CN105871853A - Portal authenticating method and system - Google Patents

Abstract

The present invention provides an entry authentication method and system, wherein the method includes: the terminal sends a first HTTP request to the access point, and receives the first HTTP response returned by the access point, the status code of the first HTTP response includes The redirection jump code recognized by the browser, the redirection jump code includes the uniform resource locator of the entry authentication; the terminal obtains the uniform resource locator of the entry authentication in the first HTTP response, and based on the URL of the entry authentication The Uniform Resource Locator requests entry authentication from the authentication server. The invention obviously reduces a large number of invalid HTTP data packets to the authentication server, reduces the processing pressure of the authentication server, and thus provides better network services for the access point.

Description

A kind of entrance authentication method and system

technical field

The embodiments of the present invention relate to the technical field of communications, and in particular to an entry authentication method and system.

Background technique

Today's era is an era of mobile Internet. In many public places, such as hotels, coffee shops, schools, stations, shopping malls and other places with a large number of people, in order to retain customers and solve customers' online problems when shopping and waiting , often configure wireless access points to provide customers with access to the Internet, and this traditional password input method not only brings great inconvenience to management, but also has a certain degree of insecurity. Therefore, there are a large number of wireless WIFI networks in both homes and public environments, especially in public commercial environments, where people usually use their mobile devices to access external Internet networks, and businesses in commercial environments are more Pay attention to commercial interests, so generally do not provide "free" wireless network for users to use. The wireless network provided by the merchant often requires Portal authentication, also known as entrance authentication. Users use mobile phone number, QQ account, WeChat account or Weibo account to verify Authentication online. The Portal authentication method has the advantages of not needing to install an authentication client, reducing the maintenance workload of the client, facilitating operation, enabling business development on the Portal page, and mature technology, so it is widely used in networks such as operators and schools.

At present, the hook function is often defined in the embedded Linux kernel, then hijacks and parses the HTTP message sent by the user terminal to the access point, obtains some network information from it, and immediately constructs an HTTP message whose status code is "302 Found". The Location field in the header of the 302 Found status code data packet contains the URL (Uniform Resoure Locator, Uniform Resource Locator) of the authentication server set. After the HTTP data packet is constructed, it is sent to the user terminal through the kernel message data sending function. When the user terminal receives the response packet with the 302Found status code, it parses out the URL of the authentication server, and obtains the authentication page from the authentication server again.

However, this interaction method has defects. For example, when the current smart terminal is turned on, a large number of applications (APP) are started in the background. After the terminal is connected to the WIFI network, these APPs will also communicate with the server and send a large number of HTTP packets. , after accessing the response 302 status code packet, the application background will also connect to the authentication server, and the application itself cannot display the obtained authentication page, resulting in a large amount of invalid HTTP to the server. If the authentication server hardware configuration is too low, or supports If the number of concurrency is too small, in severe cases, HTTP messages from the browser may not be processed in time and may be lost.

Contents of the invention

The invention provides an entry authentication method and system, which can significantly reduce a large number of invalid HTTP data packets sent to the authentication server, reduce the processing pressure of the authentication server, and thus provide better network services for the access point.

The present invention provides an entry authentication method, which is applied to a terminal, including: the terminal sends a first HTTP request to an access point, and receives a first HTTP response returned by the access point, and the status of the first HTTP response The code includes a redirection jump code based on browser identification, and the redirection jump code includes the uniform resource locator of the entry authentication; the terminal acquires the uniform resource locator of the entry authentication in the first HTTP response, and based on the The uniform resource locator of the entry authentication requests the entry authentication from the authentication server.

Further, the redirection jump code based on browser recognition is a redirection jump code written in javascript language; the terminal sends the first HTTP request to the access point, and receives the first HTTP response returned by the access point, Including: the terminal sends a first HTTP request to the access point, if the MAC address of the terminal is not in the forwarding list of the access point, the access point hijacks the first HTTP request, and returns to the terminal including the use The first HTTP response of the redirection jump code written in javascript language.

