接将终端设备接入，在不是在网设备时，将通过认证服务器进行认证，仅在认证通过时，将终端设备接入；这样，即便提供无线局域网的接入设备的无线参数泄露，非法终端设备在使用无线参数接入无线局域网时，也会因为终端设备认证不通过被拒绝访问，解决了现有无线局域网安全性低的问题。

Description

[根据细则26改正09.11.2017]　接入设备、认证服务器、终端设备接入控制方法及系统
相关申请的交叉引用
本申请基于申请号为201710288872.6、申请日为2017年04月27日的中国专利申请提出，并要求该中国专利申请的优先权，该中国专利申请的全部内容在此引入本申请作为参考。
技术领域
本申请涉及局域网应用领域，尤其涉及一种接入设备、认证服务器、终端设备接入控制方法及系统、计算机存储介质。
背景技术
在现实生活中，存在这样的应用场景，酒店、车站等商家为了满足用户接入WiFi等无线局域网的需求，会设置多个接入设备，这些接入设备提供的WiFi，相互连接及覆盖，实现对场景的无缝覆盖。
这种方法在满足用户接入需求的同时，会存在这样的问题，为了便于用户终端接入WiFi，所有的接入设备使用相同的WiFi名称及密码等无线参数对用户进行认证，WiFi名称及密码一旦泄露，其他人员就可以肆意使用WiFi，影响商家内正常顾客的使用，会给商家带来不必要的网络费用。
申请内容
本申请实施例提供了一种接入设备、认证服务器、终端设备接入控制方法及系统、计算机存储介质，以至少解决现有技术仅使用无线局域网的无线参数对用户进行认证导致的安全性低的问题。
一方面，提供了一种终端设备接入控制方法，包括：
在检测到终端设备接入无线局域网的接入请求后，获取终端设备的设备标识；接入请求为终端设备根据无线局域网的接入参数发起的接入无线局域网的请求；
根据终端设备的设备标识和在网设备的设备标识，判断终端设备是否为在网设备；
对终端设备执行与判断结果对应的控制操作。
一方面，提供了一种终端设备接入控制方法，包括：
获取在网设备的设备标识；
发送在网设备的设备标识至公共局域网的接入设备，公共局域网由至少两个接入设备提供的无线局域网形成。
一方面，提供了一种终端设备接入控制方法，包括：
认证服务器获取在网设备的设备标识，发送在网设备的设备标识至公共局域网的接入设备，公共局域网由至少两个接入设备提供的无线局域网形成；
接入设备在检测到终端设备接入无线局域网的接入请求后，获取终端设备的设备标识，根据终端设备的设备标识和在网设备的设备标识，判断终端设备是否为在网设备；对终端设备执行与判断结果对应的控制操作。
一方面，提供了一种接入设备，包括：通信模块及处理器，其中，
通信模块配置为提供无线局域网，并与终端设备及认证服务器进行通信；
处理器配置为在在检测到终端设备接入无线局域网的接入请求后，获取终端设备的设备标识，根据终端设备的设备标识和在网设备的设备标识，判断终端设备是否为在网设备；对终端设备执行与判断结果对应的控制操作。
一方面，提供了一种认证服务器，包括：认证模块及处理器，其中，
认证模块配置为与接入设备进行通信；
处理器配置为获取在网设备的设备标识，发送在网设备的设备标识至公共局域网的接入设备；公共局域网由至少两个接入设备提供的无线局域网形成。
一方面，提供了一种终端设备接入控制系统，包括：本申请实施例提供的认证服务器，及多个接入设备，多个接入设备的无线局域网形成公共局域网；多个接入设备中的至少一个为本申请实施例提供的接入设备，其中，
认证服务器配置为获取在网设备的设备标识，发送在网设备的设备标识至公共局域网的接入设备；
接入设备配置为在检测到终端设备接入无线局域网的接入请求后，获取终端设备的设备标识，根据终端设备的设备标识和在网设备的设备标识，判断终端设备是否为在网设备；对终端设备执行与判断结果对应的控制操作。
另一方面，提供了一种计算机存储介质，计算机存储介质中存储有计算机可执行指令，计算机可执行指令配置为执行前述的终端设备接入控制方法。
本申请实施例的有益效果：
本申请实施例提供了一种接入设备、认证服务器、终端设备接入控制方法及系统、计算机存储介质，其中，该方法在检测到终端设备根据无线局域网的接入参数请求接入无线局域网时，将获取设备标识，判断终端设备是否为在网设备，根据判断结果的不同，对终端设备执行不同的控制操作，例如，在为在网设备时，直接将终端设备接入，在不是在网设备时，将通过认证服务器进行认证，仅在认证通过时，将终端设备接入；这样，即便提供无线局域网的接入设备的无线参数泄露，非法终端设备在使用无 线参数接入无线局域网时，也会因为终端设备认证不通过被拒绝访问，解决了现有接入设备仅认证无线局域网的接入参数存在的接入参数泄露使得非法用户可以随时接入无线局域网导致的无线局域网安全性低的问题。
附图说明
图1为本申请第一实施例提供的终端设备接入控制系统的组网示意图；
图2为本申请第一实施例提供的接入设备的结构框图；
图3为本申请第一实施例提供的终端设备接入控制方法的第一种流程图；
图4为本申请第一实施例提供的终端设备接入控制方法的第二种流程图；
图5为本申请第二实施例提供的终端设备接入控制系统的组网示意图；
图6为本申请第二实施例提供的接入设备的结构框图；
图7为本申请第二实施例提供的认证服务器的结构框图；
图8为本申请第二实施例提供的终端设备接入控制方法的流程图；
图9为本申请第二实施例提供的终端设备接入控制方法在接入设备侧的总体流程图；
图10为本申请第二实施例提供的终端设备接入控制方法在接入设备侧的第二种流程图；
图11为本申请第二实施例提供的终端设备接入控制方法在认证服务器侧的第一种流程图；
图12为本申请第二实施例提供的终端设备接入控制方法在认证服务器侧的第二种流程图；
图13为本申请第三实施例提供的终端设备接入控制系统的组网示意图；
图14为本申请第三实施例提供的终端设备接入控制方法的第一种流程 图；
图15为本申请第三实施例提供的终端设备接入控制方法的第二种流程图；
图16为本申请实施例涉及的终端归属无线局域网的确定示意图；
图17为本申请实施例涉及的无线局域网形成公共局域网的示意图；
图18为本申请第二实施例提供的终端设备接入控制方法在接入设备侧的第一种流程图。
具体实施方式
下面将结合本申请实施例中的附图，对本申请实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例只是本申请中一部分实施例，而不是全部的实施例。基于本申请中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都属于本申请保护的范围。
本申请主要用于酒店、商场等应用场景，在这些场景中，需要将多个接入设备提供的小范围的无线局域网组成一个大范围的局域网，下文将这个大范围的局域网成为当前局域网，在实际应用中，相邻接入设备所提供的无线局域网的覆盖范围可能会重叠，针对这种现象，本申请提供了一种新的终端设备归属无线局域网的划分方式。
具体的，如图16所示，接入设备1与接入设备2分别提供无线局域网1及无线局域网2部分相互重叠，在重叠区域内，无线局域网范围连线构成归属无线局域网的分界，在区域A范围内的终端设备a归属无线局域网1，在区域B内的终端设备b归属无线局域网2；这种终端设备归属无线局域网的划分方式简单。
具体的，如图17所示，接入设备1、接入设备2、接入设备3及接入设备4分别提供无线局域网1、无线局域网2、无线局域网3及无线局域网 4，无线局域网1、无线局域网2、无线局域网3及无线局域网4相互之后重叠或者覆盖之后，形成公共局域网C；针对接入设备1来说，接入设备2、接入设备3及接入设备4就是形成公共局域网的其他接入设备，针对认证服务器来说，确定的公共局域网C的接入设备包括接入设备1、接入设备2、接入设备3及接入设备4。
在实际应用中，本申请涉及的第一预定时长和第二预定时长可以根据经验及需要设置，例如第一预定时长可以设定为正常用户从第一无线局域网范围步行到第二无线局域网范围的时间，一般为10分钟，而第二预定时长可以设定为正常用户外出办事的时间，如24小时等。
在实际应用中，本申请涉及的设备标识是指唯一可以确定用户身份的参数，如设备的MAC地址(Media Access Control地址，媒体访问控制地址)，设备内SIM(Subscriber Identity Module，用户身份识别卡)卡对应的手机号等。
在实际应用中，本申请涉及的在网设备是指已经接入当前局域网所范围的接入设备提供的小范围的无线局域网的设备，那么对应的，终端设备为在网设备，代表着终端设备发生了由公共局域网C中无线局域网1切换到无线局域网2等的切换行为，或者短暂(小于第二预定时长)离开公共局域网C后重新返回的重新接入局域网的行为，而终端设备不是在网设备，代表着终端设备第一次接入公共局域网C中无线局域网的行为，超时(大于第二预定时长)离开公共局域网C后重新返回的重新接入局域网的行为。
在实际应用中，本申请涉及的在网设备的设备标识的实现，可以是通过设置合法用户的方式，其中，设置合法用户的方式是指设置一些用户为合法用户，这些用户的设备标识记为合法用户的设备标识，而在网设备的设备标识就是特指合法用户的设备标识，其具体实现如下文描述，不再详细赘述。
现通过具体实施方式结合附图的方式对本申请做出进一步的诠释说明。
第一实施例：
图1为本申请第一实施例提供的终端设备接入控制系统的组网示意图，由图1可知，本实施例提供的终端设备接入控制系统包括：多个接入设备，多个接入设备的无线局域网形成公共局域网；其中，接入设备之间直接或者间接通过第三方设备通信，进行数据交互；
接入设备配置为提供无线局域网；在检测到终端设备接入无线局域网的接入请求后，获取终端设备的设备标识，判断设备标识是否为在网设备的设备标识，若是，则将终端设备接入无线局域网，为终端设备提供无线接入服务，其中，接入请求为终端设备根据无线局域网的接入参数，如网络名称及接入密码等，发起的接入无线局域网的请求。这样，本申请提供的方法与现有技术相比，至少存在这样的优点：在认证终端设备的接入请求后，还需要认证终端设备的设备标识，仅在设备标识为允许接入的设备标识时，才会将终端设备接入，这样，即便提供无线局域网的接入设备的无线参数泄露，非法终端设备在使用无线参数接入无线局域网时，也会因为设备不在网设备的设备标识被拒绝访问，解决了现有接入设备仅认证无线局域网的接入参数存在的接入参数泄露使得非法用户可以随时接入无线局域网导致的无线局域网安全性低的问题。
图2为本申请第一实施例提供的接入设备的结构框图，由图2可知，本实施例提供的接入设备包括：网络局域网模块21、接入控制模块22及服务提供模块23，其中，
网络局域网模块21配置为提供无线局域网；
接入控制模块22配置为在检测到终端设备接入无线局域网的接入请求后，获取终端设备的设备标识，判断设备标识是否为为在网设备的设备标 识，若是，则触发服务提供模块23将终端设备接入无线局域网；接入请求为终端设备根据无线局域网的接入参数发起的接入无线局域网的请求；
服务提供模块23配置为将终端设备接入无线局域网，为终端设备提供无线接入服务。
在一些实施例中，上述实施例中的接入设备还包括存储模块，其中：
存储模块配置为存储合法用户信息列表，合法用户信息列表包括至少一条合法用户信息项，合法用户信息项包括合法用户的设备标识及资源使用信息，资源使用信息包括终端上网流量、终端上网时长中的至少一种；
接入控制模块22配置为调用合法用户信息列表，在合法用户信息列表中，查找与设备标识匹配的合法用户信息项；若查找到与设备标识匹配的合法用户信息项，则设备标识为符合预设规则的设备标识；若没有查找到与设备标识匹配的合法用户信息项，则设备标识不为在网设备的设备标识。
在一些实施例中，上述实施例中的接入控制模块22在为终端设备提供无线接入服务之后，还配置为：检测终端设备是否离开无线局域网；在检测到终端设备离开无线局域网后，判断是否在第一预定时长内接收到终端接入信息，其中，终端接入信息为形成公共局域网的其他接入设备在为终端设备提供无线接入服务后生成的信息，公共局域网由至少两个接入设备提供的无线局域网形成；若没有接收到终端接入信息，则认为终端设备离开公共局域网，并判断终端设备是否在第二预定时长内重新接入公共局域网；若未重新接入公共局域网，则删除合法用户信息列表中设备标识匹配的合法用户信息项，将更新后的合法用户信息列表，直接或者通过第三方设备，发送至形成公共局域网的其他接入设备。
在一些实施例中，上述实施例中的接入控制模块22在判断是否在第一预定时长内接收到终端接入信息之后，还配置为：若在第一预定时长内接收到终端接入信息，则更新资源使用信息，并将更新后的资源使用信息， 直接或者通过第三方设备，发送至形成公共局域网的其他接入设备；或者，接入控制模块在判断终端设备是否在第二预定时长内重新接入当前局域网之后，还用于：若在第二预定时长内重新接入当前局域网，则更新资源使用信息，并将更新后的资源使用信息，直接或者通过第三方设备，发送至形成公共局域网的其他接入设备。
在一些实施例中，上述实施例中的接入控制模块22在判断设备标识是否为在网设备的设备标识之后，还配置为：若设备标识不为在网设备的设备标识，则获取终端设备的身份认证信息；对身份认证信息进行认证；若认证通过，则允许终端设备接入无线局域网。在实际应用中，身份认证信息需要携带公共局域网的提供者为合法用户分别的身份认证参数，如酒店前台为客人配置的登录账号及登录密码，可以用来识别用户身份，进而判断用户是不是合法用户，这些登录账号及登录密码并不是接入设备(如路由器)提供的无线局域网(WiFi)的接入账号及密码。
在一些实施例中，当上述实施例中的接入设备包括存储模块时，接入控制模块22在允许终端设备接入无线局域网之后，还配置为：获取终端设备的资源使用信息；将终端设备的设备标识及资源使用信息对应存储为一条合法用户信息项，并更新至合法用户信息列表中；将更新后的合法用户信息列表，直接或者通过第三方设备，发送至形成公共局域网的其他接入设备。
图3为本申请第一实施例提供的终端设备接入控制方法的第一种流程图，由图3可知，本实施例提供的终端设备接入控制方法包括：
S301：在检测到终端设备接入无线局域网的接入请求后，获取终端设备的设备标识；接入请求为终端设备根据无线局域网的接入参数发起的接入无线局域网的请求；
S302：判断设备标识是否为在网设备的设备标识；若是，则执行步骤 S303，若否，则执行步骤S305；
S303：将终端设备接入无线局域网；
S304：为终端设备提供无线接入服务。
在一些实施例中，如图3所示，上述实施例中的方法在步骤S302之后，还包括：
S305：若设备标识不是在网设备的设备标识，则获取终端设备的身份认证信息；
S306：对身份认证信息进行认证；若认证通过，则执行步骤S307；若认证失败，则执行S308；
S307：将终端设备接入无线局域网；
S308：拒绝终端设备接入无线局域网。
在一些实施例中，当调用合法用户信息列表时，如图3所示，上述实施例中的方法在步骤S307之后，还包括：
S309：获取终端设备的资源使用信息；
S310：将终端设备的设备标识及资源使用信息对应存储为一条合法用户信息项，并更新至合法用户信息列表中；
S311：将更新后的合法用户信息列表，直接或者通过第三方设备，发送至形成公共局域网的其他接入设备。
在一些实施例中，上述实施例中的步骤S302包括：
调用合法用户信息列表，合法用户信息列表包括至少一条合法用户信息项，合法用户信息项包括合法用户的设备标识及资源使用信息，资源使用信息包括终端上网流量、终端上网时长中的至少一种；
在合法用户信息列表中，查找与设备标识匹配的合法用户信息项；
若查找到与设备标识匹配的合法用户信息项，则设备标识为在网设备的设备标识；
若没有查找到与设备标识匹配的合法用户信息项，则设备标识不为在网设备的设备标识。
图4为本申请第一实施例提供的终端设备接入控制方法的第二种流程图，由图4可知，本实施例提供的终端设备接入控制方法在为终端设备提供无线接入服务(S304或者S307)之后，还包括：
S401：周期性的检测终端设备是否离开无线局域网；若离开，则执行S402，若未离开，则返回执行S401；
S402：在检测到终端设备离开无线局域网后，判断是否在第一预定时长内接收到终端接入信息，其中，终端接入信息为形成公共局域网的其他接入设备在为终端设备提供无线接入服务后生成的信息；若没有接收到终端接入信息，则认为终端设备离开公共局域网，执行步骤S403，若在第一预定时长内接收到终端接入信息，则执行步骤S405；
S403：判断终端设备是否在第二预定时长内重新接入当前局域网；若未重新接入公共局域网，则执行步骤S404；若在第二预定时长内重新接入公共局域网，则执行步骤S407；
S404：删除合法用户信息列表中设备标识匹配的合法用户信息项，将更新后的合法用户信息列表，直接或者通过第三方设备，发送至形成公共局域网的其他接入设备。
在一些实施例中，如图4所示，上述实施例中的方法在S402之后还包括：
S405：若在第一预定时长内接收到终端接入信息，则更新资源使用信息；
S406：将更新后的资源使用信息，直接或者通过第三方设备，发送至形成公共局域网的其他接入设备。
在一些实施例中，如图4所示，上述实施例中的方法在S403之后还包 括：
S407：若在第二预定时长内重新接入当前局域网，则更新资源使用信息；
S408：将更新后的资源使用信息，直接或者通过第三方设备，发送至形成公共局域网的其他接入设备。
第二实施例：
图5为本申请第二实施例提供的终端设备接入控制系统的组网示意图，由图5可知，本实施例提供的终端设备接入控制系统包括：认证服务器、多个接入设备，多个接入设备的无线局域网形成一个公共局域网，接入设备之间直接或者间接通信，进行数据交互；其中
认证服务器用于用于获取在网设备的设备标识，发送在网设备的设备标识至公共局域网的接入设备；
接入设备用于在检测到终端设备接入无线局域网的接入请求后，获取终端设备的设备标识，根据终端设备的设备标识和在网设备的设备标识，判断终端设备是否为在网设备；对终端设备执行与判断结果对应的控制操作。
在实际应用中，当接入设备判断终端设备是否为在网设备的判断结果为否，则获取终端设备的身份认证信息，发送身份认证信息至认证服务器；
此时，认证服务器还用于对身份认证信息进行认证，并发送认证结果至接入设备；
接入设备还用于在认证结果为认证通过时，将终端设备接入无线局域网，并为终端设备提供无线接入服务。
图6为本申请第二实施例提供的接入设备的结构框图，由图6可知，本实施例提供的接入设备包括：通信模块61及处理器62，其中，
通信模块61配置为提供无线局域网，并与终端设备及认证服务器进行通信；