Further, the terminal acquires the uniform resource locator of the entry authentication in the first HTTP response, and requests the entry authentication from the authentication server based on the uniform resource locator of the entry authentication, including: the access point pre-configures the uniform resource locator of the entry authentication resource locator, and save the uniform resource locator of the entry authentication in the forwarding list of the access point; the terminal sends a second HTTP request to the access point, if the second HTTP request includes the access point The access point forwards the second HTTP request to the authentication server.

Further, after forwarding the second HTTP request to the authentication server, the method further includes: after the authentication server receives the second HTTP request, returning a second HTTP response including the entry authentication request page data to the terminal through the access point; After receiving the second HTTP response, the terminal identifies the entry authentication request page data and displays the entry authentication request page through the browser; after obtaining the entry authentication information through the entry authentication request page, the terminal carries the entry authentication information in the third HTTP request, and forward the third HTTP request to the authentication server through the access point.

Further, after forwarding the third HTTP request to the authentication server, the method further includes: after the authentication server receives the third HTTP request, obtaining entry authentication information; if it is determined that the authentication is passed according to the entry authentication information, then Passed authentication information is carried in the third HTTP response, and the third HTTP response will be returned to the terminal through the access point; three HTTP responses, and return the third HTTP response to the terminal through the access point.

Further, the method further includes: if it is determined according to the entry authentication information that the authentication is passed, the access point adds the MAC address of the authenticated terminal to the forwarding list.

An embodiment of the present invention provides an entry authentication system, including: a terminal, configured to send a first HTTP request to an access point; an access point, configured to receive the first HTTP request and return a first HTTP response, the The status code of the first HTTP response includes a redirection jump code based on browser recognition, and the redirection jump code includes a uniform resource locator for entry authentication; the terminal is also used to receive the first HTTP response, and obtain the uniform resource locator of the entry authentication from the first HTTP response, and request entry authentication to the authentication server based on the uniform resource locator of the entry authentication; the authentication server is configured to perform entry authentication on the terminal.

Further, the redirection jump code based on browser recognition is a redirection jump code written in javascript language; the access point receives the first HTTP request and returns the first HTTP response, specifically : The access point receives the first HTTP request sent by the terminal, if the MAC address of the terminal is not in the forwarding list of the access point, the access point hijacks the first HTTP request, and returns to the terminal including the The first HTTP response of the redirection jump code written in javascript language.

Further, the access point is further configured to: pre-configure the uniform resource locator of the entry authentication, and store the uniform resource locator of the entry authentication in the forwarding list of the access point; Obtain the uniform resource locator of the entry authentication in the first HTTP response, and request the entry authentication to the authentication server based on the uniform resource locator of the entry authentication, specifically: the terminal sends a second HTTP request to the access point, if the second The uniform resource locator of the entry authentication in the HTTP request is in the forwarding list of the access point, then the access point forwards the second HTTP request to the authentication server, and after the authentication server receives the second HTTP request, The second HTTP response that includes the entry authentication request page data is returned to the terminal through the access point; after receiving the second HTTP response, the terminal identifies the entry authentication request page data and displays the entry authentication request page through the browser; the terminal passes the entry authentication After the request page obtains the entry authentication information, the entry authentication information is carried in the third HTTP request, and the third HTTP request is forwarded to the authentication server through the access point; the authentication server receives the third HTTP request Afterwards, the entry authentication information is obtained; if it is determined that the authentication is passed according to the entry authentication information, the authentication information will be carried in the third HTTP response, and the third HTTP response will be returned to the terminal through the access point; if If it is determined that the authentication is not passed according to the entry authentication information, the authentication failure information is carried in the third HTTP response, and the third HTTP response is returned to the terminal through the access point.

Further, the access point is further configured to: add the MAC address of the authenticated terminal to the forwarding list if it is determined that the authentication is passed according to the entry authentication information.