处理器62配置为在检测到终端设备接入无线局域网的接入请求后，获取终端设备的设备标识，根据终端设备的设备标识和在网设备的设备标识，判断终端设备是否为在网设备；对终端设备执行与判断结果对应的控制操作；接入请求为终端设备根据无线局域网的接入参数发起的接入无线局域网的请求。
在一些实施例中，上述实施例中的处理器62配置为判断终端设备是否为在网设备，若否，则获取终端设备的身份认证信息，发送身份认证信息至认证服务器，接收认证服务器返回的认证结果，在认证结果为认证通过时，将终端设备接入无线局域网，并为终端设备提供无线接入服务。
在一些实施例中，上述实施例中的通信模块61配置为接收认证服务器下发的合法用户信息列表，合法用户信息列表包括至少一条合法用户信息项，合法用户信息项包括合法用户的设备标识；处理器62配置为将合法用户的设备标识作为在网设备的设备标识。此时，处理器62配置为调用合法用户信息列表，在合法用户信息列表中，查找与终端设备的设备标识匹配的合法用户信息项，若查找到与设备标识匹配的合法用户信息项，则终端设备为在网设备，若没有查找到与设备标识匹配的合法用户信息项，则终端设备不是在网设备。在实际应用中，合法用户信息项包括合法用户的设备标识及资源使用信息，资源使用信息包括终端上网流量、终端上网时长中的至少一种，这样，处理器62可以根据资源使用信息为终端设备提供无线接入服务。
在一些实施例中，上述实施例中的处理器62还配置为在为终端设备提供无线接入服务之后，检测终端设备是否离开无线局域网；在检测到终端设备离开无线局域网后，判断通信模块61是否在第一预定时长内接收到认 证服务器转发的终端接入信息，其中，终端接入信息为形成公共局域网的其他接入设备在为终端设备提供无线接入服务后生成的信息，公共局域网由至少两个接入设备提供的无线局域网形成；若没有接收到终端接入信息，则认为终端设备离开当前局域网，通过通信模块向认证服务器发送用户离网消息，用户离网消息用于触发认证服务器判断终端设备是否在第二预定时长内重新接入公共局域网；若通过通信模块接收到认证服务器反馈的新合法用户信息列表，则将存储的合法用户信息列表替换为新合法用户信息列表。
在一些实施例中，上述实施例中的接入设备包括：通信总线、通信单元、处理器、存储器及存储在存储器上并可在处理器上运行的计算机程序，其中，
通信总线配置为实现通信单元、处理器及存储器之间的通信连接；
通信单元配置为提供无线局域网，并与终端设备及认证服务器进行通信；
处理器配置为执行计算机程序，以实现以下步骤：
在检测到终端设备接入无线局域网的接入请求后，获取终端设备的设备标识；
根据来自认证服务器的在网设备的设备标识，判断终端设备是否为在网设备；
若否，则获取终端设备的身份认证信息，发送身份认证信息至认证服务器；
接收认证服务器返回的认证结果，在认证结果为认证通过时，将终端设备接入无线局域网，并为终端设备提供无线接入服务。
在一些实施例中，上述实施例中的处理器还配置为执行计算机程序，以实现以下步骤：
接收认证服务器下发的合法用户信息列表；
将合法用户的设备标识作为在网设备的设备标识；
调用合法用户信息列表，在合法用户信息列表中，查找与终端设备的设备标识匹配的合法用户信息项；
若查找到与设备标识匹配的合法用户信息项，则终端设备为在网设备，若没有查找到与设备标识匹配的合法用户信息项，则终端设备不是在网设备。
在一些实施例中，上述实施例中的处理器还配置为执行计算机程序，以实现以下步骤：
在为终端设备提供无线接入服务之后，检测终端设备是否离开无线局域网；
在检测到终端设备离开无线局域网后，判断通信模块是否在第一预定时长内接收到终端接入信息，其中，终端接入信息为形成公共局域网的其他接入设备在为终端设备提供无线接入服务后生成的信息，公共局域网由至少两个接入设备提供的无线局域网形成；
若没有接收到终端接入信息，则认为终端设备离开公共局域网，通过通信模块向认证服务器发送用户离网消息，用户离网消息用于触发认证服务器判断终端设备是否在第二预定时长内重新接入公共局域网；
若通过通信模块接收到认证服务器反馈的新合法用户信息列表，则将存储的合法用户信息列表替换为新合法用户信息列表。
在一些实施例中，本申请实施例还提供了一种计算机可读存储介质，计算机可读存储介质存储有一个或者多个程序，一个或者多个程序可被执行，以实现以下步骤：
在检测到终端设备接入无线局域网的接入请求后，获取终端设备的设备标识；
根据来自认证服务器的在网设备的设备标识，判断终端设备是否为在网设备；
若否，则获取终端设备的身份认证信息，发送身份认证信息至认证服务器；
接收认证服务器返回的认证结果，在认证结果为认证通过时，将终端设备接入无线局域网，并为终端设备提供无线接入服务。
在一些实施例中，上述实施例中的一个或者多个程序可被执行，以实现以下步骤：
接收认证服务器下发的合法用户信息列表；
将合法用户的设备标识作为在网设备的设备标识；
调用合法用户信息列表，在合法用户信息列表中，查找与终端设备的设备标识匹配的合法用户信息项；
若查找到与设备标识匹配的合法用户信息项，则终端设备为在网设备，若没有查找到与设备标识匹配的合法用户信息项，则终端设备不是在网设备。
在一些实施例中，上述实施例中的一个或者多个程序可被执行，以实现以下步骤：
在为终端设备提供无线接入服务之后，检测终端设备是否离开无线局域网；
在检测到终端设备离开无线局域网后，判断通信模块是否在第一预定时长内接收到终端接入信息，其中，终端接入信息为形成公共局域网的其他接入设备在为终端设备提供无线接入服务后生成的信息，公共局域网由至少两个接入设备提供的无线局域网形成；
若没有接收到终端接入信息，则认为终端设备离开公共局域网，通过通信模块向认证服务器发送用户离网消息，用户离网消息用于触发认证服 务器判断终端设备是否在第二预定时长内重新接入公共局域网；
若通过通信模块接收到认证服务器反馈的新合法用户信息列表，则将存储的合法用户信息列表替换为新合法用户信息列表。
图7为本申请第二实施例提供的认证服务器的结构框图，由图7可知，本实施例提供的认证服务器包括：认证模块71及处理器72，其中，
认证模块71配置为与接入设备进行通信；
处理器72配置为获取在网设备的设备标识，发送在网设备的设备标识至公共局域网的接入设备；公共局域网由至少两个接入设备提供的无线局域网形成；其中，在网设备的设备标识用于接入设备在接收到终端设备接入无线局域网的接入请求后，对获取到的终端设备的设备标识进行认证，并仅在终端设备为在网设备时，将终端设备接入无线局域网，并为终端设备提供无线接入服务，在终端设备不是在网设备时，将通过认证服务器进行认证，仅在认证通过时，将终端设备接入；接入请求为终端设备根据无线局域网的接入参数发起的接入无线局域网的请求，公共局域网由至少两个接入设备提供的无线局域网形成。
在一些实施例中，上述实施例中的处理器72配置为：确定形成公共局域网的接入设备；构建包括至少一条合法用户信息项的合法用户信息列表，合法用户信息项包括合法用户的设备标识；发送合法用户信息列表至接入设备。在实际应用中，为了便于接入设备为终端设备提供接入服务，合法用户信息项包括合法用户的设备标识及资源使用信息，资源使用信息包括终端上网流量、终端上网时长中的至少一种。
在一些实施例中，上述实施例中的处理器72在发送合法用户信息列表至接入设备之后，还配置为：通过认证模块接收接入设备发送的用户离网消息；判断用户离网消息对应的终端设备是否在第二预定时长内重新接入公共局域网；若否，则删除合法用户信息列表中设备标识匹配的合法用户 信息项，生成新合法用户信息列表；发送新合法用户信息列表至接入设备。
在一些实施例中，上述实施例中的认证模块71配置为：接收管理人员配置的合法用户的设备标识，作为在网设备的设备标识；和/或，接收接入设备发送的身份认证信息，对身份认证信息进行认证，若认证通过，则将身份认证信息对应的设备标识作为在网设备的设备标识。
在一些实施例中，上述实施例中的认证服务器包括：通信总线、通信单元、处理器、存储器及存储在存储器上并可在处理器上运行的计算机程序，其中，
通信总线配置为实现通信单元、处理器及存储器之间的通信连接；
通信单元配置为与接入设备进行通信；
处理器配置为执行计算机程序，以实现以下步骤：
获取在网设备的设备标识；
发送在网设备的设备标识至公共局域网的接入设备；公共局域网由至少两个接入设备提供的无线局域网形成。
在一些实施例中，上述实施例中的处理器还用于执行计算机程序，以实现以下步骤：
确定形成公共局域网的接入设备；
构建包括至少一条合法用户信息项的合法用户信息列表，合法用户信息项包括合法用户的设备标识及资源使用信息，资源使用信息包括终端上网流量、终端上网时长中的至少一种；
发送合法用户信息列表至接入设备。
在一些实施例中，上述实施例中的处理器还用于执行计算机程序，以实现以下步骤：
在发送合法用户信息列表至接入设备之后，接收接入设备发送的用户离网消息；
判断用户离网消息对应的终端设备是否在第二预定时长内重新接入公共局域网；
若否，则删除合法用户信息列表中设备标识匹配的合法用户信息项，生成新合法用户信息列表；
发送新合法用户信息列表至接入设备。
在一些实施例中，上述实施例中的处理器还用于执行计算机程序，以实现以下步骤：
接收管理人员配置的合法用户的设备标识，作为在网设备的设备标识；
和/或，
接收接入设备发送的身份认证信息，对身份认证信息进行认证，若认证通过，则将身份认证信息对应的设备标识作为在网设备的设备标识。
在一些实施例中，本申请实施例还提供了一种计算机可读存储介质，计算机可读存储介质存储有一个或者多个程序，一个或者多个程序可被执行，以实现以下步骤：
获取在网设备的设备标识；
发送在网设备的设备标识至公共局域网的接入设备；公共局域网由至少两个接入设备提供的无线局域网形成。
在一些实施例中，上述实施例中的一个或者多个程序可被执行，以实现以下步骤：
确定形成公共局域网的接入设备；
构建包括至少一条合法用户信息项的合法用户信息列表，合法用户信息项包括合法用户的设备标识及资源使用信息，资源使用信息包括终端上网流量、终端上网时长中的至少一种；
发送合法用户信息列表至接入设备。
在一些实施例中，上述实施例中的一个或者多个程序可被执行，以实 现以下步骤：
在发送合法用户信息列表至接入设备之后，接收接入设备发送的用户离网消息；
判断用户离网消息对应的终端设备是否在第二预定时长内重新接入公共局域网；
若否，则删除合法用户信息列表中设备标识匹配的合法用户信息项，生成新合法用户信息列表；
发送新合法用户信息列表至接入设备。
在一些实施例中，上述实施例中的一个或者多个程序可被执行，以实现以下步骤：
接收管理人员配置的合法用户的设备标识，作为在网设备的设备标识；
和/或，
接收接入设备发送的身份认证信息，对身份认证信息进行认证，若认证通过，则将身份认证信息对应的设备标识作为在网设备的设备标识。
图8为本申请第二实施例提供的终端设备接入控制方法的流程图，由图8可知，本实施例提供的终端设备接入控制方法包括：
S801：认证服务器获取在网设备的设备标识，发送在网设备的设备标识至公共局域网的接入设备，公共局域网由至少两个接入设备提供的无线局域网形成；
S802：接入设备在检测到终端设备接入无线局域网的接入请求后，获取终端设备的设备标识，根据终端设备的设备标识和在网设备的设备标识，判断终端设备是否为在网设备；对终端设备执行与判断结果对应的控制操作。
图9为本申请第二实施例提供的终端设备接入控制方法在接入设备侧 的总体流程图，由图9可知，本实施例提供的终端设备接入控制方法在接入设备侧的体现包括：
S901：在检测到终端设备接入无线局域网的接入请求后，获取终端设备的设备标识；
S902：根据终端设备的设备标识和在网设备的设备标识，判断终端设备是否为在网设备；
S903：对终端设备执行与判断结果对应的控制操作。
图18为本申请第二实施例提供的终端设备接入控制方法在接入设备侧的第一种流程图，由图18可知，本实施例提供的终端设备接入控制方法在接入设备侧的体现包括：
S901：在检测到终端设备接入无线局域网的接入请求后，获取终端设备的设备标识；接入请求为终端设备根据无线局域网的接入参数发起的接入无线局域网的请求；
S902：根据在网设备的设备标识，判断终端设备是否为在网设备；若是，则执行S904，若不是，则执行S905；
S904：将终端设备接入无线局域网，为终端设备提供无线接入服务；
S905：获取终端设备的身份认证信息，发送身份认证信息至认证服务器；
S906：接收认证服务器返回的认证结果，在认证结果为认证通过时，将终端设备接入无线局域网，并为终端设备提供无线接入服务。
在图18中，步骤S904至步骤S906即是步骤S903的具体内容。
由图18可知，在一些实施例中，上述实施例中的方法，在步骤S902之前，还包括：
S900：接收认证服务器下发的合法用户信息列表，合法用户信息列表包括至少一条合法用户信息项，合法用户信息项包括合法用户的设备标识， 将合法用户的设备标识作为在网设备的设备标识；在实际应用中，合法用户信息项还包括合法用户的资源使用信息，资源使用信息包括终端上网流量、终端上网时长中的至少一种。
在一些实施例中，上述实施例中的步骤S902包括：
调用合法用户信息列表，在合法用户信息列表中，查找与终端设备的设备标识匹配的合法用户信息项；
若查找到与设备标识匹配的合法用户信息项，则终端设备为在网设备；若没有查找到与设备标识匹配的合法用户信息项，则终端设备不是在网设备。
图10为本申请第二实施例提供的终端设备接入控制方法在接入设备侧的第二种流程图，由图10可知，本实施例提供的终端设备接入控制方法在接入设备侧的体现在为终端设备提供无线接入服务(S904及S906)之后，还包括：
S1001：周期性的检测终端设备是否离开无线局域网；若离开，则执行S1002，若未离开，则返回执行S1001；
S1002：在检测到终端设备离开无线局域网后，判断是否在第一预定时长内接收到认证服务器转发的终端接入信息，终端接入信息为形成公共局域网的其他接入设备在为终端设备提供无线接入服务后生成的信息；若没有接收到终端接入信息，则执行S1003，若接收到终端接入信息，则执行S1006；
S1003：若没有接收到终端接入信息，则认为终端设备离开公共局域网，向认证服务器发送用户离网消息，用户离网消息用于触发认证服务器判断终端设备是否在第二预定时长内重新接入公共局域网；
S1004：等待第二预定时长，判断是否接收到新合法用户信息列表；若接收到新合法用户信息列表，则执行S1005，若没有接收到新合法用户信息 列表，则执行S1007；
S1005：若接收到认证服务器反馈的新合法用户信息列表，则将存储的合法用户信息列表替换为新合法用户信息列表；
S1006：若接收到终端接入信息，则认为该用户终端在第一预定时长内重新接入公共局域网的其他无线局域网，维持合法用户信息列表；
S1007：若接收到认证服务器侧的响应消息之后，仍没有接收到新合法用户信息列表，则认为该用户终端在第二预定时长内重新接入公共局域网，维持合法用户信息列表。
图11为本申请第二实施例提供的终端设备接入控制方法在认证服务器侧的第一种流程图，由图11可知，本实施例提供的终端设备接入控制方法在认证服务器侧的体现包括：
S1101：获取在网设备的设备标识；在网设备的设备标识用于接入设备在接收到终端设备接入无线局域网的接入请求后，对终端设备是否为在网设备进行认证；
S1102：发送在网设备的设备标识至公共局域网的接入设备，公共局域网由至少两个接入设备提供的无线局域网形成。
在一些实施例中，上述实施例中的步骤S1101包括：
接收管理人员配置的合法用户的设备标识，作为在网设备的设备标识；
和/或，
接收接入设备发送的身份认证信息，对身份认证信息进行认证，若认证通过，则将用户认证信息对应的设备标识作为在网设备的设备标识。
在一些实施例中，上述实施例中的步骤S1102包括：
确定形成公共局域网的接入设备；
构建包括至少一条合法用户信息项的合法用户信息列表，合法用户信 息项包括合法用户的设备标识；在实际应用中，合法用户信息项还包括合法用户的资源使用信息，资源使用信息包括终端上网流量、终端上网时长中的至少一种；
发送合法用户信息列表至接入设备。
图12为本申请第二实施例提供的终端设备接入控制方法在认证服务器侧的第二种流程图，由图12可知，本实施例提供的终端设备接入控制方法在认证服务器侧的体现在发送合法用户信息列表至接入设备(步骤S1102)之后，还包括：
S1201：周期性的判断是否接收到接入设备发送的用户离网消息；若是，则执行S1202：若否，则返回执行S1201；
S1202：判断用户离网消息对应的终端设备是否在第二预定时长内重新接入公共局域网；若否，则认为该用户终端设备离开了公共局域网，执行S1203，若是，则认为该用户终端设备重新加入公共局域网，则执行S1205；
S1203：若否，则删除合法用户信息列表中设备标识匹配的合法用户信息项，生成新合法用户信息列表；
S1204：发送新合法用户信息列表至接入设备；
S1205：向接入设备返回响应。
第三实施例：
现结合具体应用场景、以接入设备为CPE(Customer Premise Equipment，客户终端设备)设备为例，对本申请做进一步的诠释说明。
随着互联网的快速发展，CPE设备作为一种较为便携式的通讯终端得到了广泛的应用，但CPE通常作为较狭小环境中(如家庭、小型咖啡馆等)使用的设备，并且CPE设备通常相对比较独立不具有统一管理的特性，尤其是在对多用户接入时，只要这些用户具有当前CPE的认证信息就可以登 入，安全性较差，这些认证信息在CPE上就可以被更改，当有多个CPE进行组网的时候，则显得力不从心了。针对这些问题，本实施例提出了一种基于radius(remote authentication dial in user service，远程用户拨号认证系统)认证的管理CPE用户接入的方法。
具体的，如图13所示，本实施例提供的管理控制系统包括：一个radius服务器(即上述实施例涉及的认证服务器)，多个CPE设备(即上述实施例涉及的接入设备)以及多个用户的终端设备，其中，
在radius服务器中运行有传统的认证服务进程及总控进程，其中，认证服务进程用于监听各个CPE设备传输过来的AAA(Authentication、Authorization、Accounting，认证、鉴权、计费)认证信息。同时radius服务器上运行一个总控进程，此进程负责控制所有的CPE设备用户信息数据，当用户信息经过认证服务进程认证通过之后，认证服务进程触发总控进程，总控进程利用VLAN技术(按IP组播划分，是一种VLAN的定义，即认为一个组播组就是一个VLAN，这种划分的方法将VLAN扩大到了广域网，因此这种方法具有更大的灵活性)将组建组播信息发送到组网内的各个CPE中。