In the existing technology, not only HTTP data packets are sent during Portal authentication, but also running applications often send HTTP data packets intermittently, resulting in a large number of invalid HTTP data packets being sent to the authentication server, which may cause HTTP error messages. The defect that the text cannot be processed in time and lost, the entrance authentication method and system of the present invention, by providing a kind of HTTP response packet, as the response packet of Portal authentication, the status code of the response packet of this Portal authentication is different from the traditional Portal is 302 Found status code, the browser can jump to the Portal authentication server page only after receiving the response packet of Portal authentication; The authentication server reduces the processing pressure of the authentication server and provides better network services for the access point.

Description of drawings

In order to more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the following will briefly introduce the drawings that need to be used in the description of the embodiments or the prior art. Obviously, the accompanying drawings in the following description These are some embodiments of the present invention. Those skilled in the art can also obtain other drawings based on these drawings without creative work.

FIG. 1 is a schematic flow diagram of an entry authentication method in an embodiment of the present invention;

Fig. 2 is the comparative schematic diagram of the 200 OK status code of the first HTTP response and the 302 Found status code of the traditional HTTP response packet in the embodiment of the present invention;

Fig. 3 is a schematic diagram of the entrance authentication method illustrated in the embodiment of the present invention;

FIG. 4 is a schematic diagram of the architecture of the entrance authentication system illustrated in the embodiment of the present invention.

detailed description

In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments It is a part of embodiments of the present invention, but not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by persons of ordinary skill in the art without creative efforts fall within the protection scope of the present invention.

In order to better understand the present invention, the technical points involved are briefly introduced below.

AP: Equivalent to a wireless switch, it is an access point for wireless terminals using a wired network. It is mainly used for home broadband, enterprise internal network deployment, and network deployment in business environments.

Cloud AC: That is, the wireless LAN access controller, which is responsible for summarizing the data of all APs and connecting them to the Internet. At the same time, it can remotely configure some device parameters of APs, such as bandwidth speed limit, Portal function, security function and other parameters.

Portal authentication: also known as web authentication, that is, to use the Internet, the user needs to perform identity authentication before using the Internet network.

The interaction process of traditional Portal authentication can be roughly as follows:

1. When an unauthenticated user accesses the network, enter an Internet address in the address bar of the web browser, then the HTTP request will be redirected to the web authentication home page of the Portal server when passing through the access device;

2. After the user enters the authentication information on the authentication home page/authentication dialog box and submits it, the Portal server will pass the user's authentication information to the access device;

3. The access device then communicates with the authentication/accounting server for authentication and accounting;

4. After the authentication is passed, if no security policy is adopted for the user, the access device will open the channel between the user and the Internet, allowing the user to access the Internet; if a security policy is adopted for the user, the client, the access device and the security policy server will Interaction, after passing the user's security check, the security policy server authorizes the user to access unrestricted resources according to the user's security.

However, currently, not only HTTP data packets are sent during Portal authentication, but also running applications often send HTTP data packets intermittently, causing a large number of invalid HTTP data packets to be sent to the authentication server, which may cause HTTP packets to fail. lost in time.

With respect to prior art, this method embodiment is by providing a kind of HTTP response packet, as the response packet of Portal authentication, the status code of the response packet of this Portal authentication is to be different from traditional Portal is 302 Found status code, browser receives Only after the Portal authentication response packet can jump to the Portal authentication server page; if the response packet is not Portal authentication is received, the connection will end.

Fig. 1 is a schematic flow chart of the entrance authentication method in the embodiment of the present invention, as shown in Fig. 1, including:

Step S11, if the access point receives the first HTTP request from the terminal, it returns a first HTTP response to the terminal, the status code of the first HTTP response includes a redirection jump code based on browser recognition, and the redirection The redirection code includes the Portal URL.

Step S12, if the access point receives the second HTTP request including the Portal URL sent by the terminal, it requests Portal authentication from the authentication server according to the Portal URL.

Compared with the prior art, after the terminal sends the first HTTP request for Portal authentication to the access point in the embodiment of the present invention, the access point does not directly forward it to the upper-level network, but returns a non-return request to the terminal. The first HTTP response with the traditional 302 Found status code.

Compared with the prior art, the status code of the first HTTP response is different from the 302 Found status code of the traditional HTTP response packet. For example, the status code of the first HTTP response can be set to 200 OK. Of course, the name of the status code can be other The expression form is not specifically limited here.