总控进程用于调度所有的CPE设备消息处理，总控所有的事件处理。
服务器离网计时器：此计时器运行于服务器中，服务器中的总控进程收到CPE监控进程(运行于CPE设备中)发送的某用户终端离网消息之后，启动此计时器，当此计时器达到设定值之后，则总控进程会在局域网内广播消息，删除所有CPE设备中此用户终端的用户信息。如果在此时间内收到CPE设备广播的用户终端重新接入的消息，则关闭计时器。
CPE设备中运行radius client(认证客户端)，当终端用户A登录到CPE设备时，将输入登录用户名，密码(此用户名，密码，将由网络管理员统一管理，网络管理员需设置不同的用户名参数，给予其不同/相同的上网时 间，上网流量等信息)
CPE设备中运行CPE监控进程，所有CPE设备当收到radius服务器中总控进程发送的组播报文消息后，解析此报文消息获得登录用户的参数信息，列表(即本申请涉及的合法用户信息列表)下表1所示，其中设备MAC(Media Access Control，媒体访问控制)地址为设备唯一标识，User_name为终端登录用户名，passwpord为密码，traffic为此用户登录剩余流量，单位为兆(M)，time为此用户登录剩余时间，单位是分钟(min)。
设备MAC User_name passwpord Traffic(M) Time(mins)
00-23-5A-15-99-42 iPhone-A 123456 50 #(不限制)
6E-2F-4C-16-24-89 iPhone-B Admin #(不限制) 60
9B-2A-1B-42-72-63 iPhone-C Mima 45 38
表1
CPE离网定时器，运行于CPE设备中，用于计算用户终端离开本设备WIFI网络的时间是否大于第一预设时长，如果第一预设时长内未收到局域网内其余CPE设备广播的用户终端接入信息，则会触发CPE设备的CPE监控进程发送终端设备离网消息给radius服务器的总控进程。
多CPE设备对流量及时间的统一处理：
对于流量，网络管理员首先设置各终端设备的初始流量并通过radius服务器上的总控进程在局域网内广播消息通知所有的CPE设备。CPE设备获得此消息后初始化并将指此用户的参数更新到合法用户信息列表中。CPE设备利用linux防火墙iptables流量统计能力对接入网络的所有终端设备的流量进行统一监控，设置流量上限，其数值等于traffic中的对应值，(1)当用户流量超过时则断开网络，并通过CPE监控进程在局域网内广播通知，告知所有CPE设备将其用户信息中的traffic值置零。(2)当用户断开CPE-1时且此时流量未超限，则CPE-1中的监控进程读取此时间内iptables进程所 监控用户使用的流量，更新用户信息参数表，并通过监控进程利用VLAN在局域网中进行报文广播，其余CPE设备收到广播信息后更新用户参数表，当此用户进入其余CPE覆盖范围时，则会按照更新后的用户信息参数表中的流量进行上限设置，计流等操作。
对于时间，网络管理员首先设置各终端设备的初始上网时间并通过radius服务器上的总控进程在局域网内广播消息触发所有的CPE设备，CPE设备获得此消息后初始化并将指此用户的参数更新到合法用户信息列表中。此时每个CPE设备都会针对此用户启动一个定时器，但此定时器处于wait状态，当用户实际接入网内某个CPE设备(如CPE-1)时，此CPE设备启动定时器，(1)如果时间到，则监控进程通知设备关闭此用户的链接。(2)如果时间未到，情况1：用户离开CPE-1的覆盖范围，进入CPE-2的WIFI覆盖范围，监控模块收到CPE-2广播的终端接入信息，发送暂停消息给CPE计时器，计时器停止并触发监控进程更新合法用户信息列表，之后监控进程在局域网内广播更新消息，通知所有CPE设备更新合法用户信息列表。CPE-2设备启动自身的计时器开始计时。情况2：用户离开此局域网，CPE-1在一定时间内未收到其余CPE设备广播的此用户接入消息，则关闭计时器，并发送上报用户离网消息以及更新后的用户参数列表信息给radius服务器，radius服务器启动此用户的挂起定时器。情况3：用户重新进入此局域网，接入的CPE设备同样发送用户名密码的认证请求给radius服务器，radius服务器关闭挂起定时器，发送认证通过信息以及用户参数列表给所有的CPE设备进行参数列表的更新，此用户接入的CPE设备则启动计时器开启进行上网时间统计。
用户在大局域网中不同小WIFI范围的切换：
(1)用户当首次进入此局域网中时(假设先进入CPE-1设备的WIFI覆盖范围)，用户终端首先通过WIFI设备的SSID以及WIFI密码这种传统 形式链接到CPE-1设备WIFI，但此时CPE设备并不将用户终端进行联网，而是显示认证页面，要求用户终端设备输入用户名密码等进行认证，CPE-1设备将此用户名密码传输到radius服务器中进行认证，如果认证未通过，则radius服务器认证服务进程触发总控进程局域网广播消息，通知所有CPE屏蔽此用户终端。如果认证通过radius服务器认证服务进程触发总控进程在局域网内广播消息，此消息中具有此用户终端的参数信息表中的参数信息(即终端MAC地址、登录用户名、密码、剩余上网流量、剩余上网时间)，所有的CPE设备收到此消息信息之后将更新自己的参数信息列表。对于CPE-1则认证通过开启此用户的上网权限，并根据此用户是依据流量上网还是时间上网来进行权限监控。
(2)当此用户在局域网内进行移动，由CPE-1的WIFI覆盖范围，切换到CPE-2的WIFI覆盖范围时，此处的覆盖范围并不是很精确，中间必然会存在交叉地带。当CPE-2的WIFI信号强于CPE-1的WIFI覆盖信号，此时此终端将接入CPE-2的WIFI信号，CPE-2的设备与用户终端链接成功后，会在局域网内发送广播消息请求此用户终端的用户参数信息，CPE-1收到此广播消息后，会将之前的统计的剩余流量以及剩余时间等参数信息列表发送给CPE-2设备。CPE-2设备会更新用户参数信息表并开始对此用户的上网时间以及流量进行监控统计。
(3)当此用户离开局域网时，由CPE-2的WIFI覆盖范围移出，此种情况，CPE-2设备在一定时间内(此时间即目前WIFI通用的断开时间)，未发现此用户终端且没有收到其余局域网内CPE设备广播的用户终端接入消息，则认为此用户已离开局域网发送信息给radius服务器，radius服务器则将此用户挂起并开启一个挂起定时器，当此用户在此定时器到时之前未从新接入局域网内的CPE设备，则认为用户离开，将发送广播信息，清除所有CPE设备上的此用户信息。
(4)当此用户重新进入局域网时，操作步骤类似步骤(1)，同样需重新登录用户名密码，CPE发送此用户名密码进行认证，radius服务器认证时，通过广播消息通知所有CPE获取此用户的参数信息表。
在上述描述的基础上，现结合图14及15对本申请的具体实现进行描述。
图14是用户终端流量计费上网流程图，由图14可知，本方法包括：
S1401：网络管理员对将要接入的用户终端在服务器上进行参数配置，通过认证服务进程配置允许接入的用户名密码、总控进程配置此用户的参数信息(MAC地址、用户名、密码、剩余上网流量)。
S1402：终端设备接入局域网，获取设备标识；
用户终端通过CPE-1设备(以此为例，可以是组网内的任意CPE设备)，首先接入CPE-1设备的WIFI，获取设备标识；
S1403：判断用户终端是否为新接入的用户终端；本步骤主要是根据各接入设备维护的合法用户设备标识列表实现；若是新设备，则执行S1404；若终端设备之前短暂离开了局域网，在服务器离网计时器的时间内重返局域网，CPE设备会首先在自身的合法用户信息列表中查找，认为该设备终端不是新设备，则执行S1415；
S1404：获取用户名及密码；
此时CPE-1显示认证页面，提示终端用户输入需要认证的用户名密码(即网络管理员给此用户配置的用户名、密码)；
S1405：认证是否是合法用户；若认证通过，则执行S1406；若认证未通过，则执行S1414；
CPE-1设备中的radius client将此用户名密码信息上传服务器，通过radius服务器进行AAA认证；
S1406:如果radius服务器中的认证服务进程认证通过，则首先触发服 务器中的总控进程。总控进程查询网络管理员配置的此用户终端的参数信息并将此参数信息在局域网内进行广播。所有CPE设备的监控进程接收到广播消息后，会更新自己的用户参数信息表，其中CPE-1设备，则利用防火墙功能，放开此用户，使此终端设备能够进行网络接入。并利用防火墙的计流量功能对此用户进行上网流量统计，实时对比参数信息表。
S1407-S1409:当CPE设备统计的此用户终端上网流量小于剩余上网流量且用户直接从此局域网内的任意CPE设备的WIFI覆盖范围移出。CPE-1设备会启动此用户的离网计时器，此计时器时间(长短等于第一预设时长)内，未收到别的CPE广播的用户接入消息，则监控进程发送用户离网消息给服务器。服务器总控进程接收到CPE发送的用户离网消息后，启动服务器离网计时器(长短等于第二预设时长)，计算此用户终端离开局域网的时间，如果规定时间到期内收到网内CPE广播的此终端入网消息，则关闭计时器。如果时间到期却未收到CPE广播的终端入网消息，则总控进程广播用户离网确认消息，触发网内所有的CPE设备删除用户信息列表中此终端的信息，则结束。