In the embodiment of the present invention, the comparison between the 200 OK status code of the first HTTP response and the 302 Found status code of the traditional HTTP response packet is shown in FIG. 2 . The 200OK status code of the first HTTP response includes a redirection jump code written in javascript language, and the redirection jump code includes a Portal URL, so the Portal URL of the authentication server also needs to be pre-configured on the access point.

Because usually only the browser supports the code written in the javascript language, after the terminal obtains the 200 OK status code of the first HTTP response, it can initiate the second HTTP on the browser page according to the Portal URL in the redirection jump code written in the javascript language. request, so that the access point can request Portal authentication from the authentication server according to the Portal URL. And APP usually does not support code written in javascript language, so it will not jump to the authentication server. It can be seen that the present invention can obviously reduce a large number of invalid HTTP data packets to the authentication server, thereby reducing the processing pressure of the authentication server.

Fig. 3 is a schematic diagram of an entrance authentication method illustrated in an embodiment of the present invention. To access the Sina domain name "sina.com.cn" as an example, you need to configure the authentication server Portal URL to the AP, such as "portal.com". As shown in Figure 3, including:

The terminal accesses sina.com.cn and sends the first http request to the AP. After the AP detects the first http request, it does not directly forward it to the upper-level network. Instead, the AP hijacks the first http request and then forges a The first http response whose status code is 200 OK is returned to the terminal.

After the terminal receives the first http request, it parses it through the browser of the terminal, and finds that the status code of the http request contains a redirection code written in javascript language, and the Portal URL in the code can be redirected according to the redirection The address sends a second httprequest to the AP.

After receiving the second http request, the AP forwards the second http request to the authentication server. It should be noted that this Portal URL can be placed in the AP's whitelist in advance, and will not be hijacked by the AP, otherwise the AP will also hijack the Portal URL when it receives the second message, resulting in a loop jump.

After receiving the second http request, the authentication server sends the Portal authentication request page data to the AP in the form of the second http response, and the AP forwards the data to the terminal after receiving the second http response.

After receiving the second http response, the terminal displays the portal authentication page through the browser, fills in the authentication information, and then sends the third http request including the Portal authentication data to the AP.

After receiving the third http request, the AP forwards the third http request to the authentication server.

After receiving the third http request, the authentication server obtains the Portal authentication data of the terminal. If the Portal authentication is passed, the Portal authentication passing information will be carried in the third http response and returned to the AP. The AP will add the MAC address information of the terminal that has passed the Portal authentication to the whitelist, and will no longer hijack all data packets of this terminal. If If the authentication fails, an authentication failure message is returned, and the user needs to re-authenticate until the authentication succeeds.

Fig. 4 is a schematic diagram of the architecture of the entrance authentication system in the embodiment of the present invention. As shown in Figure 4, an entry authentication system includes:

a terminal, configured to send a first HTTP request to the access point;

The access point is configured to receive the first HTTP request and return the first HTTP response, the status code of the first HTTP response includes a browser-based redirection jump code, and the redirection jump code Include the uniform resource locator of the entry authentication;

The terminal is further configured to receive the first HTTP response, and obtain a uniform resource locator of entry authentication from the first HTTP response, and request entry authentication to an authentication server based on the uniform resource locator of entry authentication;

The authentication server is configured to perform entry authentication on the terminal.

It should be noted that the authentication client in FIG. 4 is used as the above-mentioned terminal, the access device is used as the above-mentioned access point, and the Portal server is used as the above-mentioned authentication server. In addition, the entrance authentication system may also include a security policy server and an authentication and accounting server not shown in FIG. 4 , which are not limited here.

specifically,

The redirection jump code based on browser recognition is a redirection jump code written in javascript language.

The access point receives the first HTTP request and returns the first HTTP response, specifically: the access point receives the first HTTP request sent by the terminal, if the MAC address of the terminal is not forwarded by the access point list, the access point hijacks the first HTTP request, and returns to the terminal the first HTTP response including the redirection jump code written in javascript language.

The access point is further configured to: pre-configure the uniform resource locator of the entry authentication, and store the uniform resource locator of the entry authentication in the forwarding list of the access point.

The terminal acquires the uniform resource locator of the entry authentication from the first HTTP response, and requests the entry authentication from the authentication server based on the uniform resource locator of the entry authentication, specifically: the terminal sends a second HTTP request to the access point , if the uniform resource locator of the entry authentication in the second HTTP request is in the forwarding list of the access point, the access point forwards the second HTTP request to the authentication server, and the authentication server receives the After the second HTTP request, the terminal returns the second HTTP response including the entry authentication request page data to the terminal through the access point; after receiving the second HTTP response, the terminal identifies the entry authentication request page data and displays the entry authentication request page through the browser; After obtaining the entry authentication information through the entry authentication request page, the terminal carries the entry authentication information in the third HTTP request, and forwards the third HTTP request to the authentication server through the access point; the authentication server receives After the third HTTP request, obtain the entry authentication information; if it is judged that the authentication is passed according to the entry authentication information, the authentication information will be carried in the third HTTP response, and the third HTTP will be passed through the access point. The response is returned to the terminal; if it is judged that the authentication is not passed according to the entry authentication information, the authentication information is not passed in the third HTTP response, and the third HTTP response is returned to the terminal through the access point.

The access point is further configured to: add the MAC address of the authenticated terminal to the forwarding list if it is determined that the authentication is passed according to the entry authentication information.

The entrance authentication method and system that the embodiment of the present invention provides, by providing a kind of HTTP response packet, as the response packet of Portal authentication, the status code of the response packet of this Portal authentication is different from traditional Portal is 302 Found status code, browser Only after receiving the response packet for Portal authentication can you jump to the Portal authentication server page; if the response packet is not received for Portal authentication, this connection will be terminated, thereby significantly reducing a large number of invalid HTTP packets to the authentication server and reducing the authentication time. The server handles the stress and provides better network service to the access point.

The device embodiments described above are only illustrative, and the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in One place, or it can be distributed to multiple network elements. Part or all of the modules can be selected according to actual needs to achieve the purpose of the solution of this embodiment. It can be understood and implemented by those skilled in the art without any creative effort.

Through the above description of the implementations, those skilled in the art can clearly understand that each implementation can be implemented by means of software plus a necessary general hardware platform, and of course also by hardware. Based on this understanding, the essence of the above technical solution or the part that contributes to the prior art can be embodied in the form of software products, and the computer software products can be stored in computer-readable storage media, such as ROM/RAM, magnetic discs, optical discs, etc., including several instructions to make a computer device (which may be a personal computer, server, or network device, etc.) execute the methods described in various embodiments or some parts of the embodiments.

Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that: it can still be Modifications are made to the technical solutions described in the foregoing embodiments, or equivalent replacements are made to some of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the various embodiments of the present invention.

Claims (10)

1. a portal authentication method, described method is applied in terminal, it is characterised in that including:

Terminal sends the first HTTP request to access point, and receives the HTTP that access point returns Response, the conditional code of described first http response includes that redirection based on browser identification redirects Code, described redirection redirects code and includes the URL of portal authentication；

Terminal obtains the URL of the portal authentication in the first http response, and based on The URL of described portal authentication asks portal authentication to certificate server.

Portal authentication method the most according to claim 1, it is characterised in that: described based on clear It is that the redirection using javascript language to write redirects generation that the redirection of device identification of looking at redirects code Code；

Terminal sends the first HTTP request to access point, and receives the HTTP that access point returns Response, including:

Terminal sends the first HTTP request to access point, if the MAC Address of described terminal does not has In the forwarding list of access point, then access point kidnaps described first HTTP request, and to terminal Return the HTTP sound including that the redirection that described use javascript language is write redirects code Should.

Portal authentication method the most according to claim 2, it is characterised in that: described terminal obtains Take the URL of portal authentication in the first http response, and recognize based on described entrance The URL of card asks portal authentication to certificate server, including:

Access point is pre-configured with the URL of portal authentication, and by described portal authentication URL is saved in the forwarding list of access point；

Terminal sends the second HTTP request to access point, if wrapped in described second HTTP request Include the URL of portal authentication in the forwarding list of described access point, then access point will Described second HTTP request is transmitted to certificate server.