S1410-S1413:当CPE设备统计的此用户终端上网流量小于剩余上网流量且用户从CPE-1设备的WIFI覆盖范围移动至CPE-2设备的WIFI覆盖范围。CPE-1设备会启动一个离网定时器，其此时CPE-2设备会接收到设备发送的WIFI接入请求，WIFI模块发送认证请求给CPE-2设备的监控进程，监控进程查询自身的用户信息列表。如果存在，CPE-2设备的监控进程在局域网内广播此用户终端的接入消息。局域网内的CPE-1的设备(其余设备的忽略此消息)监控进程接收到此用户终端的接入信息之后。关闭此用户终端在CPE-1上的流量统计及上网权限，关闭离网定时器。更新用户信息列表中的剩余流量，发送包含更新后的用户信息列表消息给CPE-2设备。CPE-2设备接收到CPE-1发送来的包含用户信息的消息，则首先更新自身 的用户状态消息列表。之后打开此用户的上网权限，利用防火墙的计流量功能对此用户进行上网流量统计，实时对比参数信息表。
S1414:服务器中的认证服务进程认证未通过，则通知CPE设备不允许此用户终端进行接入。
S1415-S1416:通知服务器关闭离网计时器；允许入网并开启流量计费。
这里，如果终端设备之前短暂离开了局域网，在服务器离网计时器的时间内重返局域网，CPE设备会首先在自身的合法用户信息列表中查找如果存在则不需要认证用户名密码，直接进入步骤S1416(等同于S1406)。
S1417-S1419:当CPE设备统计的此用户终端上网流量大于等于剩余上网流量时，则CPE关闭此终端用户的上网权限，监控进程触发服务器总控进程此终端用户流量超限，总控进程通知所有局域网内的CPE，删除此用户信息列表，此用户下线。
图15是用户终端时间计费上网流程图，由图15可知，本方法包括：
S1501:网络管理员对将要接入的用户终端在服务器上进行参数配置，通过认证服务进程配置允许接入的用户名密码，总控进程配置此用户的参数信息(MAC地址、用户名、密码、剩余上网时间)。
S1502：终端设备接入局域网，获取设备标识；
用户终端通过CPE-1设备(以此为例，可以是组网内的任意CPE设备)，首先接入CPE-1设备的WIFI，获取设备标识；
S1503：判断用户终端是否为新接入的用户终端；本步骤主要是根据各接入设备维护的合法用户设备标识列表实现；若是新设备，则执行S1504；若终端设备之前短暂离开了局域网，在服务器离网计时器的时间内重返局域网，CPE设备会首先在自身的合法用户信息列表中查找，认为该设备终端不是新设备，则执行S1515；
S1504：获取用户名及密码；
此时CPE-1显示认证页面，提示终端用户输入需要认证的用户名密码(即网络管理员给此用户配置的用户名、密码)；
S1505：radius服务器认证是否是合法用户；若认证通过，则执行S1506；若认证未通过，则执行S1514；
CPE-1设备中的radius client将此用户名密码信息上传服务器，通过radius服务器中的认证服务进程进行AAA认证；
S1506:如果认证通过，则radius服务器中的认证服务进程首先触发服务器中的总控进程。总控进程查询网络管理员配置的此用户终端的参数信息(mac地址、用户名、密码、剩余上网时间)并将此参数信息在局域网内进行广播。所有CPE设备的监控进程接收到广播消息后，会更新自己的用户参数信息表，其中CPE-1设备，则利用防火墙功能，放开此用户，使此终端设备能够进行网络接入。并启动上网计时器对此用户进行接入时间计时，并实时对比参数信息表。
S1507-S1509:当CPE设备统计的此用户终端上网时间小于剩余上网时间且用户直接从此局域网内的任意CPE设备的WIFI覆盖范围移出。CPE-1设备会启动此用户的离网计时器，此计时器时间内，未收到别的CPE广播的用户接入消息，则监控进程发送用户离网消息给服务器。服务器总控进程接收到CPE发送的用户离网消息后，启动服务器离网计时器，计算此用户终端离开局域网的时间，如果时间到期内收到网内CPE广播的此终端入网消息则关闭计时器。如果时间到期却未收到CPE广播的终端入网消息，则总控进程广播用户离网确认消息，通知网内所有的CPE设备删除用户信息列表中此终端的信息，则结束。
S1510-S1513:当CPE设备统计的此用户终端上网时间小于剩余上网时间且用户从CPE-1设备的WIFI覆盖范围移动至CPE-2设备的WIFI覆盖范围。CPE-1设备会启动离网定时器，此时CPE-2设备会接收到设备发送的 WIFI接入请求，WIFI模块发送认证请求给CPE-2设备的监控进程，监控进程查询自身的用户信息列表。如果存在。CPE-2设备的监控进程在局域网内广播此用户终端的接入消息。局域网内的CPE-1的设备(其余设备的忽略此消息)监控进程接收到此用户终端的接入信息之后。关闭此用户终端在CPE-1上的时间统计及上网权限，关闭离网定时器。更新用户信息列表中的剩余上网时间，发送包含更新后的用户信息列表消息给CPE-2设备。CPE-2设备接收到CPE-1发送来的包含用户信息的消息，则首先更新自身的用户状态消息列表。之后打开此用户的上网权限，上网计时器对此用户进行接入时间计时，实时对比参数信息表。
S1514:服务器中的radius server认证未通过，则通知CPE-1设备不允许此用户终端进行接入。
S1515-S1516:通知服务器关闭离网计时器；允许入网并开启流量计费。
这里，如果终端设备之前短暂离开了局域网，在服务器离网计时器的时间内重返局域网，CPE设备会首先在自身的合法用户信息列表中查找如果存在则不需要认证用户名密码，直接进入步骤S1516(等同于S1506)。
S1517-S1519:当CPE设备统计的此用户终端上网时间大于等于剩余上网时间时，则CPE关闭此终端用户的上网权限，CPE监控进程通知服务器的总控进程此终端用户流量超限，总控进程通知所有局域网内的CPE，删除此用户信息列表，此用户下线。
综上可知，通过本申请实施例的实施，至少存在以下有益效果：
本申请实施例提供了一种接入设备、认证服务器、终端设备接入控制方法及系统，其中，该方法在检测到终端设备根据无线局域网的接入参数请求接入无线局域网时，将获取设备标识，判断终端设备是否为在网设备，根据判断结果的不同，对终端设备执行不同的控制操作，例如，在为在网设备时，直接将终端设备接入，在不是在网设备时，将通过认证服务器进 行认证，仅在认证通过时，将终端设备接入；这样，即便提供无线局域网的接入设备的无线参数泄露，非法终端设备在使用无线参数接入无线局域网时，也会因为终端设备认证不通过被拒绝访问，解决了现有接入设备仅认证无线局域网的接入参数存在的接入参数泄露使得非法用户可以随时接入无线局域网导致的无线局域网安全性低的问题。
本领域内的技术人员应明白，本申请的实施例可提供为方法、系统、或计算机程序产品。因此，本申请可采用硬件实施例、软件实施例、或结合软件和硬件方面的实施例的形式。而且，本申请可采用在一个或多个其中包含有计算机可用程序代码的计算机可用存储介质(包括但不限于磁盘存储器和光学存储器等)上实施的计算机程序产品的形式。
本申请是参照根据本申请实施例的方法、设备(系统)、和计算机程序产品的流程图和/或方框图来描述的。应理解可由计算机程序指令实现流程图和/或方框图中的每一流程和/或方框、以及流程图和/或方框图中的流程和/或方框的结合。可提供这些计算机程序指令到通用计算机、专用计算机、嵌入式处理机或其他可编程数据处理设备的处理器以产生一个机器，使得通过计算机或其他可编程数据处理设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的装置。
这些计算机程序指令也可存储在能引导计算机或其他可编程数据处理设备以特定方式工作的计算机可读存储器中，使得存储在该计算机可读存储器中的指令产生包括指令装置的制造品，该指令装置实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能。
这些计算机程序指令也可装载到计算机或其他可编程数据处理设备上，使得在计算机或其他可编程设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其他可编程设备上执行的指令提供用于实现 在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。
以上仅是本申请的具体实施方式而已，并非对本申请做任何形式上的限制，凡是依据本申请的技术实质对以上实施方式所做的任意简单修改、等同变化、结合或修饰，均仍属于本申请技术方案的保护范围。
工业实用性
本申请实施例的技术方案，在检测到终端设备根据无线局域网的接入参数请求接入无线局域网时，将获取设备标识，判断终端设备是否为在网设备，根据判断结果的不同，对终端设备执行不同的控制操作，例如，在为在网设备时，直接将终端设备接入，在不是在网设备时，将通过认证服务器进行认证，仅在认证通过时，将终端设备接入；这样，即便提供无线局域网的接入设备的无线参数泄露，非法终端设备在使用无线参数接入无线局域网时，也会因为终端设备认证不通过被拒绝访问，解决了现有接入设备仅认证无线局域网的接入参数存在的接入参数泄露使得非法用户可以随时接入无线局域网导致的无线局域网安全性低的问题。