Portal authentication method the most according to claim 3, it is characterised in that: by described second After HTTP request is transmitted to certificate server, also include:

After certificate server receives described second HTTP request, returned to terminal by access point The second http response including portal authentication requests for page data；

After terminal receives the second http response, identify portal authentication requests for page data and pass through Browser display portal authentication requests for page；

After terminal gets portal authentication information by described portal authentication requests for page, by described enter Mouth authentication information carries in the 3rd HTTP request, and by access point by described 3rd HTTP Request is transmitted to certificate server.

Portal authentication method the most according to claim 4, it is characterised in that: by the described 3rd After HTTP request is transmitted to certificate server, also include:

After certificate server receives described 3rd HTTP request, obtain portal authentication information；

If judging by certification according to described portal authentication information, then will be taken by authentication information Band is in the 3rd http response, and described 3rd http response will be returned to by access point Terminal；

If judging not over certification according to described portal authentication information, then will be not over recognizing Card information is carried in the 3rd http response, and will be rung by described 3rd HTTP by access point Terminal should be returned to.

Portal authentication method the most according to claim 5, it is characterised in that: described method is also Including:

If judging that access point is by by certification by certification according to described portal authentication information The MAC Address of terminal adds in forwarding list.

7. a portal authentication system, it is characterised in that including:

Terminal, for sending the first HTTP request to access point；

Access point, is used for receiving described first HTTP request, and the first http response returned, The conditional code of described first http response includes that redirection based on browser identification redirects code, Described redirection redirects code and includes the URL of portal authentication；

Described terminal, is additionally operable to receive described first http response, and from a described HTTP Response obtains the URL of portal authentication, unified resource based on described portal authentication Finger URL asks portal authentication to certificate server；

Certificate server, for carrying out portal authentication to described terminal.

Portal authentication system the most according to claim 7, it is characterised in that: described based on clear It is that the redirection using javascript language to write redirects generation that the redirection of device identification of looking at redirects code Code；

Described access point receives described first HTTP request, and the first http response returned, Particularly as follows:

Access point receives the first HTTP request that terminal sends, if the MAC Address of described terminal Not in the forwarding list of access point, then described first HTTP request of access point abduction, and to Terminal returns and includes that the redirection that described use javascript language is write redirects the first of code Http response.

Portal authentication system the most according to claim 8, it is characterised in that: described access point, It is additionally operable to: be pre-configured with the URL of portal authentication, and by the system of described portal authentication One URLs is saved in the forwarding list of access point；

Described terminal obtains the URL of portal authentication from described first http response, URL based on described portal authentication asks portal authentication to certificate server, specifically For:

Terminal sends the second HTTP request to access point, if in described second HTTP request The URL of portal authentication is in the forwarding list of described access point, then access point is by institute Stating the second HTTP request and be transmitted to certificate server, certificate server receives described 2nd HTTP After request, included the 2nd HTTP of portal authentication requests for page data to terminal return by access point Response；After terminal receives the second http response, identify portal authentication requests for page data and lead to Cross browser display portal authentication requests for page；

After terminal gets portal authentication information by described portal authentication requests for page, by described enter Mouth authentication information carries in the 3rd HTTP request, and by access point by described 3rd HTTP Request is transmitted to certificate server；After certificate server receives described 3rd HTTP request, obtain Taking mouth authentication information；If judging by certification according to described portal authentication information, then will be logical Cross authentication information to carry in the 3rd http response, and will be by access point by described 3rd HTTP Response returns to terminal；If judging not over certification according to described portal authentication information, then To carry in the 3rd http response not over authentication information, and will be by access point by described 3rd http response returns to terminal.

Portal authentication system the most according to claim 9, it is characterised in that: described access Point, is additionally operable to:

If judging by certification according to described portal authentication information, then by by the terminal of certification MAC Address add in forwarding list.