Claims (19)

  1. 一种终端设备接入控制方法，包括：
    在检测到终端设备接入无线局域网的接入请求后，获取所述终端设备的设备标识；
    根据所述终端设备的设备标识和在网设备的设备标识，判断所述终端设备是否为在网设备；
    对所述终端设备执行与判断结果对应的控制操作。
  2. 如权利要求1所述的终端设备接入控制方法，其中，所述对所述终端设备执行与判断结果对应的控制操作包括：
    当所述判断结果为所述终端设备为在网设备时，将所述终端设备接入所述无线局域网，并为所述终端设备提供无线接入服务。
  3. 如权利要求1所述的终端设备接入控制方法，其中，所述对所述终端设备执行与判断结果对应的控制操作还包括：
    当所述判断结果为所述终端设备不为在网设备时，获取所述终端设备的身份认证信息，发送所述身份认证信息至所述认证服务器；
    接收所述认证服务器返回的认证结果，在所述认证结果为认证通过时，将所述终端设备接入所述无线局域网，并为所述终端设备提供无线接入服务。
  4. 如权利要求1至3任一项所述的终端设备接入控制方法，其中，在判断所述终端设备是否为在网设备之前，还包括：
    接收认证服务器下发的合法用户信息列表，所述合法用户信息列表包括至少一条合法用户信息项，所述合法用户信息项包括合法用户的设备标识；
    将所述合法用户的设备标识作为所述在网设备的设备标识。
  5. 如权利要求4所述的终端设备接入控制方法，其中，在为所述终 端设备提供无线接入服务之后，还包括：
    检测所述终端设备是否离开所述无线局域网；
    在检测到所述终端设备离开所述无线局域网后，判断是否在第一预定时长内接收到所述认证服务器转发的终端接入信息，其中，所述终端接入信息为形成公共局域网的其他接入设备在为所述终端设备提供无线接入服务后生成的信息，所述公共局域网由至少两个接入设备提供的无线局域网形成；
    若没有接收到所述终端接入信息，则认为所述终端设备离开所述公共局域网，向所述认证服务器发送用户离网消息，所述用户离网消息用于触发所述认证服务器判断所述终端设备是否在第二预定时长内重新接入所述公共局域网；
    若接收到所述认证服务器反馈的新合法用户信息列表，则将存储的所述合法用户信息列表替换为所述新合法用户信息列表。
  6. 一种终端设备接入控制方法，包括：
    获取在网设备的设备标识；
    发送所述在网设备的设备标识至公共局域网的接入设备，所述公共局域网由至少两个接入设备提供的无线局域网形成。
  7. 如权利要求6所述的终端设备接入控制方法，其特征在，所述发送所述在网设备的设备标识至公共局域网的各接入设备包括：
    确定形成所述公共局域网的接入设备；
    构建包括至少一条合法用户信息项的合法用户信息列表，所述合法用户信息项包括合法用户的设备标识；
    发送所述合法用户信息列表至所述接入设备。
  8. 如权利要求7所述的终端设备接入控制方法，其中，在发送所述合法用户信息列表至所述接入设备之后，还包括：
    接收接入设备发送的用户离网消息；
    判断所述用户离网消息对应的终端设备是否在第二预定时长内重新接入所述公共局域网；
    若否，则删除所述合法用户信息列表中所述设备标识匹配的合法用户信息项，生成新合法用户信息列表；
    发送所述新合法用户信息列表至所述接入设备。
  9. 如权利要求6至8任一项所述的终端设备接入控制方法，其中，所述在网设备的设备标识包括：
    接收管理人员配置的合法用户的设备标识，作为所述在网设备的设备标识；
    和/或，
    接收接入设备发送的身份认证信息，对所述身份认证信息进行认证，若认证通过，则将所述用户认证信息对应的设备标识作为所述在网设备的设备标识。
  10. 一种终端设备接入控制方法，包括：
    认证服务器获取在网设备的设备标识，发送所述在网设备的设备标识至公共局域网的接入设备，所述公共局域网由至少两个接入设备提供的无线局域网形成；
    所述接入设备在检测到终端设备接入无线局域网的接入请求后，获取所述终端设备的设备标识，根据所述终端设备的设备标识和所述在网设备的设备标识，判断所述终端设备是否为在网设备；对所述终端设备执行与判断结果对应的控制操作。
  11. 一种接入设备，包括：通信模块及处理器，其中，
    所述通信模块配置为提供无线局域网，并与终端设备及认证服务器进行通信；
    所述处理器配置为在检测到终端设备接入无线局域网的接入请求后，获取所述终端设备的设备标识，根据所述终端设备的设备标识和在网设备的设备标识，判断所述终端设备是否为在网设备，对所述终端设备执行与判断结果对应的控制操作。
  12. 如权利要求11所述的接入设备，其中，所述通信模块配置为接收认证服务器下发的合法用户信息列表，所述合法用户信息列表包括至少一条合法用户信息项，所述合法用户信息项包括合法用户的设备标识，将所述合法用户的设备标识作为所述在网设备的设备标识。
  13. 如权利要求11或12所述的接入设备，其中，所述处理器还配置为在为所述终端设备提供无线接入服务之后，检测所述终端设备是否离开所述无线局域网；在检测到所述终端设备离开所述无线局域网后，判断所述通信模块是否在第一预定时长内接收到认证服务器转发的终端接入信息，其中，所述终端接入信息为形成公共局域网的其他接入设备在为所述终端设备提供无线接入服务后生成的信息，所述公共局域网由至少两个接入设备提供的无线局域网形成；若没有接收到所述终端接入信息，则认为所述终端设备离开所述公共局域网，通过所述通信模块向所述认证服务器发送用户离网消息，所述用户离网消息用于触发所述认证服务器判断所述终端设备是否在第二预定时长内重新接入所述公共局域网；若通过所述通信模块接收到所述认证服务器反馈的新合法用户信息列表，则将存储的所述合法用户信息列表替换为所述新合法用户信息列表。
  14. 一种认证服务器，包括：认证模块及处理器，
    所述认证模块配置为与接入设备进行通信；
    所述处理器配置为获取在网设备的设备标识，发送所述在网设备的设备标识至公共局域网的接入设备；所述公共局域网由至少两个接入设 备提供的无线局域网形成。
  15. 如权利要求14所述的认证服务器，其中，所述处理器配置为：确定形成所述公共局域网的接入设备；构建包括至少一条合法用户信息项的合法用户信息列表，所述合法用户信息项包括合法用户的设备标识；发送所述合法用户信息列表至所述接入设备。
  16. 如权利要求15所述的认证服务器，其中，所述处理器在发送所述合法用户信息列表至所述接入设备之后，还配置为：接收接入设备发送的用户离网消息；判断所述用户离网消息对应的终端设备是否在第二预定时长内重新接入所述公共局域网；若否，则删除所述合法用户信息列表中所述设备标识匹配的合法用户信息项，生成新合法用户信息列表；发送所述新合法用户信息列表至所述接入设备。
  17. 如权利要求14至16任一项所述的认证服务器，其中，所述认证模块配置为：接收管理人员配置的合法用户的设备标识，作为所述在网设备的设备标识；和/或，接收接入设备发送的身份认证信息，对所述身份认证信息进行认证，若认证通过，则将所述身份认证信息对应的设备标识作为所述在网设备的设备标识。
  18. 一种终端设备接入控制系统，包括：如权利要求14至17任一项所述的认证服务器，及多个接入设备，所述多个接入设备的无线局域网形成公共局域网；所述多个接入设备中的至少一个为如权利要求11至13任一项所述的接入设备，其中，
    所述认证服务器配置为获取在网设备的设备标识，发送所述在网设备的设备标识至公共局域网的接入设备；
    所述接入设备配置为在检测到终端设备接入无线局域网的接入请求后，获取所述终端设备的设备标识，根据所述终端设备的设备标识及所述在网设备的设备标识，对所述终端设备执行与判断结果对应的控制操 作。
  19. 一种计算机存储介质，所述计算机存储介质中存储有计算机可执行指令，该计算机可执行指令配置为执行权利要求1-5任一项所述的终端设备接入控制方法，或者权利要求6-9任一项所述的终端设备接入控制方法，或者权利要求10所述的终端设备接入控制方法。
PCT/CN2017/109984 2017-04-27 2017-11-08 接入设备、认证服务器、终端设备接入控制方法及系统 WO2018196329A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
EP17907831.6A EP3618477A4 (en) 2017-04-27 2017-11-08 ACCESS DEVICE, AUTHENTICATION SERVER AND METHOD AND SYSTEM FOR CONTROLLING ACCESS TO A TERMINAL DEVICE

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201710288872.6 2017-04-27
CN201710288872.6A CN108811043B (zh) 2017-04-27 2017-04-27 接入设备、认证服务器、终端设备接入控制方法及系统

Publications (1)

Publication Number Publication Date
WO2018196329A1 true WO2018196329A1 (zh) 2018-11-01

Family

ID=63919424

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/109984 WO2018196329A1 (zh) 2017-04-27 2017-11-08 接入设备、认证服务器、终端设备接入控制方法及系统

Country Status (3)

Country Link
EP (1) EP3618477A4 (zh)
CN (1) CN108811043B (zh)
WO (1) WO2018196329A1 (zh)

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113691519A (zh) * 2021-08-18 2021-11-23 绿能慧充数字技术有限公司 一种云服务统一管理访问权限的离网设备集控方法
CN113746864A (zh) * 2021-09-22 2021-12-03 中国联合网络通信集团有限公司 用户终端的认证方法、装置、设备、存储介质
CN115021936A (zh) * 2022-06-10 2022-09-06 中国南方电网有限责任公司 一种远端站点的终端设备安全接入认证授权方法及系统
CN116669142A (zh) * 2023-07-26 2023-08-29 天津安力信通讯科技有限公司 一种屏蔽无线网络通信信号的方法

Families Citing this family (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113472714A (zh) * 2020-03-12 2021-10-01 华为技术有限公司 认证终端设备的方法及装置
CN112804684A (zh) * 2020-06-01 2021-05-14 苏州才豪电子科技有限公司 一种基于无线通信网络的网络接入系统
CN115243340A (zh) * 2021-04-06 2022-10-25 杭州海康威视数字技术股份有限公司 设备联动方法、系统、装置及电子设备
AU2021204609A1 (en) * 2021-06-25 2023-01-19 Sensetime International Pte. Ltd. Cluster management method and apparatus, electronic device and storage medium

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101707773A (zh) * 2009-11-23 2010-05-12 中国电信股份有限公司 Wlan接入网关、移动网与无线宽带网的融合方法和系统
US20100232409A1 (en) * 2009-03-16 2010-09-16 Samsung Electronics Co., Ltd. Method and system for connecting mobile communication terminal with access point
CN104284332A (zh) * 2014-09-26 2015-01-14 中兴通讯股份有限公司 一种鉴权方法及无线路由器
CN104812019A (zh) * 2015-03-13 2015-07-29 深信服网络科技（深圳）有限公司 无线网络的接入方法、无线接入设备及无线控制设备
CN106535155A (zh) * 2016-10-14 2017-03-22 上海斐讯数据通信技术有限公司 一种无线终端进行无线漫游的方法、装置和系统

Family Cites Families (12)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
AU2003230389A1 (en) * 2002-05-13 2003-11-11 Thomson Licensing S.A. Seamless public wireless local area network user authentication
KR100448318B1 (ko) * 2002-11-08 2004-09-16 삼성전자주식회사 무선망에서의 핸드오프방법
CN102638797B (zh) * 2012-04-24 2016-08-03 华为技术有限公司 接入无线网络的方法、终端、接入网节点和鉴权服务器
CN104581718A (zh) * 2013-10-09 2015-04-29 中兴通讯股份有限公司 一种实现安全接入的方法、系统及无线网关设备
US9693296B2 (en) * 2014-07-17 2017-06-27 Xiaomi Inc. Network connection method and apparatus
CN104159275B (zh) * 2014-07-17 2015-12-09 小米科技有限责任公司 网络连接方法及装置
CN105025484B (zh) * 2015-06-12 2018-07-06 广东欧珀移动通信有限公司 接入Wi-Fi热点的方法及装置
CN105246073B (zh) * 2015-08-28 2019-06-21 深圳市信锐网科技术有限公司 无线网络的接入认证方法及服务器
CN105472610A (zh) * 2015-11-20 2016-04-06 上海斐讯数据通信技术有限公司 无线路由器登录管理方法及装置
CN105376739B (zh) * 2015-12-04 2019-10-11 上海斐讯数据通信技术有限公司 网络认证方法及系统
CN105516960B (zh) * 2015-12-09 2020-01-07 上海斐讯数据通信技术有限公司 无感知认证方法系统，基于该方法系统的管理方法、系统
CN105897724A (zh) * 2016-05-05 2016-08-24 张胜利 无线终端通过胖ap联网的方法及在胖ap间漫游的方法

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20100232409A1 (en) * 2009-03-16 2010-09-16 Samsung Electronics Co., Ltd. Method and system for connecting mobile communication terminal with access point
CN101707773A (zh) * 2009-11-23 2010-05-12 中国电信股份有限公司 Wlan接入网关、移动网与无线宽带网的融合方法和系统
CN104284332A (zh) * 2014-09-26 2015-01-14 中兴通讯股份有限公司 一种鉴权方法及无线路由器
CN104812019A (zh) * 2015-03-13 2015-07-29 深信服网络科技（深圳）有限公司 无线网络的接入方法、无线接入设备及无线控制设备
CN106535155A (zh) * 2016-10-14 2017-03-22 上海斐讯数据通信技术有限公司 一种无线终端进行无线漫游的方法、装置和系统

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3618477A4 *

Cited By (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113691519A (zh) * 2021-08-18 2021-11-23 绿能慧充数字技术有限公司 一种云服务统一管理访问权限的离网设备集控方法
CN113691519B (zh) * 2021-08-18 2023-09-01 绿能慧充数字技术有限公司 一种云服务统一管理访问权限的离网设备集控方法
CN113746864A (zh) * 2021-09-22 2021-12-03 中国联合网络通信集团有限公司 用户终端的认证方法、装置、设备、存储介质
CN115021936A (zh) * 2022-06-10 2022-09-06 中国南方电网有限责任公司 一种远端站点的终端设备安全接入认证授权方法及系统
CN115021936B (zh) * 2022-06-10 2023-10-27 中国南方电网有限责任公司 一种远端站点的终端设备安全接入认证授权方法及系统
CN116669142A (zh) * 2023-07-26 2023-08-29 天津安力信通讯科技有限公司 一种屏蔽无线网络通信信号的方法
CN116669142B (zh) * 2023-07-26 2023-12-29 天津安力信通讯科技有限公司 一种屏蔽无线网络通信信号的方法

Also Published As

Publication number Publication date
CN108811043A (zh) 2018-11-13
CN108811043B (zh) 2022-06-10
EP3618477A4 (en) 2020-04-29
EP3618477A1 (en) 2020-03-04

Similar Documents

Publication Publication Date Title
WO2018196329A1 (zh) 接入设备、认证服务器、终端设备接入控制方法及系统
US11212678B2 (en) Cross access login controller
US9918353B2 (en) 802.1X access session keepalive method, device, and system
KR102224368B1 (ko) D2D(device to device) 통신에서의 과금 정보 기록을 위한 방법 및 시스템
WO2016155298A1 (zh) 一种中继ue接入控制方法及装置
US9538357B2 (en) Method and apparatus for processing D2D device identity
EP3200486B1 (en) Connection establishment method, device, and system
CN104104516A (zh) 一种Portal认证方法和设备
WO2014176964A1 (zh) 一种通信管理方法及通信系统
WO2015165149A1 (zh) 配置方法、ProSe密钥管理功能实体、终端、系统和存储介质
WO2012094879A1 (zh) 一种mtc服务器共享密钥的方法及系统
CN109413649A (zh) 一种接入认证方法及装置
WO2012109823A1 (zh) 一种机器类型通信设备的拥塞控制方法及系统
JP2020501440A (ja) 緊急番号設定方法、取得方法および装置
EP3855695B1 (en) Access authentication
CN103384365A (zh) 一种网络接入方法、业务处理方法、系统及设备
CN101697550A (zh) 一种双栈网络访问权限控制方法和系统
CN105592433B (zh) 设备到设备限制发现业务广播、监听方法、装置及系统
EP2955945B1 (en) Method and system for implementing authentication and accounting in interaction between wireless local area network and fixed network
WO2016090578A1 (zh) 认证的处理方法、装置和终端
WO2009092306A1 (zh) 网络选择方法、网元设备和网络系统
CN104333854B (zh) WiFi计费方法和系统
WO2016206387A1 (zh) 一种接入孤立网络的鉴权认证方法及系统
EP4203392A1 (en) Authentication support for an electronic device to connect to a telecommunications network
CN103929726A (zh) 无线局域网络与固网交互中接入控制相关方法及系统

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17907831

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 2017907831

Country of ref document: EP

Effective date: 20191127